Data Controller

Herdade da Lapa, Lda, NIF 514477717, based in Arraiolos, Évora, Portugal, is the controller responsible for processing your personal data, in accordance with the General Data Protection Regulation (GDPR — Regulation (EU) 2016/679) and applicable national legislation.

Contact: info@montedalapa.com

Data Collected and Purposes

We collect and process the following personal data for the purposes indicated:

  • Identification data (name, date of birth, nationality, ID/passport number and type): legal obligation — reporting to AIMA/SEF in accordance with internal security legislation and the Schengen Convention.
  • Contact data (email address, phone number): performance of the accommodation contract — sending booking confirmations, arrival instructions, and stay-related communications.
  • Payment data (transaction reference, last digits of card): performance of the contract and compliance with tax obligations. Full payment data is processed exclusively by the contracted payment processor and is not stored by Herdade da Lapa, Lda.
  • Communication data (emails and messages exchanged): management of the reservation and guest relationship, based on the controller's legitimate interest.

Data Sharing

Your data may be shared with the following parties, only to the extent necessary:

  • AIMA / SEF - legal obligation for foreign guests.
  • Booking platforms (e.g. Airbnb, Booking.com) - under their respective contracts and privacy policies.
  • Payment processors - to carry out financial transactions.
  • Tax and judicial authorities - when required by law.

We do not share personal data with third parties for marketing or advertising purposes.

Data Retention

  • Identification data for foreign guests: minimum period required by internal security legislation (refer to AIMA for current retention period).
  • Tax and billing data: 10 years, in accordance with the Tax Code.
  • Communication data: up to 2 years after the end of the contractual relationship.

Upon expiry of the retention period, data is securely deleted or anonymised.

Your Rights

Under the GDPR, you have the right to:

  • Access - obtain confirmation as to whether your data is being processed and access it.
  • Rectification - correct inaccurate or incomplete data.
  • Erasure - request deletion of your data, where applicable.
  • Restriction - restrict processing in certain circumstances.
  • Portability - receive your data in a structured, machine-readable format.
  • Objection - object to processing based on legitimate interest.

To exercise your rights, contact us using the details in section 1. You also have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD):

www.cnpd.pt

Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or improper disclosure.

Cookies

Our website may use essential technical cookies required for the site to function. If third-party or analytics cookies are used, a consent notice will be displayed upon your visit. For further information, please refer to our cookie policy (where applicable).

Changes

This Privacy Policy may be updated periodically. The current version is always available at www.montedalapa.com. Last updated: June 2026.