Penedo do Bufo website and services
Version 1.0 – 18 July 2026
PART I – LEGAL NOTICE
1. Website publisher and operator
The website https://penedodobufo.com is published and operated by:
- Company name: Penedo de Cima, Lda.
- NIPC and company registration number: 517 362 821
- Registered office: Estrada Municipal 124, apartado 339Z, Cerro das Casas, 8100-168 Salir, Loulé, Portugal
- Establishment address: Penedo do Bufo, Caminho Cerro das Casas 10, Cerro das Casas, 8100-168 Salir, Loulé, Portugal
- Email: info@penedodobufo.com
- Website: https://penedodobufo.com
- Publication director: the management of Penedo de Cima, Lda.
- RNAL registration number :3520593, 3520647 & 3520658.
Local accommodation activity is carried on under the Portuguese Alojamento Local regime and under the supervision of the competent authorities, including Loulé Municipal Council and the legally designated supervisory authorities.
2. Purpose of the website and published information
The website presents the estate, its accommodation, areas, services, indicative rates, availability and booking options. Photographs and descriptions are intended to inform visitors as accurately as possible. The final contractual features and terms are those communicated in the offer, booking confirmation, Rental Agreement and applicable GRT.
Penedo do Bufo endeavours to keep published information accurate and may update it. Opening hours, distances, transport prices, local recommendations, partner availability and other third-party information are indicative and may change independently of its control.
3. Intellectual property
The website structure, text, photographs, videos, graphics, logos, trade marks, plans, translations and other content are protected by applicable intellectual-property rights. Unless authorised in writing or permitted by law, any reproduction, adaptation, substantial extraction, distribution or commercial use is prohibited.
Testimonials are published with the required permission and may be shortened for layout purposes without altering their meaning.
4. External links and availability
The website may contain links to platforms, partners, social networks or information websites. Penedo do Bufo does not control their content, availability or privacy practices. Users should consult the relevant third-party terms.
Penedo do Bufo takes reasonable steps to maintain the availability and security of the website but cannot guarantee that it will be entirely free from interruption, error or attack. Any issue may be reported to info@penedodobufo.com.
5. Complaints and consumer dispute resolution
The Complaints Book is available on the premises. The electronic Complaints Book is available online.
Consumers may also contact the Algarve Consumer Information, Mediation and Arbitration Centre (CIMAAL), Avenida 5 de Outubro, No. 55, ground floor right, 8000-075 Faro, Portugal; +351 289 823 135; info@consumoalgarve.pt.
PART II – PRIVACY POLICY
6. Data controller
The data controller is Penedo de Cima, Lda., identified in Clause 1. For any question about personal data or to exercise a right, contact info@penedodobufo.com.
No data protection officer has been appointed because this is not required for the processing currently envisaged. The position will be reassessed if the activities change.
7. Data we may process
- Contact and booking enquiries: name, email, telephone number, language, message, requested dates, group composition and accommodation preferences.
- Contract and financial management: address, invoicing details, tax number, amount, payment status, invoice, security deposit and contract correspondence.
- Guest registration: identity, nationality, date and place of birth, identity or travel document and arrival/departure dates where required by law, particularly for foreign guests.
- Stay arrangements: bed configuration, cot, dietary requirements, allergies, accessibility needs, times, services and activities requested.
- Members’ Area: login, email, connection history, preferences and content viewed where necessary for operation.
- Technical data: IP address, security logs, browser, device, language, pages viewed and cookie-consent choices.
- Marketing communications: email address, preferences and sending or unsubscribe history where permitted.
- Data from an intermediary: information supplied by a booking platform, organiser, agency or lead guest, insofar as necessary to provide the service.
- Health, allergy, disability or other special-category data is requested only where useful for arranging the stay. It is provided voluntarily, processed in a limited manner and, where required, on the basis of explicit consent. Please do not send unnecessary medical details.
8. Purposes and legal bases
- Responding to enquiries and preparing a booking: pre-contractual steps taken at the request of the data subject.
- Confirming, managing and performing the stay: performance of the contract.
- Managing payments, deposits, invoices and accounting duties: performance of the contract and legal obligations.
- Registering and reporting guest data to authorities: Portuguese legal obligation.
- Arranging services and meeting specific needs: performance of the contract; explicit consent where sensitive data is required.
- Securing the website, preventing fraud and defending legal rights: legitimate interests, subject to the rights and freedoms of individuals.
- Managing the Members’ Area: performance of the requested service and legitimate interest in its security.
- Measuring audience or personalising the website through non-essential cookies: prior consent in accordance with the Cookie Policy.
- Sending offers or marketing information: consent or another basis expressly permitted by law; unsubscribe at any time.
9. Mandatory information
Fields marked as mandatory are required to answer an enquiry, conclude or perform the contract, issue an invoice or comply with a legal obligation. Without this information, Penedo do Bufo may be unable to confirm or provide the stay. Other information is optional.
10. Recipients
- Within the limits of necessity, data may be accessible to authorised management staff and persons responsible for reception, housekeeping, maintenance or arranging services; website hosting, maintenance, email, booking management, payment, accounting, storage and IT-security providers acting as processors or independent controllers according to their role; chefs, caterers, transport providers, guides or other partners chosen by the guest, solely to provide the requested service; banks, payment providers, insurers, advisers and competent authorities where necessary; and tax, municipal, police or guest-registration authorities where required by law.
- Penedo do Bufo does not sell personal data.
11. Transfers outside the European Economic Area
Some technical providers or platforms may process data outside the European Economic Area. In that case, the transfer relies on an adequacy decision, European Commission standard contractual clauses or another safeguard recognised by the GDPR. Further information may be requested from info@penedodobufo.com.
12. Retention periods
- Enquiries not resulting in a booking: up to three years after the last contact, unless the person objects or evidence must be retained longer.
- Booking files and contracts: for the contractual relationship and thereafter for the periods necessary to establish and defend legal rights.
- Invoices and tax-relevant records: 10 years, or any longer period required in a particular case.
- Foreign-guest accommodation-record data: for the statutory period, normally one year from the day after departure is reported.
- Members’ Area: while the account remains active, followed by deletion or anonymisation after a reasonable period of inactivity unless a legal duty or request requires otherwise.
- Marketing communications: until consent is withdrawn or the legally relevant period after the last active contact expires.
- Technical and security logs: for a period proportionate to the purpose, generally from a few weeks to 12 months, unless an incident requires longer retention.
- Cookies: for the periods stated in the Cookie Policy and consent manager.
13. Individual rights
Subject to the GDPR, any person may request access, rectification, erasure, restriction, portability, or object to processing based on legitimate interests. Where processing is based on consent, consent may be withdrawn at any time without affecting prior lawful processing.
Requests should be sent to info@penedodobufo.com. Limited proof of identity may be requested where there is reasonable doubt. Penedo do Bufo normally responds within one month, extendable under the GDPR.
A complaint may be lodged with the Portuguese Data Protection Authority (CNPD), Avenida D. Carlos I, 134 – 1.º, 1200-651 Lisbon, Portugal; www.cnpd.pt.
14. Minors
Bookings must be made by an adult. Data relating to minors is supplied by their representatives or the lead guest and used only to organise the stay, observe capacity and comply with legal obligations.
15. Security and data breaches
Penedo do Bufo adopts reasonable technical and organisational measures to protect data against unauthorised access, loss, alteration or disclosure. Access is restricted according to role, and providers are selected with regard to their safeguards.
Where a breach is likely to create a high risk to individuals’ rights and freedoms, affected persons will be informed in accordance with legal requirements. As no transmission or storage method can be guaranteed to be 100% secure, do not send copies of documents or sensitive data by email unless requested.
16. Automated decision-making
Penedo do Bufo does not make decisions producing legal effects or similarly significantly affecting a person solely on the basis of automated processing.
17. Cookies and third-party services
The website uses strictly necessary cookies and, subject to consent, preference, analytics or third-party service cookies. Their operation, purposes and the means of changing choices are described in the Cookie Policy.
18. Policy updates
This policy may be amended to reflect changes to the website, providers or law. The date and version appear at the beginning of the document. Material changes will be brought to the attention of affected persons by an appropriate means.
19. Hosting, Technical Maintenance and Access to Data
The website is hosted by Infomaniak Network SA, whose infrastructure is located in Switzerland. As Switzerland benefits from an adequacy decision issued by the European Commission, data processing carried out within this framework is considered to provide an adequate level of protection within the meaning of the GDPR.
Technical maintenance, updates, security and the proper functioning of the website are handled by FDG Digital, a company established in Belgium (VAT BE 1033.045.446), acting as a technical service provider on behalf of Penedo do Bufo.
In the course of these activities, FDG Digital may need to access certain personal data on a strictly limited basis where such access is necessary to ensure the operation, maintenance or security of the website, resolve a technical incident, or carry out an intervention requested by the data controller.
FDG Digital does not use such data for any other purpose, does not sell it or disclose it to third parties, and is bound by an obligation of confidentiality. Access is restricted solely to authorised persons and only for the period necessary to carry out the assigned task.
All processing activities carried out by these service providers are performed exclusively on the instructions of Penedo de Cima, Lda. and in compliance with Regulation (EU) [text incomplete in the French original].
