Privacy Policy

Personal Data Processing Notice
Last updated: 15/02/2026

1. Who we are and how to contact us
This Notice explains how Alma Terra Hotel Boutique & Spa (“Alma Terra”, “we”) collects, uses, shares, and protects personal data in the context of its activities, including through the website, reservations, communications, and the provision of hotel services, in accordance with the General Data Protection Regulation (GDPR) and applicable legislation.

Data Controller: Whispering Waves, Lda
Registered office: Rua Vale de Manso, Albufeira de Castelo de Bode, Aldeia do Mato, 2200-601 Abrantes, Portugal
Tax ID (VAT): PT518748146
Privacy contact: privacy@almaterrahotel.com

2. What personal data we process
Depending on the relationship and the type of interaction, we may process, among others, the following personal data:

• • Identification and contact data
  • • Name, email, phone number, address, country, language.
• • Reservation and stay data
  • • Dates, room type, preferences, special requests, stay history, communications with our team, and information required to deliver the service.
• • Billing and payment data
  • • Billing details, VAT number where applicable, transaction information and payment confirmations. We do not store card security codes. Payment processing is handled by specialized providers.
• • Legal compliance data
  • • Data required by law in the context of hotel operations, and tax and accounting obligations.
• • Website technical and usage data
  • • IP address, device identifiers, browser, operating system, pages visited, traffic source, events and interactions, and data obtained through cookies and similar technologies, where applicable.
• • Marketing and relationship data
  • • Communication preferences, subscriptions, interactions with campaigns and content, always under an appropriate legal basis.
• • Special categories of data
  • • Only when strictly necessary to provide services safely, for example food allergies, accessibility needs, or relevant restrictions. Always with enhanced safeguards and data minimization.
    
    

3. How we collect personal data

We mainly collect personal data:

• • directly from you, via forms, email, phone, online booking, check-in, and in-person interactions
• • through distribution and intermediary partners, such as travel agencies and OTAs, where applicable
• • through technical tools on the website, such as cookies and tags, where permitted
  
  

4. Purposes and legal bases for processing
We process personal data for the following purposes:

• • Managing reservations, stays, and delivering services
  • • Legal basis: performance of a contract, or pre-contractual steps.
• • Payments, invoicing, and accounting
  • • Legal basis: performance of a contract and legal obligation.
• • Operational management, quality, and service improvement
  • • Legal basis: legitimate interests, with proportionality assessment and data minimization.
• • Security, fraud prevention, and system protection
  • • Legal basis: legitimate interests, and legal obligation where applicable.
• • Service communications
  • • Confirmations, changes, assistance, pre-arrival and post-stay communications.
  • • Legal basis: performance of a contract and legitimate interests.
• • Marketing communications
  • • Newsletters, campaigns, and offers.
  • • Legal basis: consent, or legitimate interests where applicable, always with a simple opt-out option.
• • Legal claims and dispute management
  • • Legal basis: legitimate interests and the exercise of rights in judicial and administrative proceedings.
    
    

5. Cookies and similar technologies

The website may use cookies and similar technologies for:

• • technical operation and security
• • analytics and performance measurement
• • marketing and campaign measurement, where authorized

Alma Terra currently uses the following measurement and advertising technologies, where applicable and subject to cookie consent settings:

• • Google Analytics
• • Google Tag Manager
• • Meta Pixel
• • Google Ads

You can manage your preferences in the cookie banner and withdraw consent at any time through the website cookie manager.

6. Who we share personal data with
We may share personal data, strictly to the extent necessary, with:

• • Technology and operational service providers, including:
  • • Blastness, for the website and booking engine
  • • website hosting and maintenance providers
  • • the analytics and advertising tools listed in section 5
  • • support and security providers
• • Payment service providers
  • • Payment processing and fraud prevention are carried out by specialized providers, who may process the data required to execute the transaction and secure the payment.
• • Public authorities
  • • Where there is a legal obligation or a valid request.
• • Professional advisers and service providers
  • • Accounting, auditing, legal advisers, where necessary and subject to confidentiality duties.

All processors act under contract, with confidentiality, security, and data protection obligations.

7. International transfers
If any service provider processes data outside the European Economic Area, we will ensure appropriate legal mechanisms, such as Standard Contractual Clauses and supplementary measures, where required.

8. Data retention
We retain personal data only for as long as necessary for the purposes and legal obligations. As a general rule:

• • Reservation and stay data: for the period needed to manage the relationship, customer support, and post-stay responsibilities, and then for a limited period in line with internal policies and applicable legal time limits.
• • Invoicing and accounting: for the applicable legal retention periods.
• • Marketing: until consent is withdrawn, or until you object to processing, depending on the legal basis.

Where specific legal obligations apply, the relevant statutory period prevails.

9. CCTV, video surveillance
Alma Terra uses CCTV video surveillance in common and access areas, exclusively for the purposes of protecting people and property, preventing and investigating incidents, and safeguarding the premises.

Appropriate signage is displayed on site. Processing is based on the Data Controller’s legitimate interests, ensuring minimization of the areas recorded and restricted access to images. Images are retained only for the period strictly necessary and in accordance with applicable legal time limits.

10. Information security
We implement technical and organizational measures appropriate to the risk, including access controls, permissions management, confidentiality policies, segregation of duties, and security best practices for systems and accounts.

11. Your rights
You may exercise the following rights, where applicable:

• • access
• • rectification
• • erasure
• • restriction
• • objectionù
• • data portability
• • withdrawal of consent, where processing is based on consent

Requests should be sent to privacy@almaterrahotel.com. We may request additional information to verify identity and prevent unauthorized requests.

You may also lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), or with your local EU supervisory authority.

12. Marketing preferences and opt-out
Whenever marketing communications are sent, you will have a simple and immediate way to opt out, for example an unsubscribe link or replying to the email. Opting out does not affect service communications strictly necessary to deliver your booking, for example reservation confirmations.

13. Changes to this Notice
We may update this Notice to reflect legal, technical, or operational changes. The “Last updated” date will be revised, and for material changes we may communicate through appropriate channels.