Privacy Policy

Last updated: 5 September 2026

Who is responsible

Raíz, in Santa Margarida da Serra, Grândola, is the controller of the personal data collected through this site. We process your data in accordance with the General Data Protection Regulation (GDPR) and applicable Portuguese law.

For any questions about your data, email us at reservas@raizalentejo.com.

What data we collect

We only collect the data needed to provide our service:

• Booking: name, email, mobile number (only when paying by MB WAY), stay dates and number of guests.
• Payment: payment details are handled directly by Stripe (cards) and Easypay (MB WAY and Multibanco) — they never pass through our servers.
• Contact form: name, email and your message.
• Browsing: on every visit, Google Analytics and Google Ads receive the URL visited, the page you came from, the title and language, the date and time, browser information and your IP address. Without your consent, no cookies are used and no identifier that follows you across pages or visits is created. With your consent, cookie identifiers are added and, after an ad click, its click identifier. To measure a booking, we send its value, number of nights and guests, method, and a transaction reference that cannot access the booking. We don't send Google the name, email, phone number, stay dates or payment details. If you accept advertising measurement, the OpenAI pixel (ads in ChatGPT) also receives the pages visited, the quote and booking value and, after a click on an ad in ChatGPT, its click identifier; to link a booking request and its payment to that ad, our server additionally sends OpenAI the email and phone number in irreversible form (SHA-256 hash), never in clear text.

What we use the data for

We use your data to manage your booking and stay (performance of the contract), reply to your messages, comply with legal obligations — namely invoicing and tax — and, with your consent, understand how the site is used and measure whether ads lead to enquiries or bookings.

We don't use data collected on this site to personalise ads or build remarketing audiences, and we never sell it.

Cookies and measurement signals

Google Analytics and Google Ads load on every visit, but always start with every purpose denied. In that state no cookies are written or read and no identifier that follows you across pages or visits is created: Google receives only the page address, the page you came from, the title, the language, the date and time, browser information and your IP address — which Google receives by virtue of answering the request. These signals are used to estimate aggregate totals, not to identify you.

If you accept in the banner, cookies start being used and your visit can be linked across pages and sessions, which makes statistics and ad measurement more accurate. You can accept statistics and advertising measurement separately, and withdraw either afterwards.

The OpenAI pixel (ads in ChatGPT) works differently: it is only loaded once you accept advertising measurement and, without that choice, receives nothing. Withdrawing consent switches it off again.

Ad personalisation always remains disabled, with or without consent: we never build remarketing audiences from this site. Ad click identifiers are stripped from the page address before it is sent to Google Analytics or OpenAI.

Your choice, the notice version and its date are stored in your browser. You can change it or withdraw consent at any time through “Cookie settings” in the footer.

Who we share it with

We share data only with the providers needed to run the service: Stripe (card payments), Easypay (MB WAY and Multibanco), Resend (email delivery), Google Analytics (statistics), Google Ads (advertising measurement) and OpenAI (measurement of ads in ChatGPT, only with your consent) — without cookies before your choice, with cookies only once you accept and the site's hosting.

Some of these providers may process data outside the European Economic Area, always with the safeguards provided for by the GDPR.

How long we keep it

We keep booking data for as long as needed to manage the stay and for the applicable legal periods, namely tax-related ones. Contact messages are kept only as long as needed to reply and follow up.

Your rights

You can request, at any time, access to, rectification, erasure, restriction of processing or portability of your data, as well as object to processing or withdraw any consent you have given. Just email reservas@raizalentejo.com.

You also have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (cnpd.pt).

Security

All communication with the site is encrypted (HTTPS) and payments are processed by certified providers. We don't store card details on our systems.

Changes to this policy

We may update this policy at any time — the version in force is always the one published on this page, with the update date shown above.

To learn how Google handles data received through these services, read How Google uses information from sites or apps that use its services.