Privacy Policy

Last updated: 3 November 2026

1. Data controller

SAMPAIO & NASR, LDA. (tax number 513931260, Rua Coronel José Núncio, n.º 14, 6.º G, 2795-248 Linda-a-Velha, Portugal), which operates the Chez Vivi trade name, is the controller of personal data collected in direct bookings, under Regulation (EU) 2016/679 (GDPR) and Portuguese Law 58/2019.

Data protection requests: privacy@chezvivi.com

For the Cardal and Passadiço units, foreign guest reporting to AIMA is made in the name of the unit's registration holder, on whose behalf we process that data as managing entity, under the management agreement with that holder.

2. What data we process and why

  • Managing the booking and stay. Data: name, email, phone, address, dates, number of guests, messages exchanged. Legal basis: performance of contract (GDPR Art. 6(1)(b)). Retention: 5 years.
  • Payment and security deposit. Data: card details, processed by Stripe; we do not store the full card number. Legal basis: performance of contract (Art. 6(1)(b)). Retention: as long as needed for payment and the deposit.
  • Invoicing and accounting. Data: name, tax number, address, booking number, number of nights, amounts. Legal basis: legal obligation (Art. 6(1)(c)). Retention: 10 years, under tax law.
  • Reporting foreign guests to AIMA (SIBA system). Data: the data required in the accommodation registration form, including name, date of birth and identity document. Legal basis: legal obligation (Art. 6(1)(c) and Portuguese Law 23/2007). Retention: statutory period.
  • Damage handling and defence of legal claims. Data: photos, quotes, communications. Legal basis: legitimate interest (Art. 6(1)(f)). Retention: until resolved and the limitation period ends.
  • Internal management statistics. Data: nationality, dates, booking channel, amounts. Legal basis: legitimate interest (Art. 6(1)(f)). Retention: 5 years.
  • Offers for future direct bookings, by email. Data: name, email. Legal basis: legitimate interest regarding customers (Art. 6(1)(f) and Portuguese Law 41/2004). You can refuse at booking and unsubscribe in every email. Retention: until refusal or unsubscription.
  • Website visit analytics. Data: browsing data, through Google Analytics. Legal basis: consent (Art. 6(1)(a)). Retention: as stated in the cookie notice.

Data needed for the contract or required by law is mandatory: without it we cannot confirm the booking or give access. We do not make solely automated decisions.

3. Who we share data with

  • AIMA, through SIBA, and the Portuguese Tax Authority, as required by law.
  • Stripe, to process payments and the security deposit.
  • TalkGuest, our booking management system and website booking engine.
  • Supabase, hosting provider of the company's internal management platform.
  • The registration holders of the Cardal and Passadiço units, for stays in those units.
  • Our certified accountant and, in case of a claim, our insurer.

Service providers act as processors under a contract complying with Article 28 GDPR, or as independent controllers where the law so provides.

4. Transfers outside the European Economic Area

We favour providers that process data within the European Economic Area (EEA). Some, such as Stripe and Google (Analytics), may process data outside the EEA. Any such transfer only takes place under a European Commission adequacy decision or standard contractual clauses.

5. Your rights

You may request access, rectification, erasure, restriction and portability of your data, and object to processing based on legitimate interest, by email to privacy@chezvivi.com. We reply within one month. Some data cannot be erased while the law requires us to keep it.

You may lodge a complaint with the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt.

6. Security

We apply appropriate technical and organisational measures, including restricting access to people who need the data for their role.

7. Cookies

chezvivi.com uses cookies strictly necessary for the site and booking to work. It also uses Google Analytics to measure visits, only with prior consent, which can be given or withdrawn at any time in the cookie notice.

8. Updates

This policy may be updated. The date of the latest version is shown at the top.