1. Controller
Thomas Gangloff
Quinta da Balaia 54, 8200-594 Albufeira, Portugal
Email: info@oceanbalaia.com
2. Principles
We take the protection of your personal data seriously. This Privacy Policy explains what personal data we collect, for what purpose and on what legal basis we process it, and what rights you have. Processing is carried out in accordance with the General Data Protection Regulation (GDPR) and applicable Portuguese data protection law.
3. Data We Collect and Why
a) Booking enquiries and bookings
When using our booking form, we collect the following data: first and last name, email address, travel dates, number of guests, and payment data (processed via Stripe). This data is necessary for the performance of the contract (Art. 6(1)(b) GDPR).
b) Contact
When you contact us by email, the data you provide will be stored to process your enquiry. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).
c) Technical access data
When you visit our website, technical data is automatically recorded (IP address, browser, operating system, access time). This serves the technical provision of the website (Art. 6(1)(f) GDPR).
d) Web analytics (Google Analytics – planned)
This website will shortly use Google Analytics, a web analytics service provided by Google Ireland Ltd. Google Analytics uses cookies that enable analysis of website usage. The legal basis is your consent (Art. 6(1)(a) GDPR). You will be asked for your consent before activation (cookie banner). This Privacy Policy will be updated accordingly upon activation.
4. Payment Processing via Stripe
Payments are processed via Stripe Payments Europe Ltd. (1 Grand Canal Street Lower, Dublin 2, Ireland). Stripe is certified as a payment service provider according to PCI-DSS standards. Your payment data is transmitted directly to Stripe and is not stored on our servers. Further information: https://stripe.com/privacy
5. Retention Period
Booking data and contractual documents are retained for the legally required period of 10 years (statutory retention obligation under tax law, Art. 6(1)(c) GDPR). Contact enquiries without a resulting contract are deleted after 12 months.
6. Disclosure to Third Parties
Your data is only shared with:
- Stripe (payment processing, see section 4)
- Infomaniak Network SA (hosting provider, Switzerland) – as a data processor
- Authorities, where required by law
Transfer to third countries (outside the EU/EEA) only takes place where adequate data protection guarantees exist (e.g. standard contractual clauses).
7. Your Rights (GDPR Art. 15–22)
You have the right to:
- Access your stored data (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure of your data, provided no statutory retention obligation applies (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Object to processing (Art. 21 GDPR)
- Withdraw consent previously given (Art. 7(3) GDPR)
To exercise your rights, please contact: info@oceanbalaia.com
8. Right to Lodge a Complaint
You have the right to lodge a complaint with the competent data protection supervisory authority. In Portugal, this is the CNPD (Comissão Nacional de Proteção de Dados), Rua de São Bento, 148-3º, 1200-821 Lisboa, www.cnpd.pt.
9. Cookies
Our website uses technically necessary cookies that are required for the operation of the website. These cookies do not require consent. Once Google Analytics is activated, you will be asked for your consent in advance.
10. Hosting
This website is hosted by Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Geneva, Switzerland. Infomaniak processes your data as a data processor exclusively within the framework of a data processing agreement and in accordance with our instructions.
Last updated: January 2026