Privacy Policy

1. Identity of the Controller

1.1 Controller

The controller responsible for processing your personal data is:

Rui Gabriel Raminhos Guerreiro, empresário em nome individual, trading as Cubic Houses
NIF: 218 823 061
Address: Avenida da República, 116 — 2º Esquerdo, 8700-310 Olhão, Portugal
Email: rui@cubichousesolhao.com
Telephone (WhatsApp): +351 936 380 392

Cubic Houses is a registered Alojamento Local operator and provides property management services on behalf of accommodation owners. References in this Policy to “Cubic Houses”, “we”, “us”, or “our” mean the controller identified above.

1.2 Data Protection Officer

Cubic Houses is not required to appoint a Data Protection Officer under Article 37 of the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), as its processing activities do not meet the criteria set out in that article.

All matters relating to the protection of personal data, including requests to exercise the rights described in Section 9, may be addressed to the contact details in Section 1.1.

1.3 Scope of this Policy

This Policy describes how Cubic Houses processes the personal data of:

• guests staying at properties managed by Cubic Houses;
• prospective guests who contact Cubic Houses or submit booking enquiries;
• accommodation owners and prospective owners who engage or consider engaging Cubic Houses' management services;
• visitors to the Cubic Houses website (cubichousesolhao.com) and the booking and owner platforms operated by Cubic Houses.

Cubic Houses uses cookies and similar technologies on its websites. The use of cookies is described in the separate Cookie Policy, available at cubichousesolhao.com/cookies.

2. Definitions

The following terms have the meanings set out below in this Policy. Definitions are based on Article 4 GDPR and are reproduced here for ease of reference.

“Personal data” — any information relating to an identified or identifiable natural person. This includes, for example, name, identification document number, email address, phone number, IP address, and payment information.

“Processing” — any operation performed on personal data, whether automated or not. This includes collection, storage, use, transmission, and deletion.

“Special category data” — personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for unique identification, data concerning health, or data concerning a person's sex life or sexual orientation. This category receives heightened protection under Article 9 GDPR. Cubic Houses processes a limited subset of this data — see Section 3.4.

“Controller” — the person or entity that determines the purposes and means of processing personal data. For the processing described in this Policy, the controller is Cubic Houses (Section 1.1).

“Processor” — a person or entity that processes personal data on behalf of the controller, on the controller's instructions. Cubic Houses' processors are listed in Section 6.

“Third country” — a country outside the European Economic Area (EEA). Transfers of personal data to third countries are governed by Chapter V of the GDPR and are described in Section 7.

“You” and “your” — the data subject whose personal data is being processed, namely a guest, a prospective guest, an accommodation owner, a prospective accommodation owner, or a website visitor, as the context requires.

3. Categories of Personal Data

This section describes the categories of personal data that Cubic Houses processes. The purposes and legal bases for processing each category are set out in Section 5.

3.1 Guest Data

When you book a stay at a property managed by Cubic Houses, or contact us in connection with a booking, we may process the following categories of personal data about you and the other guests in your party:

Identification and contact data: full name, date of birth, nationality, country of residence, email address, telephone number, and (for foreign guests, as required by law) identification document type, number, country of issue, and expiry date.

Booking data: property booked, dates of stay, number of guests, booking channel, booking reference, and any preferences or special requests communicated to us.

Payment data: for direct bookings, the last four digits of the payment card and the card brand, transaction reference numbers, and billing address. The full card number (PAN), CVV, and expiry date are processed directly by our payment processor (Stripe) and are not stored by Cubic Houses. For platform bookings (Airbnb, Booking.com), payment is handled by the platform and Cubic Houses does not have access to payment card details.

Communications data: the content of messages exchanged with you through booking platforms, email, WhatsApp, telephone, or other channels, and the date and time of those communications.

Stay data: check-in and check-out times, services requested during the stay, incidents or damage reports, and any information arising from the stay that is relevant to the booking or to the safety and proper use of the property.

Reviews and feedback: reviews left on booking platforms or directly with Cubic Houses, and your reactions to feedback requests.

3.2 Owner Data

If you engage Cubic Houses to manage one or more of your properties, or contact us about doing so, we may process the following categories of personal data about you:

Identification and contact data: full name, NIF (taxpayer identification number), address, email, telephone number, and a copy of your identification document where required for contractual or legal purposes.

Property data: details of the property or properties you own, including address, Alojamento Local registration number (where applicable), property characteristics, photographs, and access information. Property data may include personal data where it identifies you as the owner.

Financial data: bank account details (IBAN) for payouts, invoicing data, tax-relevant data required for the issuance of receipts and the fulfilment of Cubic Houses' tax obligations.

Contractual data: the management agreement signed with Cubic Houses and any amendments, and operational decisions communicated by you in the course of the management relationship (for example, pricing approvals, contractor authorisations).

Communications data: the content of messages exchanged with you and the date and time of those communications.

3.3 Website Visitor Data

When you visit the Cubic Houses website or its associated booking and owner platforms, we may process the following categories of personal data about you, regardless of whether you make a booking or contact us:

Technical data: IP address, device type, browser type and version, operating system, language preference, and the pages of our website you visit, including time spent on each page.

Cookie and similar technology data: as described in the separate Cookie Policy.

Form submission data: any information you provide through contact forms, enquiry forms, or newsletter subscription forms on the website.

3.4 Special Category Data

Cubic Houses processes a limited subset of special category data within the meaning of Article 9 GDPR, in the following specific cases:

Tourist tax exemptions on health or disability grounds: the Olhão Municipal Tourist Tax regulation provides exemptions for guests whose stay is motivated by medical treatment and for guests with a recognised disability of 60% or greater (and one accompanying person, in each case). Where a guest claims such an exemption, Cubic Houses processes the supporting documentation provided by the guest (for example, a medical appointment confirmation or a certificate of disability — atestado multiusos).

Assistance animals: where a guest notifies Cubic Houses of an intention to bring a trained assistance animal, the existence of an associated disability may be inferred from that information.

Special category data is processed only for the specific purpose of granting the exemption or accommodating the guest's needs, is not retained beyond the period set out in Section 8, and is not shared with third parties except as required by law (for example, justification of exemptions to the Municipality of Olhão).

4. Sources of Personal Data

Cubic Houses collects personal data both directly from data subjects and from third parties. The sources for each category of data subject are described below.

4.1 Data Collected Directly from You

Most of the personal data described in Section 3 is collected directly from you, including:

• data you provide when making a direct booking through the Cubic Houses website or by email;
• data you provide through the Guest Registration Form (Boletim de Alojamento) before your arrival;
• data you provide when contacting Cubic Houses by email, telephone, WhatsApp, or through booking platform messaging systems;
• data you provide when engaging Cubic Houses to manage your property, or when discussing prospective management;
• data you provide through forms on the Cubic Houses website.

4.2 Data Received from Booking Platforms

Where you book a stay through Airbnb, Booking.com, or another booking platform connected to Cubic Houses, the platform shares with Cubic Houses the personal data necessary for Cubic Houses to deliver the booking. This typically includes your name, contact details, booking dates, number of guests, and any messages you send through the platform's messaging system.

The privacy practices of booking platforms are governed by their own privacy policies. Cubic Houses receives data from these platforms in accordance with the data sharing arrangements in place between the platform and the property listing.

4.3 Data Received from Accommodation Owners

Where Cubic Houses takes on the management of a property, the accommodation owner may share with Cubic Houses personal data relating to:

• the owner themselves (where Cubic Houses is engaged through a representative);
• service providers, contractors, or neighbours relevant to the operation of the property.

Where Cubic Houses receives personal data about third parties from accommodation owners, Cubic Houses processes that data only to the extent necessary for the management of the property and in accordance with this Policy.

4.4 Data Generated by Your Use of Our Services

Some personal data is generated by your interaction with Cubic Houses or its systems rather than provided directly. This includes:

• check-in and check-out timestamps;
• records of services requested and delivered during your stay;
• records of damage, incidents, or complaints;
• technical data generated by your use of the Cubic Houses website (Section 3.3);
• reviews you submit and the dates on which you submit them.

4.5 Publicly Available Sources

Cubic Houses may consult publicly available sources for the purpose of verifying information about an accommodation owner or a property, including:

• the Registo Nacional de Alojamento Local (RNAL) and other public registries relating to short-term accommodation;
• public business and tax registries;
• publicly available property information (for example, land registry extracts, where lawfully accessible);
• the public profile of a property on existing or previous listing channels, where the owner indicates that the property has been previously marketed.

Cubic Houses does not collect personal data from social media or other public sources for marketing purposes.

5. Purposes and Legal Bases for Processing

Cubic Houses processes your personal data only where it has a lawful basis to do so under Article 6 GDPR (and, for special category data, under Article 9 GDPR). The purposes for which we process your data, and the corresponding legal basis for each, are set out below.

5.1 Guest Data

5.2 Owner Data

5.3 Website Visitor Data

5.4 Withdrawal of Consent

Where the legal basis for processing is your consent — for example, marketing communications to past guests or non-essential cookies — you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Methods for withdrawing consent are described in Section 9.

5.5 Legitimate Interests Balancing

Where Cubic Houses relies on its legitimate interests as the legal basis for processing, this is done only after balancing those interests against your rights and freedoms. You have the right to object to processing based on legitimate interests, as described in Section 9. Where you object to direct marketing on this basis, Cubic Houses will stop the processing in question.

6. Recipients and Processors

Cubic Houses shares your personal data with the following categories of recipient, as necessary for the purposes set out in Section 5.

6.1 Processors Acting on Cubic Houses' Behalf

Cubic Houses uses the following service providers to process personal data on its behalf, under data processing agreements that meet the requirements of Article 28 GDPR:

Cubic Houses reviews its processors periodically and updates this list when a material change occurs.

6.2 Other Recipients

In addition to the processors listed in Section 6.1, Cubic Houses may share personal data with the following recipients, who act as independent controllers or receive data on a legal basis other than a processing relationship:

Booking platforms (Airbnb, Booking.com, and similar): where you book through a platform, the platform and Cubic Houses each act as independent controllers in respect of their own processing. Communications and stay data exchanged through the platform are accessible to both parties.

Accommodation owners: the owner of the property at which you stay receives the personal data necessary for them to fulfil their role as the contracting party for the accommodation contract. The volume of data shared is limited to what is necessary — typically booking dates, guest numbers, and operational information, but excluding identification document numbers and payment details.

Public authorities:

• AIMA — Agência para a Integração, Migrações e Asilo: receives the foreign guest registration data submitted via the SIBA system, in accordance with Decreto-Lei 9/2022.
• AT — Autoridade Tributária e Aduaneira: receives invoicing and tax data in accordance with Portuguese tax law.
• Câmara Municipal de Olhão: receives the data necessary for the administration and remittance of the Municipal Tourist Tax, including (where applicable) information justifying exemptions.
• Police authorities (PSP, GNR, PJ): in the limited circumstances set out in Section 16.6 of Cubic Houses' Terms and Conditions, where reporting is required by law or where a criminal incident has occurred at the property.
• Judicial and regulatory authorities where Cubic Houses is required to disclose data by law or by court order.

Professional advisers: lawyers, accountants, auditors, and insurance providers, where disclosure is necessary for the establishment, exercise, or defence of legal claims, for compliance with legal obligations, or for the management of insurance claims.

Successors and acquirers: in the event of a sale, merger, or transfer of all or part of the Cubic Houses business, your personal data may be transferred to the successor entity, subject to the protections set out in this Policy or an equivalent policy adopted by the successor.

6.3 Limits on Sharing

Cubic Houses does not sell, rent, or otherwise commercially distribute your personal data to any third party. Personal data is shared only with the recipients identified in this Section 6, and only to the extent necessary for the purposes set out in Section 5.

7. International Transfers

7.1 Transfers Outside the European Economic Area

Some of the processors listed in Section 6.1 are established in, or have group infrastructure in, countries outside the European Economic Area (“EEA”). The transfers currently relevant to Cubic Houses' processing are described below.

7.2 Safeguards Applied

For each transfer to a third country, Cubic Houses ensures that one of the following safeguards is in place:

• the destination country benefits from an adequacy decision of the European Commission under Article 45 GDPR (the EU–US Data Privacy Framework, where the recipient self-certifies);
• the transfer is governed by Standard Contractual Clauses (“SCCs”) adopted by the European Commission under Article 46 GDPR; or
• another appropriate safeguard recognised under Article 46 GDPR is in place.

Where Standard Contractual Clauses are relied upon, Cubic Houses considers, as necessary, the legal framework of the destination country and any supplementary measures appropriate to the transfer.

7.3 Your Right to Information About Specific Transfers

If you would like further information about the safeguards applied to a specific transfer, including a copy of the relevant Standard Contractual Clauses (with commercially confidential information redacted), you may contact Cubic Houses at the address in Section 1.1.

7.4 No Sale or Rental Outside the EEA

Cubic Houses does not transfer personal data to any third country for the purpose of sale or rental of that data, nor for any purpose other than those described in Section 5.

8. Retention Periods

Cubic Houses retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, to comply with Cubic Houses' legal obligations, or to establish, exercise, or defend legal claims. Specific retention periods are set out below.

8.1 Guest Data

8.2 Owner Data

8.3 Website Visitor Data

8.4 Anonymisation and Aggregation

Cubic Houses may retain personal data in anonymised or aggregated form indefinitely for statistical, analytical, and service improvement purposes, where the anonymisation is irreversible and the data can no longer be linked to an identifiable individual.

8.5 Holds for Open Claims

Where a claim, dispute, complaint, or investigation involving personal data is open at the end of an applicable retention period, Cubic Houses retains the relevant personal data for as long as necessary to handle the matter, after which the standard retention period resumes.

9. Your Rights

You have the rights set out below in respect of the personal data Cubic Houses processes about you. These rights are granted by Articles 15 to 22 GDPR and may be exercised free of charge, subject to the limitations described in Section 9.5.

9.1 Rights

Right of access (Art. 15 GDPR). You have the right to obtain confirmation of whether Cubic Houses processes personal data about you and, where it does, to access that data and to receive the information described in Article 15 GDPR.

Right to rectification (Art. 16 GDPR). You have the right to obtain the correction of inaccurate personal data and the completion of incomplete personal data.

Right to erasure (Art. 17 GDPR — “right to be forgotten”). You have the right to obtain the erasure of personal data concerning you in the circumstances set out in Article 17 GDPR. Erasure may not be possible where processing is necessary for compliance with a legal obligation (for example, the tax retention obligations described in Section 8) or for the establishment, exercise, or defence of legal claims.

Right to restriction of processing (Art. 18 GDPR). You have the right to obtain the restriction of processing of your personal data in the circumstances set out in Article 18 GDPR — for example, while the accuracy of contested data is being verified.

Right to data portability (Art. 20 GDPR). Where processing is carried out by automated means and is based on your consent or on the performance of a contract, you have the right to receive the personal data you have provided to Cubic Houses in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.

Right to object (Art. 21 GDPR). You have the right to object to processing of your personal data based on Cubic Houses' legitimate interests (Section 5). Where you object to direct marketing, Cubic Houses will stop the processing in question. For other legitimate-interest processing, Cubic Houses will assess whether it has compelling legitimate grounds that override your interests, rights, and freedoms.

Right to withdraw consent (Art. 7(3) GDPR). Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Rights relating to automated decision-making (Art. 22 GDPR). Cubic Houses does not subject you to decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

9.2 How to Exercise Your Rights

To exercise any of the rights described in Section 9.1, you may contact Cubic Houses by:

• email at rui@cubichousesolhao.com, with the subject line “Privacy request”; or
• post to the address in Section 1.1.

Your request should describe the right you wish to exercise and provide enough information for Cubic Houses to identify the personal data concerned (for example, the name used for a booking, the booking dates, and the email address used).

9.3 Identity Verification

Cubic Houses may ask you for additional information to verify your identity before responding to your request, where this is reasonably necessary to confirm that the request comes from you and not from a third party.

9.4 Response Time

Cubic Houses will respond to your request without undue delay and in any event within one month of receipt. Where a request is complex or where Cubic Houses receives a high volume of requests, this period may be extended by up to two further months. Cubic Houses will inform you of any extension within the first month and explain the reasons for the delay.

9.5 Limits and Refusals

Cubic Houses may refuse to act on a request, or charge a reasonable fee, where the request is manifestly unfounded or excessive — in particular, because of its repetitive character. Where Cubic Houses refuses a request in whole or in part, it will explain the reasons and inform you of your right to lodge a complaint with the supervisory authority (Section 9.6).

Where the requested action is not possible because of a legal obligation, the establishment, exercise, or defence of legal claims, or any other ground recognised in the GDPR, Cubic Houses will explain this in its response.

9.6 Right to Lodge a Complaint

If you believe Cubic Houses' processing of your personal data is unlawful, or if you are dissatisfied with how Cubic Houses has responded to a request under this Section, you have the right to lodge a complaint with the Portuguese supervisory authority for data protection:

CNPD — Comissão Nacional de Proteção de Dados
Address: Av. D. Carlos I, 134 — 1.º, 1200-651 Lisboa
Telephone: +351 213 928 400
Email: geral@cnpd.pt
Website: www.cnpd.pt

You may also lodge a complaint with the data protection authority of the EU Member State of your habitual residence, your place of work, or the place of an alleged infringement, in accordance with Article 77 GDPR.

10. Cookies and Similar Technologies

The Cubic Houses website and the booking and owner platforms operated by Cubic Houses use cookies and similar technologies. Cookies are small data files placed on your device by your browser when you visit a website. They are used, among other things, to make websites function correctly, to remember your preferences, and (where you consent) to measure how the website is used.

Detailed information about the cookies used by Cubic Houses, including the categories of cookies, the specific cookies set on each platform, the purposes they serve, the third parties involved, and the retention period of each cookie, is set out in the separate Cookie Policy available at cubichousesolhao.com/cookies.

The Cookie Policy also explains how you can accept, reject, or withdraw consent for non-essential cookies through the cookie banner displayed on the Cubic Houses website, and how to manage cookie preferences through your browser settings.

11. Security

11.1 Technical and Organisational Measures

Cubic Houses implements appropriate technical and organisational measures designed to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage. The measures are reviewed periodically and adjusted to reflect changes in risk and in the state of the art.

Current measures include, among others:

• the use of secure connections (HTTPS / TLS) for the Cubic Houses website, the booking and owner platforms, and email communications where supported;
• access controls limiting access to personal data to those individuals who require access for the purposes set out in Section 5;
• the use of reputable processors (Section 6.1) that maintain their own technical and organisational security measures, contractually committed in the data processing agreements signed with Cubic Houses;
• segregation of personal data from publicly accessible areas of Cubic Houses' systems.

No information system can be guaranteed to be entirely secure. Where you communicate with Cubic Houses, you are responsible for the security of your own devices, accounts, and credentials.

11.2 Personal Data Breaches

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, Cubic Houses will notify the Portuguese supervisory authority (CNPD) within 72 hours of becoming aware of the breach, in accordance with Article 33 GDPR.

Where the breach is likely to result in a high risk to your rights and freedoms, Cubic Houses will also notify you directly without undue delay, in accordance with Article 34 GDPR, and provide the information described in that article.

12. Changes to This Policy

12.1 Updates

Cubic Houses may update this Policy from time to time, for example to reflect changes in its processing activities, the addition or replacement of processors, changes in applicable law, or guidance issued by the CNPD or other competent authorities.

The current version of the Policy is identified by the version number and effective date at the head of this document. Cubic Houses maintains an archive of previous versions and will provide a copy of any previous version on request.

12.2 Notification of Changes

Where Cubic Houses makes a change to this Policy that materially affects how your personal data is processed (for example, a change in the legal basis for a processing activity, a new category of recipient, or a new international transfer), Cubic Houses will notify you of the change in advance through one or more of the following channels:

• by email, where Cubic Houses holds a current email address for you;
• through a notice on the Cubic Houses website;
• through the booking platform messaging system in respect of an active booking.

Non-material changes (for example, corrections of typographical errors, formatting adjustments, or clarifications that do not change the substance of the Policy) take effect on publication of the new version, without separate notification.

12.3 Continued Processing Under a Previous Version

Where you object to a material change in this Policy and the processing concerned is based on your consent, you may withdraw your consent in accordance with Section 9. Where the processing is based on another legal basis, the change applies on its effective date and the rights described in Section 9 (in particular, the right to object) remain available to you.