Last updated: 19/02/2026
1. Controller Identification
This Privacy and Cookies Policy governs the processing of personal data of users of the website. Graça Hotel.
The data controller is Graça Hotel, headquartered in Quinta Branca do Faial, lote 4, 7005-862 Évora, legal entity no. 503521434.
2. Personal Data Collected
Graça Hotel may collect and process personal data through the website, especially when the user:
- Fill out forms for budget requests or information requests;
- Schedules appointments or service requests through the SimplyBook.me platform;
- Communication is done via email;
- Browse the website (technical data and cookies)
2.1. Quotation Requests
When a user submits a quote request through the form available on the website, the personal data necessary for the analysis and response to the request is collected, such as name, email address, telephone contact, desired dates, and other relevant information. This data is processed exclusively for the purposes of responding to the quote request, monitoring the request, and, when applicable, for carrying out pre-contractual due diligence related to a potential booking. The processing of this data is based on the consent of the data subject and/or the need to carry out pre-contractual due diligence, with the data being kept only for the period strictly necessary for the purposes described above or for the time required by legal obligations.
The data collected may include:
- Name;
- Email address;
- Phone number;
- Dialing and/or service data;
- IP address and technical browsing data.
3. Purposes of Treatment
Personal data is processed for the following purposes:
- Managing contact requests and communications;
- Processing appointments and providing services through SimplyBook.me;
- Sending transactional communications (confirmations and responses to requests) via WP Mail SMTP;
- Compliance with legal obligations;
- Managing cookie consent through the iubenda plugin;
- Statistical analysis of the website is only performed when MonsterInsights is active and with the user's consent.
4. Foundations of Lawfulness
The processing of personal data is based on:
- In the execution of a contract or pre-contractual due diligence;
- In compliance with legal obligations;
- Without the data subject's consent, where applicable;
- In the legitimate interest of Graça Hotel, provided that the rights of the data subject do not prevail.
5. Data Preservation
Personal data is kept only for the period necessary for the purposes that motivated its collection or for the legally required period.
Records of consent related to cookies are maintained in accordance with legal requirements through the iubenda platform.
6. Rights of Data Subjects
Under the General Data Protection Regulation (GDPR), the data subject has the right to:
- Access to your personal data;
- Correction of inaccurate or incomplete data;
- Data erasure (right to be forgotten);
- Treatment limitations;
- Data portability;
- Opposition to treatment;
- Withdrawal of consent, where applicable.
The exercise of these rights can be requested via the following email address:
gracahotel@gmail.com
7. Sharing Data with Third Parties
Personal data may be shared with third-party entities strictly necessary for the provision of services, namely:
- SimplyBook.me – scheduling and service management;
- Email sending services used by WP Mail SMTP;
- iubenda – consent and cookie management;
- Google LLC – only when MonsterInsights (Google Analytics) is active and with the user's consent.
Some of these entities may process data outside the European Economic Area, ensuring adequate protection mechanisms under the GDPR.
8. Cookies
8.1. What are cookies?
Cookies are small text files stored on a user's device when they visit a website, allowing for an improved browsing experience.
8.2. Cookies used on this website
The Graça Hotel website uses:
- Strictly necessary cookies – essential for the functioning of WordPress and the website;
- Functional cookies – for managing preferences and forms;
- Consent cookies – managed by the iubenda plugin;
- Statistical cookies – only when MonsterInsights is active and with consent.
Currently, statistical cookies are not active.
8.3. Cookie Management
The user can manage or withdraw their consent at any time through the cookie banner or their browser settings.
9. Data Security
Graça Hotel adopts appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or improper disclosure.
10. Complaints
The data subject has the right to lodge a complaint with the
National Data Protection Commission (CNPD)
Website: www.cnpd.pt
11. Policy Changes
Graça Hotel reserves the right to update this Privacy and Cookies Policy at any time. Any changes will be published on the website.