Privacy Policy
Last updated: 5 November 2026
This policy explains what personal data we collect through pinecoastvillas.com, what we use it for, who we share it with and what rights you have over it.
1. Who is responsible for your data
The data controller is Pedro João Paiva Monteiro dos Santos, a self-employed professional (sole trader) trading as Pine Coast Villas, tax number (NIF) 207361916, with business address at Rua de Goa, Lote 1, Cabanas, 2950-628 Quinta do Anjo, Palmela, Portugal. For any question about personal data, please contact us at hello@pinecoastvillas.com.
Pine Coast Villas is a promotion and intermediation service. We are not a travel agency, we do not sell accommodation in our own name and we do not receive payments from guests.
2. What data we collect
| Situation | Data |
|---|---|
| Booking request, when available on the site | Name, email, phone, country, language, dates, number of adults and children, message and, if you agree, consent to marketing communications |
| Owners' form | Name, email, phone, destination, number of bedrooms, link to an existing listing, local accommodation (AL) registration number and message |
| News list (email signup) | Email, language and the page you signed up from (footer or destination); the subscription only becomes active once you confirm your email in the message we send you |
| Guest reviews | Ratings, review text, first name and month of stay |
| Booking management | Details of confirmed bookings, internal notes and, where needed, documents that are not identity documents, such as payment receipts or special requests |
| Spam protection | IP address and technical browser data, checked by Cloudflare when a form is submitted |
| Site analytics, only with your consent | Cookie identifiers and site usage data (pages visited, device and browser type, approximate location), processed in aggregate |
| Advertising, only with your consent | Cookie identifiers and data about your visit to the site (pages visited and, if you arrive through a Meta ad, the identifier of that click) |
We do not ask for or keep identity documents. Registering foreign guests with the authorities is done by the owner of the property.
3. What we use the data for, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Answering booking requests and forwarding them to the owner | Steps taken at your request before entering into a contract |
| Following up the booking and sending confirmation, refusal or cancellation emails | Performance of a contract |
| Answering owners interested in a partnership | Steps taken before entering into a contract |
| Inviting guests to review their stay and publishing approved reviews | Legitimate interest in showing genuine opinions from real guests |
| Sending news and offers | Consent, which you may withdraw at any time |
| Meeting tax and accounting obligations | Legal obligation |
| Protecting the site against spam and abuse | Legitimate interest |
| Measuring and improving how the site is used (analytics and statistics) | Consent, which you may withdraw at any time through "Cookie settings" in the site footer |
| Measuring the results of our ads and showing Pine Coast Villas ads to people who visited the site (Meta) | Consent, which you may withdraw at any time through "Cookie settings" in the site footer |
4. Who we share the data with
- The property owner: when we forward a request, we send your name, country, dates, number of guests and message, without your email or phone. Once the owner confirms the booking, we pass on your contact details so that they can deal with you directly about payment and your stay. From that point, the owner is responsible for how they process that data.
- Service providers processing data on our behalf:
Provider Service Location Supabase Database, authentication and file storage European Union Vercel Website hosting Servers in the European Union; company based in the USA Brevo Email delivery and news list management European Union (France) Cloudflare Spam protection for forms (Turnstile) Global network; company based in the USA OpenStreetMap Maps on destination pages United Kingdom Google Ireland Limited Google Tag Manager and Google Analytics 4 (site analytics, only with consent) European Union (Ireland); parent company based in the USA Microsoft Ireland Operations Limited Microsoft Clarity (site analytics, only with consent) European Union (Ireland); parent company based in the USA
- Meta Platforms Ireland Limited (advertising, only with consent): if you allow it, the Meta Pixel sends Meta data about your visit to the site, so that we can measure our ads and show Pine Coast Villas ads. For the collection and transmission of that data, Pine Coast Villas and Meta are joint controllers; from then on, Meta processes it as an independent controller, under its own privacy policy.
We do not sell personal data. We only share data with Meta for advertising if you allow it, as described in section 7.
5. Transfers outside the European Union
Some providers are based in the United States or the United Kingdom. In those cases, the transfer relies on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework or the decision concerning the United Kingdom, or on standard contractual clauses approved by the European Commission. This applies to Google and Microsoft, which act as processors on our behalf for the site analytics services, activated only with your consent: the data collected may be processed in the United States under those safeguards.
For the Meta Pixel, activated only with your consent, the data may be transferred to Meta Platforms, Inc., in the United States, under the EU-US Data Privacy Framework.
6. How long we keep the data
| Data | Period |
|---|---|
| Booking requests that were never confirmed, and the contact details of whoever sent them if they have no other bookings or marketing consent | 12 months |
| Contacts from owners that did not lead to a partnership | 24 months after the last contact |
| Confirmed bookings and related invoicing | 10 years, for tax reasons |
| Expired review invitations | 6 months |
| Published reviews | While they are published, or until you ask for removal or anonymisation |
| Marketing list | Until you withdraw your consent |
| Contacts of previous clients, with no bookings through the site and no marketing consent | 24 months |
At the end of these periods, the data is deleted or anonymised.
7. Cookies and storage on your device
The site uses what is strictly necessary for it to work, which does not depend on consent, and, only if you allow it, analytics and statistics cookies and advertising cookies.
Essential cookies (no consent needed):
| Name | Purpose | Duration |
|---|---|---|
| NEXT_LOCALE | Remembering your chosen language | Session (ends when you close the browser) |
| pcv_consent | Remembering your choice about analytics and advertising cookies, so we do not ask again during that period | 6 months |
| Cloudflare Turnstile | Checking that a form is sent by a person and not an automated program. We do not create any cookie of our own for this; whatever Cloudflare may store is set by Cloudflare | Set by Cloudflare |
| sb-…-auth-token (admin session) | Keeping the restricted area logged in; never created for visitors | Up to 400 days, or until the session ends |
Analytics (with consent):
These cookies are only activated if you click "Accept" or switch on "Analytics and statistics" in the preferences, and they help us understand, in aggregate, how the site is used and improve it. They are loaded through Google Tag Manager.
| Name | Purpose | Duration | Provider |
|---|---|---|---|
| _ga, _ga_<ID> (Google Analytics 4) | Telling visitors apart and measuring site usage | Up to 2 years | Google Ireland Limited |
| _clck (Microsoft Clarity) | Storing the user identifier and Clarity preferences | Up to 1 year | Microsoft Ireland Operations Limited |
| _clsk (Microsoft Clarity) | Linking page views within the same visit | 1 day | Microsoft Ireland Operations Limited |
| CLID (Microsoft Clarity) | Identifying the user's first visit to the site | Up to 1 year | Microsoft Ireland Operations Limited |
You can withdraw or change your consent at any time through "Cookie settings" in the site footer; once withdrawn, analytics or advertising cookies stop being used and we try to delete those already created. Withdrawal does not affect the lawfulness of processing carried out before. Your choice is kept for 6 months, after which we ask again. You can also delete cookies in your browser settings.
Google and Microsoft process this data as processors on our behalf and may transfer it to the United States, as described in section 5.
Advertising (with consent):
These cookies are only activated if you click "Accept" or switch on "Advertising" in the preferences, and they help us measure the results of our ads and show Pine Coast Villas ads to people who visited the site. They are loaded through Google Tag Manager.
| Name | Purpose | Duration | Provider |
|---|---|---|---|
| _fbp (Meta Pixel) | Telling site visits apart to measure Meta ads | 90 days | Meta Platforms Ireland Limited |
| _fbc (Meta Pixel) | Storing the click identifier when you arrive from a Meta ad | 90 days | Meta Platforms Ireland Limited |
Meta processes this data as described in sections 4 and 5.
8. Reviews and how we verify them
Only guests who stayed in a property booked through us can leave a review. After check-out, the guest receives by email a personal link, valid for 30 days and usable only once. We publish only the first name, the month of stay and the review, after checking it. We do not edit reviews. You can ask at any time for your review to be removed or published anonymously.
9. Your rights
At any time, you may ask us for:
- access to your data and a copy of it;
- correction of inaccurate data;
- deletion of your data, except data we must keep by law;
- restriction of processing or data portability;
- objection to processing based on legitimate interest;
- withdrawal of your marketing consent, without affecting processing carried out before.
To exercise these rights, write to hello@pinecoastvillas.com. We reply within 30 days. You also have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt.
10. Security
Data is stored with services that use encrypted connections and restricted access. Private files can only be reached through temporary links valid for 60 seconds, and only the administration has access to the restricted area.
11. Changes to this policy
We may update this policy. The date of the last update is always shown at the top. If a change is significant, we will inform the guests and owners we are in contact with.
12. Contact
hello@pinecoastvillas.com