1. Controller
Thomas Gangloff
Quinta da Balaia 54, 8200-594 Albufeira, Portugal
Email: info@oceanbalaia.com
2. Principles
We take the protection of your personal data seriously. This Privacy Policy explains what personal data we collect, for what purpose and on what legal basis we process it, and what rights you have. Processing is carried out in accordance with the General Data Protection Regulation (GDPR) and applicable Portuguese data protection law.
3. Data We Collect and Why
a) Booking enquiries and bookings
When using our booking form, we collect the following data: first and last name, email address, travel dates, number of guests, and payment data (processed via Stripe). This data is necessary for the performance of the contract (Art. 6(1)(b) GDPR).
b) Contact
When you contact us by email, the data you provide will be stored to process your enquiry. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).
c) Technical access data
When you visit our website, technical data is automatically recorded (IP address, browser, operating system, access time). This serves the technical provision of the website (Art. 6(1)(f) GDPR).
d) Web analytics (Google Analytics)
This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies that enable analysis of website usage.
The legal basis is exclusively your consent (Art. 6(1)(a) GDPR). Google Analytics is loaded only after you have expressly agreed via the cookie banner; without your consent, no analytics cookie is set and no connection to Google is established. You may withdraw your consent at any time with effect for the future (Art. 7(3) GDPR) using the “Cookie settings” link in the footer. On withdrawal, any Google Analytics cookies already set are deleted.
Your IP address is truncated by Google Analytics 4 and is not stored permanently. We additionally use Google Consent Mode v2: the advertising signals (ad_storage, ad_user_data, ad_personalization) are permanently denied, so your data is not used for advertising purposes.
Transfer of data to Google LLC in the USA cannot be ruled out. This is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework, under which Google LLC is certified, supplemented by the European Commission's Standard Contractual Clauses.
Retention: the _ga cookie is stored for 2 years, the _gid cookie for 24 hours. Usage data collected in Google Analytics is deleted automatically after 14 months. Further information: https://policies.google.com/privacy
4. Payment Processing via Stripe
Payments are processed via Stripe Payments Europe Ltd. (1 Grand Canal Street Lower, Dublin 2, Ireland). Stripe is certified as a payment service provider according to PCI-DSS standards. Your payment data is transmitted directly to Stripe and is not stored on our servers. Further information: https://stripe.com/privacy
5. Retention Period
Booking data and contractual documents are retained for the legally required period of 10 years (statutory retention obligation under tax law, Art. 6(1)(c) GDPR). Contact enquiries without a resulting contract are deleted after 12 months.
6. Disclosure to Third Parties
Your data is only shared with:
- Stripe (payment processing, see section 4)
- Google Ireland Limited (web analytics, see section 3 d) – only with your consent
- Infomaniak Network SA (hosting provider, Switzerland) – as a data processor
- Authorities, where required by law
Transfer to third countries (outside the EU/EEA) only takes place where adequate data protection guarantees exist (e.g. standard contractual clauses).
7. Your Rights (GDPR Art. 15–22)
You have the right to:
- Access your stored data (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure of your data, provided no statutory retention obligation applies (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Object to processing (Art. 21 GDPR)
- Withdraw consent previously given (Art. 7(3) GDPR)
To exercise your rights, please contact: info@oceanbalaia.com
8. Right to Lodge a Complaint
You have the right to lodge a complaint with the competent data protection supervisory authority. In Portugal, this is the CNPD (Comissão Nacional de Proteção de Dados), Rua de São Bento, 148-3º, 1200-821 Lisboa, www.cnpd.pt.
9. Cookies
Our website uses technically necessary cookies that are required for the operation of the website (for example to store your language selection). These cookies do not require consent.
In addition, we use Google Analytics cookies – exclusively after your express consent via the cookie banner (see section 3 d). Your decision is stored locally in your browser and can be changed at any time using the “Cookie settings” link in the footer.
10. Hosting
This website is hosted by Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Geneva, Switzerland. Infomaniak processes your data as a data processor exclusively within the framework of a data processing agreement and in accordance with our instructions.
Last updated: July 2026