Privacy policy
Last updated: 27 October 2026
1. Who we are
The controller of your data is Tiago Emanuel & Sofia, Lda. (trading as Rentalgest), tax number (NIPC) 517064022, with its registered office at R. Prof. Dr. Mota Pinto 6, 1.º A, 8600-616 Lagos, Portugal. For any question about your data: geral@rentalgest.com.
2. What data we process, why, and on what basis
| Who | Data | Purpose | Legal basis (GDPR, Art. 6) |
|---|---|---|---|
| Prospective clients (review request on the website) | Name, email, phone, area of the home, type of home, number of properties to be managed and whether a holiday rental licence (AL) is already in place | To reply to the request, prepare the review of the home and present a proposal | Steps taken at the request of the data subject before entering into a contract |
| Prospective clients (where the request came from) | The page of the website where the request was made, the website language and, if present in the page address, the campaign parameters utm_source, utm_medium and utm_campaign | To know which pages and campaigns bring in requests, so we can improve the website and our communication | Legitimate interest |
| Anyone who sends a review request (protection against automated submissions) | An encrypted code derived from the IP address (the IP address is not stored); date and time of the submission | To limit repeated submissions and protect the form against automated submissions (spam) | Legitimate interest (security) |
| Owners (proposal and contract) | Identification, tax number (NIF), address, marital status, contact details, IBAN, property documents, AL licence, insurance, SIBA credentials | To enter into and perform the management contract, pay income, invoice and meet holiday rental (AL) obligations | Performance of a contract and legal obligations |
| Guests | Identification, contact details, dates of stay, identity document (foreign guests), payment details | To manage the booking and the stay, report foreign guests to the authorities and invoice | Performance of a contract and legal obligations |
| Portal users | Email, password (stored encrypted by the authentication system), access logs | To provide secure access to the portal | Performance of a contract and legitimate interest (security) |
We do not use your data for automated decision-making or for third-party advertising.
3. Who we share it with
- Authorities, where required by law: AIMA (reporting of foreign guests through SIBA), the Tax and Customs Authority (Autoridade Tributária), the municipality (tourist tax) and Turismo de Portugal.
- Service providers that process data on our behalf, under contracts that require them to protect it: the app and website database, including review requests (Supabase, with the data stored in Ireland, in the European Union); sending emails, including the internal notice of each review request (Resend), and company email (Google Workspace); website hosting and cookie-free visitor statistics (Vercel, including Vercel Web Analytics); booking system and booking engine at rentalgest.com/en/book (Icnea, a company based in Barcelona, Spain); payments (Stripe); accounting.
- Booking platforms (Airbnb, Booking.com, Vrbo), when the booking is made through them; they have their own privacy policies.
Some of these providers may process data outside the European Union (for example, Vercel and Resend, which are United States companies). In those cases, transfers are made with the safeguards provided for in the GDPR: the provider's certification under the EU-US Data Privacy Framework or the standard contractual clauses approved by the European Commission, as set out in each provider's data processing agreement.
4. How long we keep it
| Data | Period |
|---|---|
| Requests from prospective clients who do not go ahead, including the answers to the review request and where the request came from | 2 years after the last contact, then deleted automatically |
| Requests marked as spam (by Rentalgest or by the system) | 90 days, then deleted automatically |
| Encrypted code derived from the IP address (protection against automated submissions) | 24 hours, then deleted automatically |
| Contract, invoices and accounting documents | 10 years, the legal retention period for accounting records |
| Owner and property documents | For as long as the contract lasts and the legal period that follows |
| SIBA credentials sent with the proposal | Deleted as soon as the home has been set up (within 30 days at most) |
| Guest identification data | The period required by the legislation on reporting guests |
| Portal access logs | 12 months |
Submissions that the system identifies as automated are never stored.
5. Your rights
You can ask to access, rectify, erase or port your data, to restrict its processing or to object to it, by writing to geral@rentalgest.com. We reply within one month. Some data cannot be erased while the law requires us to keep it. You also have the right to lodge a complaint with the Portuguese Data Protection Authority, the Comissão Nacional de Proteção de Dados (www.cnpd.pt).
6. Security
Data is kept in systems with role-based restricted access, encrypted connections and encrypted backups. Passwords are stored encrypted by the authentication system and never in plain text.
7. Cookies and browser storage
The website and the app do not use advertising or tracking cookies. The website does not store anything in your browser: no cookies and no other kind of storage. The app only uses the technical storage needed to keep you signed in. We measure website visits with Vercel Web Analytics, which does not use cookies or identify visitors. Fonts are served by the website itself, with no requests to third parties. The booking page (/en/book) shows the booking engine of our partner Icnea, which may use the technical storage needed to complete a booking. If this changes, this policy will be updated beforehand.
8. Changes
We may update this policy; the date of the latest version is always shown at the top.