Privacy Policy

1. Introduction

At Lucas Holiday Rentals, we respect your privacy and are committed to protecting your personal information.

This Privacy Policy explains how we collect, process, store, share and protect personal data when you:

• Visit our website at https://www.lucasholidayrentals.com
• Make a direct reservation or book through an online travel platform
• Stay at a property managed by Lucas Holiday Rentals
• Complete an online check-in form
• Communicate with our guest service team or AI assistant
• Make payments for accommodation or additional services
• Contact us regarding property management or business partnerships
• Subscribe to our marketing communications

We process personal data in accordance with the General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, applicable Portuguese legislation and other relevant legal obligations.

2. Data Controller and Company Identification

The company responsible for the personal data processing described in this policy, where acting as data controller, is:

Legal Company Name: ALUCAS APARTMENTS LDA

Trading Name: Lucas Holiday Rentals

Portuguese Tax Identification Number (NIPC): 514142383

Office Address: Largo do Corpo Santo 27, 9060-074 Funchal, Madeira, Portugal

Email: info@lucasholidayrentals.com

Telephone: +351 960 482 066

Website: https://www.lucasholidayrentals.com

Lucas Holiday Rentals manages holiday accommodation in Madeira, Portugal, including properties owned by third parties.

We independently manage guest reservations, guest communications, payment administration and operational services in accordance with our contractual obligations and applicable legislation.

3. Personal Data We Collect

Depending on your interaction with us, we may collect the following categories of information.

3.1 Personal Identification

• Full name;
• Nationality;
• Date of birth;
• Identification document details, where legally required;
• Residential address, where necessary;
• Other details required for mandatory guest registration.

3.2 Contact Information

• Email address;
• Mobile telephone number;
• Other contact information voluntarily provided.

3.3 Reservation Information

• Property reserved;
• Reservation reference;
• Check-in and check-out dates;
• Number of guests;
• Guest names and registration details;
• Reservation status;
• Arrival information and special requests;
• Communication history relating to the reservation.

3.4 Payment Information

For direct bookings, we may process or receive:

• Transaction amount;
• Payment status;
• Transaction references;
• Billing details;
• Last four digits of the payment card;
• Refund information.

We do not require guests to send their full payment card details through ordinary email or messaging channels.

3.5 Website and Technical Information

Our website may collect:

• IP address;
• Browser information;
• Device and operating system details;
• Website navigation information;
• Cookie identifiers;
• Information relating to website performance, analytics and marketing activity.

This information is collected and processed in accordance with the legal requirements applicable to the technologies concerned.

4. How Personal Data Is Collected

We obtain personal information through several channels.

Direct reservations

When guests reserve accommodation through our official website, relevant personal and reservation information is collected through our booking system.

Third-party booking platforms

When guests book through platforms such as Booking.com, Airbnb, Vrbo or Expedia, we receive the information necessary to manage the reservation.

Online guest registration

Before arrival, guests may be required to complete an online check-in form containing the information necessary for guest identification and statutory reporting.

Direct communications

We may collect information when guests contact us through email, telephone, WhatsApp, booking platforms or other authorised communication channels.

Website interaction

Technical information may be collected automatically through cookies and related technologies, subject to applicable consent requirements.

5. Purposes and Legal Bases for Processing

We process personal information for the following purposes.

Reservation management

To confirm bookings, prepare accommodation, coordinate arrivals, manage changes and provide the agreed services.

Legal basis: Performance of a contract, Article 6(1)(b) GDPR.

Legal compliance

To issue invoices, maintain accounting records, register guests and comply with applicable reporting obligations.

Legal basis: Compliance with a legal obligation, Article 6(1)(c) GDPR.

Customer support and communication

To respond to enquiries, provide arrival instructions, resolve problems and assist guests during their stay.

Legal basis: Performance of a contract or legitimate interests, as applicable, under Articles 6(1)(b) and 6(1)(f) GDPR.

Property protection and security

To investigate incidents, report damage, prevent fraud and establish or defend legal claims.

Legal basis: Legitimate interests and, where applicable, legal obligations.

Marketing

To communicate relevant promotions, offers and commercial information where legally permitted.

Legal basis: Consent where required, or another applicable lawful basis.

Website analytics and advertising

To assess website performance, understand visitor behaviour and measure advertising effectiveness.

Legal basis: Consent for non-essential cookies and tracking technologies where required by law.

6. Booking Management Systems: Boom and OnSeason

Lucas Holiday Rentals uses Boom and OnSeason as integrated technology providers to manage property availability, direct reservations and operational processes.

The systems exchange information necessary to provide our services.

6.1 Information Transmitted from Boom to OnSeason

Boom provides OnSeason with relevant property information required to display and manage accommodation on our direct booking website.

Depending on the integration, this may include:

• Property descriptions;
• Accommodation characteristics;
• Availability;
• Prices;
• Booking restrictions;
• Other information required to operate the booking engine.

This enables guests to search for accommodation and make reservations directly through our website.

6.2 Information Transmitted from OnSeason to Boom

When a guest completes a direct reservation through OnSeason, the relevant reservation information is communicated to Boom.

The information transmitted includes:

• Guest name;
• Number of guests;
• Telephone number;
• Email address;
• Last four digits of the payment card used for the reservation;
• Relevant booking information needed to manage the stay.

This data exchange allows Lucas Holiday Rentals to manage reservations, coordinate guest arrivals, provide customer assistance and maintain operational records.

6.3 Purpose of the Integration

The integration between Boom and OnSeason is used to:

• Maintain accurate availability and reservation information;
• Prevent operational inconsistencies;
• Manage bookings centrally;
• Coordinate guest communications;
• Support check-in procedures;
• Improve the efficiency of property management.

Personal data exchanged between these platforms must be limited to information necessary for the relevant services.

Boom and OnSeason are subject to their applicable contractual responsibilities and data protection obligations.

Their precise roles as processors or independent controllers depend on the relevant processing activities and contractual arrangements.

7. Secure Online Payments Through Stripe

Direct reservations made through the Lucas Holiday Rentals website are processed using Stripe, our online payment service provider.

OnSeason provides the booking interface, which is integrated with Stripe to facilitate payment.

When a guest makes a payment:

• The guest selects accommodation and completes the booking information through OnSeason.
• The payment process is handled through the secure Stripe integration.
• Stripe processes the payment card information necessary to authorise and complete the transaction.
• Relevant payment confirmation and limited transaction information are returned to the booking systems.

Lucas Holiday Rentals receives only the payment-related information necessary for reservation management, reconciliation and customer support, including the last four digits of the card where provided.

We do not receive or retain full payment card numbers or card security codes through this booking integration.

Stripe may process personal data in accordance with its own applicable privacy notices and contractual arrangements.

Stripe Privacy Policy: https://stripe.com/privacy

Guests are encouraged to use only the official payment methods provided during the booking process.

8. Guest Information and Property Owners

Lucas Holiday Rentals manages accommodation on behalf of individual property owners.

As part of our property management service, owners receive the financial information required to understand the performance of their property and receive their rental income.

However, we do not routinely share guests' personal identification or contact details with property owners.

In particular, owners do not receive guest lists containing:

• Guest names;
• Telephone numbers;
• Email addresses;
• Identification or passport information;
• Payment card details.

Instead, property owners receive financial reports and settlements concerning the reservations at their properties.

These reports may include:

• Accommodation revenue;
• Applicable platform commissions;
• Management commissions;
• Relevant operating expenses;
• Amounts transferred to the owner.

Owners receive the amounts due to them after deduction of the applicable management commission and any other agreed expenses.

Our objective is to provide owners with the information necessary for transparent financial management without unnecessarily disclosing guest personal data.

Information may be disclosed to an owner exceptionally where necessary to comply with the law, establish or defend legal claims, address a serious incident or fulfil another lawful obligation. Any such disclosure will be limited to the information necessary for that purpose.

9. Mandatory Guest Registration

Portuguese legislation imposes certain guest identification and reporting obligations on accommodation operators.

Where applicable, Lucas Holiday Rentals collects the information necessary for the mandatory registration of foreign guests.

This information may include:

• Full name;
• Nationality;
• Date of birth;
• Identification document details;
• Arrival and departure dates;
• Other information required by applicable law.

Relevant data may be communicated through the Sistema de Informação de Boletins de Alojamento (SIBA) to the competent Portuguese authorities.

This processing is performed to comply with legal obligations and does not depend on marketing consent.

Online check-in and registration services may be used to collect and transmit the required information securely.

10. AI-Powered Guest Communication

Lucas Holiday Rentals uses artificial intelligence to help provide efficient and multilingual guest support.

Our AI guest assistant, Olivia, may assist with:

• Reservation enquiries;
• Check-in instructions;
• Property information;
• Frequently asked questions;
• Local recommendations;
• Translation;
• Guest requests requiring operational coordination.

Where a guest interacts directly with Olivia, the assistant must clearly identify itself as an AI assistant at the beginning of its first interaction with that guest.

After this disclosure has been made, it does not need to be repeated in every subsequent message within the same conversation, unless clarification or an additional disclosure is necessary.

Guests may request assistance from a human team member at any time.

To generate relevant responses, the AI system may process information already associated with the reservation, previous conversation messages and information supplied by the guest.

AI communication systems must be subject to appropriate access controls, contractual safeguards and relevant data protection measures.

We do not intend to use solely automated processing to make decisions producing legal or similarly significant effects on guests without the applicable safeguards required by the GDPR.

11. Resort Fee and Insurance-Related Data Processing

Lucas Holiday Rentals includes a resort fee associated with property damage protection in its reservations.

The amount may vary depending on the property.

If an incident occurs, we may process relevant information to:

• Document property damage;
• Investigate the circumstances;
• Submit eligible insurance claims;
• Communicate with insurance administrators;
• Arrange necessary repairs;
• Establish or defend legal claims.

Information may include reservation details, incident reports, relevant correspondence and photographs of damaged property.

Where necessary, such information may be shared with an insurer, claims administrator, repair provider or other party directly involved in resolving the incident.

Only information necessary for the relevant purpose should be disclosed.

12. Cookies, Website Analytics and Marketing Technologies

Our website uses technology for functionality, analytics and marketing.

This may include cookies, tracking pixels and similar technologies.

12.1 Strictly Necessary Cookies

These support essential functions such as website security, session management and booking functionality.

They may be used without consent where an applicable exemption permits this.

12.2 Analytics Cookies

We use analytics technologies to better understand how visitors interact with our website.

These may help us evaluate:

• Website traffic;
• Visitor navigation patterns;
• Booking conversion activity;
• Website performance;
• Areas for improvement.

Where analytics cookies or comparable technologies are not strictly necessary, they will be used only after valid consent has been obtained.

12.3 Marketing and Advertising Cookies

We also use marketing technologies that may support:

• Advertising measurement;
• Campaign performance analysis;
• Conversion tracking;
• Marketing effectiveness;
• Other advertising activities disclosed in our cookie information.

These technologies may involve third-party services.

Where required by law, marketing cookies and similar technologies will only be activated after the visitor provides valid consent.

12.4 Cookie Consent and Preferences

Visitors should be able to:

• Accept optional cookies;
• Reject optional cookies;
• Manage cookie categories;
• Withdraw consent at any time.

Withdrawing consent must be possible as easily as giving it.

More detailed information about individual cookies, service providers, purposes and retention periods should be provided through the website's cookie information or preference interface.

13. Data Retention

Lucas Holiday Rentals follows a general retention period of 90 days for routine guest communications and operational personal data after the guest's departure or the closure of the relevant service request, where continued retention is not necessary.

This period applies to ordinary operational information that is no longer needed after the conclusion of the guest's stay and associated service processes.

However, some categories of information must be retained for longer periods because of legal, financial, contractual or security obligations.

13.1 Routine Guest Communications

Routine guest correspondence, check-in coordination messages and other non-essential operational information are generally retained for up to 90 days following departure or closure of the relevant matter.

Where information is required in connection with an unresolved complaint, dispute or legal claim, it may be retained for a longer justified period.

13.2 Accounting and Financial Records

Invoices, accounting records and their supporting documentation are retained for the period required under Portuguese tax and accounting legislation, generally 10 civil years following the relevant year, or longer where legally required.

This information may include limited personal data necessary to support financial records.

13.3 Mandatory Guest Registration

Information collected for legally required guest registration and reporting is retained for the period established by the applicable legal requirements.

Such information is not necessarily subject to the general 90-day operational retention period.

13.4 Insurance Claims and Disputes

Information connected with property damage, insurance claims, unresolved complaints or legal proceedings may be retained for as long as reasonably necessary to manage the matter and meet applicable legal obligations.

13.5 Marketing Data

Marketing contact information may be retained while a valid legal basis exists and until the relevant consent is withdrawn, the individual objects or another applicable retention limit is reached.

Minimal suppression information may be retained where necessary to ensure that an opt-out request continues to be respected.

13.6 Cookies and Analytics

Cookie-related information is retained according to the purposes, settings and retention periods of the technologies used, as disclosed in the relevant cookie information.

13.7 Deletion and Anonymisation

When personal information is no longer required, we will delete or anonymise it, subject to relevant technical and legal requirements.

Where a service provider holds information on our behalf, we will address retention and deletion through the applicable contractual and technical arrangements.

14. Sharing Information with Service Providers

To deliver our services, we use selected technology and operational providers.

These may include:

• Boom, for property management and guest communications;
• OnSeason, for our website booking engine and direct reservation processing;
• Stripe, for online payment processing;
• Online check-in and statutory registration service providers;
• Booking platforms such as Airbnb, Booking.com, Vrbo and Expedia;
• Website hosting, analytics and marketing providers;
• Accounting and invoicing service providers;
• Insurance providers and claims administrators;
• Maintenance and operational contractors where necessary.

Data is shared only where relevant to the services provided or required by law.

We do not sell guests' personal information to third parties.

Where required under the GDPR, appropriate data processing agreements and contractual safeguards must be in place.

15. International Data Transfers

Certain service providers may process personal data outside the European Economic Area.

Where international transfers occur, we take steps to ensure that appropriate safeguards are implemented in accordance with Chapter V of the GDPR.

These may include:

• European Commission adequacy decisions;
• Standard Contractual Clauses;
• Other legally recognised transfer mechanisms;
• Additional technical and organisational safeguards where necessary.

Guests may contact us for information about safeguards relevant to their personal data.

16. Data Security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, alteration, destruction or disclosure.

These may include:

• Restricted access to reservation systems;
• User authentication;
• Secure payment processing through Stripe;
• Access controls for guest information;
• Confidentiality obligations;
• Appropriate contractual safeguards;
• Procedures for managing security incidents.

Access to personal data is limited to individuals and providers who need the information for authorised operational or legal purposes.

No electronic system is completely free of risk, but we seek to implement measures proportionate to the information being processed.

17. Marketing Communications

We may contact guests and prospective customers regarding promotions, accommodation offers and relevant business information where legally permitted.

Where consent is required, we will request it before sending marketing communications.

Guests may withdraw consent or object to direct marketing at any time.

Requests may be submitted to:

info@lucasholidayrentals.com

Where applicable, marketing emails will also provide a suitable unsubscribe mechanism.

Withdrawal of marketing consent does not prevent us from sending necessary booking, payment, safety or other non-promotional service communications.

18. Data Protection Rights

Under the GDPR, individuals may exercise the following rights, subject to the applicable legal conditions:

• Access to personal data;
• Rectification of inaccurate information;
• Erasure of personal data;
• Restriction of processing;
• Data portability;
• Objection to certain processing activities;
• Withdrawal of consent;
• Rights relating to qualifying automated decision-making.

You may exercise your rights by contacting:

info@lucasholidayrentals.com

We may request appropriate identity verification before disclosing personal information.

We will respond within the time limits established by applicable data protection legislation, normally one month.

Certain requests may be restricted where information must be retained to comply with legal obligations or establish, exercise or defend legal claims.

19. Complaints and Supervisory Authority

If you have concerns about the way Lucas Holiday Rentals processes your personal information, we encourage you to contact us.

You also have the right to lodge a complaint with the Portuguese data protection supervisory authority:

Comissão Nacional de Proteção de Dados (CNPD)

Website: https://www.cnpd.pt

For general consumer complaints concerning our accommodation services, the official Portuguese Electronic Complaints Book is also available:

https://www.livroreclamacoes.pt/Pedido/Reclamacao

These are separate complaint procedures and are intended for different types of issues.

20. Children's Personal Information

We may process limited personal data concerning children where necessary to manage family reservations, provide accommodation or comply with guest registration requirements.

Where required, the relevant information must be provided by a parent, legal guardian or other authorised person.

We do not knowingly use children's personal data for independent direct marketing without an appropriate legal basis.

21. Special Requests and Sensitive Information

Guests may voluntarily share information concerning accessibility, health-related requirements or other circumstances relevant to their stay.

Where such information constitutes special-category personal data under Article 9 of the GDPR, we will process it only where an appropriate legal basis and Article 9 condition apply.

We seek to minimise the collection of sensitive information and, where possible, record only the practical accommodation requirements.

22. Property Owners and Business Relationships

In addition to guest services, Lucas Holiday Rentals processes personal information relating to property owners, potential clients and business partners.

Such information may include:

• Contact information;
• Property details;
• Contract information;
• Billing information;
• Commercial correspondence;
• Financial and property performance records.

This information is processed for contractual, administrative, commercial or legal purposes, as applicable.

Property management reporting does not ordinarily involve sharing identifiable guest contact information with property owners.

23. External Links and Third-Party Services

Our website may contain links to external booking platforms, payment providers, activities, transport providers or other businesses.

These third parties may operate under their own privacy policies and act as independent data controllers.

We recommend that users review the applicable privacy information before providing personal information to external services.

24. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in legislation, technology, service providers or our business operations.

The latest version will be published on our website with the relevant update date.

Where changes require additional notification or consent, we will take appropriate steps in accordance with the law.

25. Contact Information

For questions about this Privacy Policy or requests relating to personal data, please contact:

ALUCAS APARTMENTS LDA, trading as Lucas Holiday Rentals

NIPC: 514142383

Address: Largo do Corpo Santo 27, 9060-074 Funchal, Madeira, Portugal

Email: info@lucasholidayrentals.com

Telephone: +351 960 482 066

Website: https://www.lucasholidayrentals.com

Lucas Holiday Rentals is committed to protecting personal information and maintaining transparency regarding the technologies and processes used to deliver its services.