Last updated: 30 September 2026

This policy explains how the personal data of visitors and guests of the website penthouse-oceanus.com are collected and used, and what your rights are.

1. Data controller

Victor Da Silva
2 Rue Pasteur, 87000 Limoges, France
Email: contact@penthouse-oceanus.com

2. Data collected and purposes

2.1 Booking a stay

When you book on the website, we collect: last name, first name, email address, phone number, country, postal address (optional), expected arrival time, dates of stay, number of guests, options selected and amounts paid.

This data is used to manage your booking, send you confirmations and practical information before your arrival (access, times), organise check-in and cleaning, collect payments and meet our accounting and tax obligations.

Legal basis: performance of the rental contract (Article 6(1)(b) GDPR) and legal obligations (Article 6(1)(c)).

2.2 Payment

Online payments are processed directly by Stripe or PayPal. We never receive or store your card numbers.

2.3 Contact form

If you write to us via the contact form or by email, we use your name, email address and message only to reply to you.

Legal basis: pre-contractual steps taken at your request (Article 6(1)(b)) or our legitimate interest in answering your questions (Article 6(1)(f)).

2.4 Obligations relating to holiday accommodation in Portugal

As the property is located in Portugal, Portuguese law requires foreign guests to be registered with the competent authorities (SIBA system). The necessary identity details are collected on arrival, solely for this legal obligation (Article 6(1)(c)).

2.5 Audience measurement

With your consent, we use Google Analytics to measure website traffic (pages viewed, referral source, device type). No audience measurement cookie is set without your consent, which you can withdraw at any time.

Legal basis: your consent (Article 6(1)(a)).

2.6 Website security

Our forms are protected against spam by Google reCAPTCHA, which analyses certain technical information (IP address, browsing behaviour on the page).

Legal basis: our legitimate interest in protecting the website against abuse (Article 6(1)(f)).

3. Data recipients

Your data is used by us alone and is never sold. Where relevant, it may be shared with the following providers:

• o2switch (France): website hosting;
• Hetzner (European Union): hosting of our internal management tools;
• Stripe and PayPal : payment processing;
• Google : audience measurement (if you accept it) and spam protection;
• the person in charge of check-in and cleaning, who only receives the information needed for your stay (name, dates, arrival time, number of guests);
• the Portuguese authorities, under the obligation described in section 2.4.

4. Transfers outside the European Union

Google, Stripe and PayPal may process some data in the United States. These transfers are covered by the EU–US Data Privacy Framework and/or the European Commission's standard contractual clauses.

5. Retention periods

• Booking and billing data: for the duration of our relationship, then for the period required by our accounting and tax obligations (up to 10 years);
• Messages received via the contact form: 3 years after the last exchange;
• Audience measurement data: 14 months maximum;
• Cookie choices: 12 months maximum.

6. Cookies

Details of the cookies used and how to manage your choices can be found in our Cookie policy. You can change your preferences at any time via the “Manage consent” link.

7. Your rights

You have the right to access, rectify, erase, restrict, object to and port your data, as well as the right to withdraw your consent at any time. You may also set instructions regarding what happens to your data after your death.

To exercise these rights, write to contact@penthouse-oceanus.com. We will reply within one month.

If you believe your rights have not been respected, you may lodge a complaint with the CNIL (www.cnil.fr).

8. Security

We take appropriate technical and organisational measures to protect your data: encrypted connection (HTTPS), restricted access to management tools, regular backups.