Who is responsible
The data controller is Savoy Luxury Accommodations, Lda., Avenida da Liberdade 112, 1250-146 Lisbon, Portugal, registered in Portugal under NIPC 514 778 203. We are responsible for the personal data described in this policy and for answering your questions about it. The policy covers the website at savoy-accomodation.com together with the enquiries, reservations and stays we handle through it.
Our data protection officer can be reached at [email protected], or by post at the address above marked «DPO». Please use this contact in preference to the reception for any request about your data.
What we collect
| Data | Why | Legal basis |
|---|---|---|
| Name, e-mail, telephone | To answer an enquiry and hold a reservation | Performance of a contract |
| Dates, guest count, room preferences | To allocate a room and prepare it | Performance of a contract |
| Identity document and nationality | Guest registration required of every Portuguese hotel | Legal obligation (SEF/AIMA reporting) |
| Payment card and billing details | To settle the account and issue an invoice | Legal obligation, contract |
| Dietary needs, accessibility needs, allergies | To serve you safely and correctly | Your explicit consent |
| Notes on your preferences | Coffee, pillow, floor, newspaper — so we do not ask twice | Legitimate interest |
| CCTV at the entrance and lobby | Security of guests and property | Legitimate interest |
| Website usage data | To keep the site working and see which pages are read | Legitimate interest |
We do not buy personal data from third parties, and we do not sell, rent or trade yours.
Sensitive information
Dietary requirements, allergies and accessibility needs can reveal information about your health. We collect them only when you volunteer them, only in order to look after you properly, and we record them as a short operational note rather than a medical record. You can ask us to delete them at any time and the only consequence is that we will ask again on your next stay.
Cookies and this website
The website at savoy-accomodation.com is deliberately plain. It uses no advertising cookies, no analytics cookies, no tracking pixels, no social media widgets and no third-party scripts beyond the Google Fonts stylesheet used to load the two typefaces on the page.
- Strictly necessary storage. None beyond what your browser does by default; the site sets no cookies of its own.
- Google Fonts. Requesting the fonts sends your IP address to Google's servers. If you prefer to avoid this, block the request in your browser — the site remains fully usable in a system typeface.
- Server logs. Our host records IP address, user agent, requested page and timestamp for security and troubleshooting, and deletes them after 30 days.
Because we set no optional cookies, there is no consent banner to click through and nothing to opt out of.
Who else sees your data
We share the minimum necessary, with the following categories of recipient:
- Payment processors — our bank and card acquirer, to take payment. We never store full card numbers ourselves.
- Portuguese authorities — guest registration data submitted as required by law, and tax records held for the statutory period.
- Booking channels — where you booked through an agency or platform, that platform already holds your data under its own policy; we receive it from them.
- Service providers — our property management system, e-mail provider and IT maintenance contractor, all within the European Union and all bound by written processing agreements.
- Suppliers acting on your instruction — a transfer driver, a restaurant, a therapist — and then only your name, the time and what is needed.
Your data is stored on servers within the European Union. We make no routine transfer outside the European Economic Area. If a transfer ever became necessary, we would rely on the European Commission's standard contractual clauses and would say so here.
How long we keep it
| Data | Kept for |
|---|---|
| Enquiries that did not become a booking | 12 months |
| Reservation and stay records | 3 years after departure |
| Invoices and accounting records | 10 years (Portuguese tax law) |
| Guest registration forms | As required by the reporting authority, then deleted |
| Preference notes | Until you ask us to delete them, or 3 years without a stay |
| CCTV footage | 30 days, then automatically overwritten |
| Web server logs | 30 days |
Your rights
Under the General Data Protection Regulation you may:
- ask for a copy of the data we hold about you;
- have inaccurate data corrected;
- have data erased where we have no continuing legal reason to keep it;
- ask us to restrict how we use it while a dispute is resolved;
- receive the data you gave us in a portable, machine-readable form;
- object to processing we carry out on the basis of legitimate interest;
- withdraw consent at any time, where consent was the basis — which does not affect what was lawful before.
Write to [email protected]. We answer within 30 days and we do not charge for it. We will ask you to confirm your identity first, so that we do not hand your stay history to somebody else.
How we protect it
Guest records are held in an access-controlled property management system, with individual accounts for each member of staff, two-factor authentication and logging of who opened which record. Paper registration cards are shredded once transmitted. Card data never reaches our own systems. Staff are trained on confidentiality at induction and annually, and their access ends the day they leave.
If a breach occurred that was likely to put your rights at risk, we would notify the CNPD within 72 hours and write to you directly without delay.
Children
Children are welcome as guests, but we collect their data only through the adult making the booking — a first name and an age for the cot or the extra bed. We do not market to anyone, and certainly not to children.
Forms on this website
The enquiry and availability forms on savoy-accomodation.com are demonstrations. They do not transmit anything: submitting one shows a message in the page and nothing leaves your browser. When the forms are connected to our reservation system, this policy will be updated and dated before that happens.
Changes to this policy
When this policy changes we update the date at the top of the page and keep the previous version on file. Material changes affecting guests with a live booking are notified by e-mail. This version replaces all earlier ones and is effective from 20 September 2026.
Contact
Data protection officer, Savoy Luxury Accommodations, Lda.
Avenida da Liberdade 112, 1250-146 Lisbon, Portugal
[email protected] · +351 21 340 77 80