01Who handles your data
The controller of personal data processed by Casa do Mar is Vasco Manuel Bentes da Silva Neves Ribas, the operator of the local accommodation registered under 88348/AL.
For privacy matters, contact us at [email protected], by telephone on +351 927 050 766, or by post at Rua do Mar, 8, 7580-645 Comporta, Portugal.
This notice concerns identity verification of the adult responsible for a direct booking.
02Why we request verification
We want to welcome our guests with confidence and peace of mind. Confirming the identity of the person responsible for the booking helps us prevent fraudulent bookings and identity misuse, ensure that we are communicating with the person entering into the contract, and protect the house, our guests and our contractual rights.
This verification is separate from registration of the other guests and the legally required reporting of foreign nationals.
03How it works and what data is processed
We use Stripe Identity. On a page provided by Stripe, you may be asked to:
- Present a valid identity document, captured using your device’s camera;
- Confirm document details, including its number;
- Take a selfie to compare with the photograph on the document;
- Confirm your email address using a code.
Data processed may include your name, date of birth, document details and images, selfie, email address, verification result and technical information such as your IP address and device data.
Casa do Mar can access the images, information submitted or extracted, and verification result. We do not receive the biometric identifiers Stripe uses to compare your face with the document photograph.
Please use the verification process provided rather than sending photographs of identity documents by email or messaging apps.
04Legal grounds and alternative methods
Data needed to identify the contracting person and manage the booking is processed to prepare and perform the contract. Fraud prevention, security and the defence of rights rely on our legitimate interests, balanced against the guest’s rights and interests.
Biometric comparison requires explicit consent. Copying a Portuguese Citizen Card also requires consent where no other legal ground permits it. Accepting the contract or paying for the booking does not replace these consents.
If you prefer not to use biometrics, do not authorise copying your document, or do not wish to use Stripe, please contact us. We will arrange an appropriate alternative way to verify your identity remotely, without automated facial recognition and, where applicable, without retaining a copy of the document.
Choosing another method does not remove the requirement to verify the identity of the person responsible for the booking. If a difficulty or discrepancy arises, we will review it with you; an unsuccessful technical result does not, on its own, determine an automatic decision about the booking.
05Stripe’s role and access to data
Stripe provides verification services to Casa do Mar and processes certain data on our behalf. Casa do Mar and Stripe also act as independent controllers for processing whose purposes each determines.
Stripe may use data to operate and improve its services, prevent fraud and maintain security, as described in its Privacy Policy. Any permission to improve biometric technology is separate and optional.
Access by Casa do Mar is limited to those who need to manage the booking, verify identity or handle an incident. We do not sell verification data or use it for advertising. Data may be disclosed to authorities where legally required.
Stripe may use group companies and verification service providers. Data is processed and stored in the United States, and other processing may take place outside the European Economic Area. Stripe’s policy describes the applicable safeguards, including adequacy decisions and standard contractual clauses, and how to obtain information about those safeguards.
06How long data is kept
We retain only data needed for the stated purposes. The current account configuration sets a three-year retention period for non-biometric data stored by Stripe on our behalf. This does not require us to keep all data for three years: we will arrange earlier deletion when it is no longer needed.
The need to retain images and other verification information will be reviewed after the stay and settlement of the security deposit. If an incident or dispute arises, information needed to resolve it and defend rights may be preserved for the legally justifiable period.
Stripe applies its own rules to data it processes as an independent controller. According to its information, biometric identifiers used for verification are deleted within a maximum of one year. Deletion of images and data stored on our behalf is a separate process.
07Your rights and how to contact us
Under the General Data Protection Regulation, you may request access, rectification, erasure, restriction of processing and, where applicable, data portability, and object to processing based on legitimate interests.
You may withdraw consent at any time without affecting the lawfulness of processing already carried out.
To exercise your rights in relation to Casa do Mar, email [email protected]. We may ask only for information needed to confirm the identity of the person making the request.
For processing by Stripe as an independent controller, you may also contact [email protected]. A request addressed to one entity may not cover data retained by the other.
You may complain to the Portuguese Data Protection Authority (CNPD) or another competent supervisory authority.