Privacy Policy

Last updated: September 2026

This Privacy Policy explains how Native Souls Lda. collects and uses personal data when you visit nativesouls.org, contact us, or make a direct reservation for Casa do Caminho Velho.

1. Data controller

Native Souls Lda.
Rua António Andrade 4 B
1700-044 Lisboa, Portugal
NIF: 517657791
Email: hello@nativesouls.org

Native Souls Lda. is the controller of the personal data described in this policy.

2. Personal data we collect

Depending on how you interact with us, we may collect:

  • Contact and booking details: name, email address, telephone number, address, country, arrival time, number and composition of guests, stay dates, preferences, notes and messages.

  • Guest-registration details: identification, nationality, date of birth and other information required under applicable accommodation, immigration or public-security rules.

  • Payment and transaction details: amounts due and paid, payment status, billing details, refunds and limited card information made available by our payment provider. Native Souls does not receive or store complete payment-card numbers or security codes.

  • Communications: emails, enquiries, requests, feedback and records needed to manage your stay or a complaint.

  • Website and device data: IP address, browser and device information, pages visited, approximate location, referral information and cookie or consent preferences.

If you book for other guests, you must ensure that you are authorised to provide their data and that they are informed of this policy.

3. Why we use personal data and our legal bases

We use personal data to:

  • respond to enquiries and take steps at your request before a booking;

  • create, manage and fulfil the accommodation contract, including check-in, guest communications, payment requests, changes and cancellations;

  • process payments, prevent fraud and manage refunds or disputes;

  • comply with tax, accounting, invoicing, accommodation, guest-registration, insurance and other legal obligations;

  • protect guests, the property, our systems and our legal rights, and establish, exercise or defend legal claims;

  • operate, secure and improve our website and booking process; and

  • send marketing communications only where we have a valid legal basis, including consent where required.

The legal bases we rely on are performance of a contract or steps before entering into a contract; compliance with legal obligations; our legitimate interests in operating and protecting our accommodation business, preventing fraud and improving our services, where those interests do not override your rights; and consent where the law requires it.

4. Direct bookings, Smoobu and Stripe

Our direct-booking process uses Smoobu to display availability, receive reservations, manage guest communications and coordinate booking information. Information entered in the booking engine is processed through Smoobu for these purposes.

Online card payments are processed securely by Stripe. Stripe receives the information required to authorise and process the payment, prevent fraud and comply with financial regulation. Stripe acts as an independent controller for certain regulated payment activities and as a processor for other services. Its own privacy information also applies to its processing.

The website is hosted and managed using Squarespace, which may process technical, form, security and cookie information necessary to provide the website.

5. Who receives personal data

We share data only where necessary with service providers and recipients such as Smoobu, Stripe, Squarespace, email and IT providers, accountants, legal or insurance advisers, and competent Portuguese authorities where disclosure or guest registration is legally required. We may also disclose data where necessary to protect guests, the property or our legal rights.

These recipients receive only the data needed for their role and are subject to contractual or legal confidentiality and data-protection obligations.

6. International transfers

Some service providers may process data outside Portugal or the European Economic Area. Where this occurs, transfers are protected by an adequacy decision, European Commission standard contractual clauses or another safeguard permitted by the GDPR. You may contact us for information about the safeguard relevant to your data.

7. How long we keep data

We keep personal data only for as long as necessary for the purpose for which it was collected and to meet legal, accounting, tax, insurance and claims requirements. Booking and accounting records are retained for the period required by Portuguese law, which is generally up to 10 years for relevant tax and accounting records. Guest communications are retained while needed to manage the stay and for a reasonable period afterwards. Data connected with a dispute or legal claim may be kept until the matter and applicable limitation periods have ended.

Marketing data is kept until consent is withdrawn or you object. Cookie and technical-data retention depends on the cookie or service concerned and is described, where applicable, through the site’s cookie controls.

8. Cookies and similar technologies

The site may use strictly necessary cookies for security, navigation, booking and payment functions. Analytics, preference or marketing cookies are used only where permitted and, where consent is required, after you make a choice through the cookie banner. You can change your choices through the available cookie settings and can also control cookies in your browser. Disabling necessary cookies may prevent parts of the site or booking engine from working correctly.

9. Data security

We use reasonable technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration or disclosure. No online service is completely risk-free, but we review access and use service providers designed to provide appropriate security.

10. Your rights

Subject to the conditions in the GDPR, you may request access to your data, correction of inaccurate data, erasure, restriction of processing, data portability, or object to processing based on legitimate interests or to direct marketing. Where processing is based on consent, you may withdraw consent at any time without affecting earlier lawful processing.

To exercise a right, email hello@nativesouls.org. We may need to verify your identity and will respond within the period required by law. Some rights may be limited where we must retain or use data to comply with law, perform a contract or defend legal claims.

You may also lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD) at cnpd.pt or with another competent supervisory authority.

11. Children

Reservations must be made by an adult. We do not knowingly collect personal data directly from children for marketing. We may process limited information about children included in a stay when needed to manage the booking, ensure safety or comply with legal obligations. The adult responsible for the booking must provide such information lawfully.

12. Automated decision-making

Native Souls does not make decisions producing legal or similarly significant effects solely by automated means. Stripe and other security providers may use automated fraud-prevention tools as described in their own privacy information.

13. Changes and contact

We may update this policy when our services, providers or legal obligations change. The current version and its update date will be published on this page.

Questions about privacy or this policy should be sent to hello@nativesouls.org.