Privacy Policy

Last updated: 11 July 2026. This policy explains what personal data this website collects, why, and what your rights are under the EU General Data Protection Regulation (GDPR).

Who is responsible for your data

Masana Algarve, Rua Torre da Medronheira, 8200-635 Olhos de Água, Albufeira, Portugal. [ Data controller legal name, registration and VAT number: TBC ] For any privacy matter, write to info@masanaalgarve.com or call +351 289 373 960.

What we collect, and why

Contact form. When you write to us we collect your name, e-mail address and message, and any dates you choose to share. We use them for one purpose: to answer you. Legal basis: taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR). Your message is stored privately in our website system and e-mailed to our team. We also send you an automatic confirmation that your message arrived. We keep enquiries until you ask us to remove them.

Bookings. Reservations are not made on this website. When you book, you are taken to the Hyatt booking engine (hyatt.com), where Hyatt acts as its own data controller under the Hyatt privacy policy. The dates and guest numbers you pick here are passed to Hyatt in the booking link. Your name and e-mail are required in our date-picker before you can continue, and we keep them so we can follow up on that stay. The number of children is recorded only as a count: we never ask for anything that identifies a child. Legal basis: taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR). They are stored with Brevo, our e-mail provider, on servers in the EU, and we keep them until you ask us to remove them. We do not add you to any mailing list.

Technical data. Like every website, our server records standard access logs (IP address, time, page requested) for security and troubleshooting, kept for a short period by our hosting provider. [ Hosting provider and log retention: to confirm at migration ] To prevent abuse, our contact form briefly counts submissions per IP address (stored in irreversible hashed form for 10 minutes, then gone).

Map. The location map is served by Mapbox (api.mapbox.com). When the map loads, your browser requests map data from Mapbox, which sees your IP address as part of that request.

Cookies and local storage

We measure how the site is used with Google Analytics: which pages are viewed, the site that referred you, and your approximate country. This only happens if you accept statistics cookies, and those cookies are stored on your device. If you decline, we measure nothing. We always ask for your consent before placing statistics or advertising cookies. We use one piece of session storage (deleted when you close the browser) to remember that you have already seen our farewell message, so it does not appear twice. WordPress sets login cookies only for our own staff, never for visitors. E-mail is different: the messages we send through Brevo carry a reading pixel and rewritten links, which lets us see whether a message was opened and which links were clicked.

Advertising. If you accept marketing cookies, Meta and Google learn that our ads brought you here, so we know which ads work. You can change your choice at any time in the cookie settings.

Who we share data with

We do not sell or rent your data. It is shared only with the service providers needed to run this site: our hosting provider, Brevo for e-mail delivery, Hyatt when you complete a booking, and Mapbox when the map loads. Brevo processes your name and e-mail address in order to deliver our messages, and records whether a message was opened and which links were clicked; its data is hosted in the EU. Where a provider processes data outside the EU/EEA, we rely on the safeguards provided for in the GDPR, such as adequacy decisions or standard contractual clauses.

Your rights

You can ask us at any time to access, correct, delete or export the personal data we hold about you, to restrict or object to how we use it, and to withdraw consent where consent is the basis. Write to info@masanaalgarve.com; we answer within one month. You also have the right to lodge a complaint with the Portuguese supervisory authority, CNPD — Comissão Nacional de Proteção de Dados (cnpd.pt).

Security and changes

Access to stored enquiries is restricted to authorised staff, and the site applies technical measures appropriate to the low volume and low sensitivity of the data it handles. If this policy changes, the new version is published on this page with an updated date.