Privacy & Cookie Use Policy

Version 1.2 - July 31, 2026


Welcome to Astoundinn's booking platform (the "Platform", "Astoundinn", "We", "Us", or "Our".

The Platform allows guests or tenants to perform online booking or reservations of properties and

rooms (the "Service").

This privacy policy (the "Policy") outlines our privacy practices with respect to the Service,

including the ways your personal information and data are collected, stored, used and shared.

Providing us with your personal information is a choice you make. We appreciate that and thank

you for making this choice. You are not legally obligated to provide us with this information, but

We do need it to allow you to use the Service.


Astoundinn acts as the data controller and is responsible for the collection and use of any data

that you submit or provide through the Service.


In addition to this privacy statement, we may have additional policies or codes of conduct which

will apply in relation to your use of the Service. If you have any questions about your use of the

Service, please contact us.


What kind of personal information is collected?

When you submit an inquiry, make a customer service request or register an account, you

provide contact information such as your name, address, mobile phone number and email

address.


We may collect your credit card or debit card information when you pay for the Service. This

information is collected on our behalf by a payment processor. We may use cookies and similar

tracking technologies to collect information on our website, and via email. Additionally, We may

collect your IP address from your internet service provider and may collect your bank details

upon property owners' need.


Where a reservation requires direct payment or a security deposit to be handled by the property

owner rather than through Astoundinn's payment processor, We may share the strictly necessary

bank account details you provide with that specific property owner, solely for the purpose of

enabling that payment or refund, and only to the extent required for that transaction. Astoundinn

does not otherwise use your bank details for any other purpose.


Legal basis for processing

In accordance with Article 6 of the GDPR, We only process your personal data where We have a

valid legal basis to do so. Depending on the purpose, this basis may be:


  • the performance of a contract, when processing is necessary to manage your booking or reservation; 
  • compliance with a legal obligation, such as tax, accounting or accommodation-registration requirements;
  • Our legitimate interests, namely to ensure the security of the Service, prevent fraud, and  improve Our systems, provided these interests do not override your rights and freedoms;
  • your consent, in particular for e-marketing communications and for non-essential cookies, which you may withdraw at any time.


Cookies and similar technologies

We use cookies and similar tracking technologies on the Platform to operate the Service,

understand how it is used, and, where you consent, to personalise content and marketing. These

fall into three categories:

  • Strictly necessary cookies, which are required for the Platform to function (such as keeping you logged in or completing a booking) and do not require your consent;
  • Analytics cookies, which help Us understand how the Service is used so We can improve it, and are only placed with your consent;
  • Marketing cookies, used to show you relevant offers and measure their performance, also placed only with your consent.


When you first visit the Platform, a cookie banner allows you to accept or reject non-essential

cookies and to manage your preferences at any time through Our cookie settings. Cookies are

retained for varying periods depending on their purpose, generally not exceeding 13 months,

after which your consent will be requested again.


Use & Disclosure of collected information

We may share the information you shared with us with third party service providers in order to

provide and support the Service:

  • communicating with you regarding the use of the Service and respond to your requests;
  • enhancing the security and safety of the Service, such as by investigating suspicious activity or violations of applicable terms or policies;
  • developing new tools, products or services within the Service;
  • associating activity on the Service across different devices operated by the same individual to improve the overall operation of the Service;
  • to identify and fix bugs that may be present;
  • conducting data and system analytics, including research to improve the Service;
  • comply with any applicable law and assisting law enforcement agencies and competent authorities, if We believe it is necessary or justified.


In certain limited cases, We may use automated tools to support functions such as fraud

detection, pricing or the presentation of recommendations within the Service. Where this occurs,

appropriate safeguards are applied and you may contact Us to obtain further information or to

request human review.


Data retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this

Policy, namely for the duration of your relationship with Astoundinn plus any additional period

required to comply with applicable legal, tax or accounting obligations (in Portugal, generally up

to 10 years for accounting and invoicing records). Data collected on the basis of your consent,

such as for e-marketing, is retained until you withdraw that consent. Once these periods elapse,

your data is deleted or anonymised.


International data transfers

Some of the third party service providers referred to in this Policy, including payment processors

and analytics providers, may be located outside the European Economic Area (EEA). Where this

occurs, We ensure that appropriate safeguards are in place, such as an adequacy decision by

the European Commission or Standard Contractual Clauses, to ensure your personal data

continues to benefit from a level of protection equivalent to that guaranteed within the EEA. You

may request further information on these safeguards by contacting Us.


Accessing, modifying, exporting or deleting your information

You have the following rights with respect to your personal data:

  • The right to request a copy of your personal data.
  • The right to request correction of your personal data if inaccurate or out of date.
  • The right to request deletion of your personal data when it is no longer necessary to retain such data.
  • The right to withdraw any consent to personal data processing at any time. For example, your consent to receive e-marketing communications.


If you want to withdraw your consent to e-marketing, please make use of the link to manage your

subscriptions included in our communication. Please note that you may still receive system

messages and administrative communications, such as order confirmation, system messages

and notifications about your account activities.

  • The right to request that your personal data be provided to you and, where possible, transferred directly (in a portable format) to another data controller when processing is based on consent or contract.
  • The right to request a restriction on further data processing in case of a dispute regarding the accuracy or processing of your personal data.
  • The right to object to the processing of personal data where processing is based on legitimate interests and/or direct marketing.


We will respond to any request to exercise these rights within one (1) month of receipt. This

period may be extended by a further two months where necessary, taking into account the

complexity and number of requests, in which case We will inform you of the extension and the

reasons for it. To exercise any of these rights, please contact Astoundinn at

reservations@astoundinn.com.


Right to lodge a complaint

If you believe that Our processing of your personal data infringes applicable data protection law,

you have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados

(CNPD), the Portuguese data protection supervisory authority, without prejudice to any other

administrative or judicial remedy.