Policy on Privacy

1. Data controller

The data controller responsible for processing your personal data is:

• Quinta Picouto de Cima
• R. Portelinha 260, 4800-429 Guimarães, Portugal
• Email: Email

2. What data we collect and when

Contact form

When you send us a message at /contact details We collect: name, email address, telephone number (optional), subject and message. This data is stored in our database (Cloud Firestore, provided by Google) and is also sent to us by email so that we can reply.

Bookings (accommodation, events, experiences)

When requesting a booking in /reservar We collect: name, email, telephone number, desired days and times, number of people — including the number of children and the age of each one — and notes you want to leave us. The data is stored in Cloud Firestore and sent by email to the Quinta's team.

Requests made through an AI assistant

A booking request can reach us via an AI assistant (ChatGPT, Gemini and the like), made in his name. This request includes your name, email, phone number, the day and time of the visit, and the number of people — including the number of children and the age of each one. This request Not a reserve: we send an email to your address asking for confirmation, and it is your click that authorises the processing of the data. Without this confirmation, the order is deleted after 24 hours and does not reach us.

Orders from the online shop

When buying wine at /wines We collect the following information: name, email address, telephone number, delivery address and confirmation that you are aged 18 or over. Payment is not processed on the website — we will contact you by email to arrange this.

Website navigation

We use the Firebase Analytics (a version of Google Analytics 4) to gain an aggregate understanding of how the website is used: pages visited, device, country, session duration. This information is pseudonymised and used only in aggregate form; it is not used to identify you individually.

3. What do we use this data for?

• Replying to your messages, confirming bookings and processing orders;
• To comply with legal and accounting obligations (in the case of orders);
• To improve the website’s presentation and usability, based on aggregated statistics.

We do not use your data for targeted advertising, automated profiling or to sell it to third parties.

4. Legal basis

• Performance of the contract or pre-contractual measures — to respond to booking enquiries, orders and messages initiated by you;
• Compliance with a legal obligation — to keep invoices and sales records as required by law;
• Legitimate interest — for aggregated statistical analysis of website usage (Firebase Analytics).

5. Who we share your data with

Your data is processed by us and by the following technical data processors, all of whom are subject to contractual data protection obligations:

• Google (Firebase / Google Cloud) — database and file hosting, email queue and Analytics. Data stored in data centres in the European Union (region eur3).
• Cloudflare — website hosting (Cloudflare Pages) and protection against attacks.
• Resend — Delivery of confirmation and notification emails. The content of the message, which includes the name, email and telephone number, goes through this service to reach you.
• Microsoft (Azure Translator) — automatic translation of pages and emails. When the reservation is made in another language, the text of the email goes through this service, and it also contains your name, email and telephone number.
• OpenAI, Google and other companies that operate assistants "When the order reaches us through this route, the data goes through this company before reaching us. This processing is governed by that service's privacy policy, not ours.

We do not share data with third parties for commercial or marketing purposes.

6. How long do we keep it for?

• Contact messages: for up to 24 months after the last contact, unless you ask us to delete them before then;
• Bookings: up to 36 months, for record-keeping and managing repeat customers;
• Orders and data relating to invoices: 10 years, for tax purposes;
• Analytics statistics: period defined by Google (typically 14 months).

7. Your rights

Under the General Data Protection Regulation (GDPR, EU 2016/679), you have the right to:

• Access the data we hold about you;
• Correct incorrect or out-of-date data;
• To request the erasure of your data (“right to be forgotten”), except where we are required by law to retain it;
• To request restriction of processing or to object to processing;
• Request the portability of your data in a structured format;
• Submit a complaint to National Data Protection Commission (CNPD).

To exercise any of these rights, simply send an email to Email. We will reply within 30 days.

8. Cookies and similar technologies

This website uses cookies that are strictly necessary for its operation (session cookies, preference cookies) and Firebase/Google analytics cookies. We do not use third-party advertising cookies.

Analytical cookies are only activated after you accept them in the notice that appears on the first visit. Without this acceptance, analytical cookies are not used. You can change your mind at any time by going to "Manage cookies" in the footer.

We also use the Cloudflare Web Analytics to count visits and measure page speed. This tool Does not use cookies, doesn't save anything on your device and doesn't track you across sites: it only collects aggregated data — page visited, source of visit, country, browser type, and load times. Because it does not store or access information on your device, it does not rely on prior consent. If you prefer not to be counted, you can block it in your browser settings or with an extension like uBlock Origin, without affecting your browsing on the site.

9. International transfers

The data is stored in Google’s data centres in the European Union (eur3, Belgium/the Netherlands). In specific cases (technical support, maintenance), Google may access the data from other countries; these transfers are covered by the European Commission’s Standard Contractual Clauses (SCCs).

10. Safety

We implement reasonable technical and organisational measures to protect your data: encrypted communication (HTTPS), database access rules that restrict who can read or write to each collection, mandatory authentication for the back office, and anti-spam protection on forms.

11. Changes to this policy

We may update this policy to reflect changes to our services or to legislation. The date of the last update is shown at the end. In the event of material changes, we will give advance notice on our website.

12. Contacts

If you have any questions regarding privacy or the processing of your data:

• Email: Email
• Telephone: Phone
• Address: 260 Rua Portelinha, 4800-429 Guimarães