Legal

Privacy Policy

‍Last updated: 28 September 2026

This Privacy Policy explains how personal data is collected, used, disclosed, stored and otherwise processed in connection with the Samara Stays website, reservation environment and related services.

Samara Stays is a hospitality brand operated and centrally managed by:

SERENITY HIDEAWAY – EMPREENDIMENTOS IMOBILIÁRIOS, UNIPESSOAL, LIMITADA
NIPC: 519356276‍
Email: legal@samarastays.com
Bookings: bookings@samarastays.com
Telephone: +351 239 065 365

For the purposes of this Privacy Policy, “Samara Stays”, “we”, “us” and “our” refer to Serenity in its capacity as operator and central manager of the Samara Stays digital and reservation environment, except where this Policy expressly states otherwise.

This Privacy Policy applies to personal data collected through:

www.samarastays.com;
bookings.samarastays.com;
Samara Stays reservation and customer-support channels;
communications concerning Samara Stays reservations; and
other digital services expressly referring to this Privacy Policy.

1. Data Protection Framework

We process personal data in accordance with applicable data-protection legislation, including, where applicable:

Regulation (EU) 2016/679 (“GDPR”);
applicable Portuguese data-protection legislation; and
applicable data-protection legislation in other jurisdictions where processing takes place or where the relevant Accommodation is located.

Personal data shall be processed in accordance with the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality and accountability.

2. Data Controller

Unless otherwise stated in this Privacy Policy, SERENITY HIDEAWAY – EMPREENDIMENTOS IMOBILIÁRIOS, UNIPESSOAL, LIMITADA is the controller responsible for personal data processed through the Samara Stays website, reservation environment and centralized customer-management functions.

Serenity's contact details are:

SERENITY HIDEAWAY – EMPREENDIMENTOS IMOBILIÁRIOS, UNIPESSOAL, LIMITADA
NIPC: 519356276
Rua Bernardino Machado, 50, 2D
3030-299 Coimbra
Portugal

General legal/privacy contact:
legal@samarastays.com

Booking/customer contact:
bookings@samarastays.com

Telephone: +351 239 065 365

3. Data Protection Officer

At the date of this Privacy Policy, Serenity has not designated a Data Protection Officer where designation is not legally required.

Where a Data Protection Officer is appointed, the relevant contact details shall be made available through this Privacy Policy or the Samara Stays website.

4. Categories of Personal Data

Depending on how you interact with Samara Stays, we may process different categories of personal data.

These may include:

4.1 Identification data

name;
surname;
title;
nationality;
date of birth where required;
identification information where required by the applicable property or law.

4.2 Contact information

email address;
telephone number;
postal address;
country of residence;
other contact information supplied by you.

4.3 Reservation information

property selected;
room or accommodation selected;
arrival and departure dates;
number of guests;
booking reference;
reservation status;
rate selected;
cancellation conditions;
special requests;
booking history;
communications concerning the reservation.

4.4 Payment information

Depending on the payment method used, we may process information relating to:

payment status;
transaction amount;
currency;
transaction reference;
payment method;
payment authorization status;
payment-related records.

Where payment is processed by a third-party payment service provider, complete card information may be processed directly by that provider rather than being stored by Serenity.

We do not intentionally store sensitive authentication data such as card security codes after authorization where prohibited by applicable payment-security requirements.

4.5 Communications

We may process information contained in communications between you and Samara Stays, including:

emails;
online chat messages;
telephone communications;
messaging applications;
customer-service enquiries;
complaints;
booking-related correspondence.

4.6 Technical information

When you use our website, certain technical information may be collected automatically, including:

IP address;
browser type;
operating system;
device information;
language settings;
time and date of access;
pages visited;
referring website;
technical identifiers;
information concerning interaction with the website.

The extent of such collection may depend on your browser, device and cookie preferences.

4.7 Marketing information

Where applicable, we may process:

marketing preferences;
newsletter subscriptions;
consent records;
unsubscribe records;
interactions with marketing communications.

5. Sources of Personal Data

We generally obtain personal data directly from you.

This may occur when you:

visit our website;
make a reservation;
submit a booking enquiry;
communicate with customer support;
request a modification or cancellation;
submit a complaint;
subscribe to communications;
submit a special request; or
otherwise communicate with Samara Stays.

We may also receive relevant information from:

a person making a reservation on your behalf;
the applicable Property Operator;
payment service providers;
service providers supporting our reservation environment; or
other persons or organizations lawfully involved in administering your reservation.

Where personal data is obtained from another source, applicable information requirements under data-protection law shall be observed. The GDPR generally requires information about the source and processing to be provided where personal data is not obtained directly from the individual.

6. Purposes of Processing

Personal data may be processed for the following purposes.

6.1 Reservation administration

We process personal data to:

receive and administer reservations;
confirm bookings;
communicate booking details;
manage availability;
administer changes and cancellations;
communicate pre-arrival information;
provide check-in information;
maintain booking records; and
provide customer support.

6.2 Payment administration

We process relevant information to:

administer payments;
confirm payment;
identify payment status;
process refunds;
reconcile transactions;
investigate payment issues;
prevent payment fraud; and
comply with payment-related requirements.

6.3 Customer service

We process information to:

answer enquiries;
provide customer assistance;
investigate complaints;
communicate with Guests;
coordinate with the applicable Property Operator; and
maintain records of customer-service interactions.

6.4 Property coordination

Where necessary to fulfil a reservation, relevant Guest information may be provided to the applicable Property Operator so that the Accommodation can be provided.

This may include information necessary for:

check-in;
identification or registration;
occupancy management;
special requests;
accessibility arrangements;
customer communications;
property operations; and
compliance with applicable legal requirements.

6.5 Website operation

We process technical information to:

operate the website;
maintain security;
identify technical errors;
improve functionality;
prevent abuse; and
maintain the reliability of the Samara Stays Services.

6.6 Legal and regulatory compliance

Personal data may be processed where necessary to:

comply with legal obligations;
comply with accounting and tax requirements;
comply with accommodation-registration requirements;
respond to lawful requests from authorities;
establish, exercise or defend legal claims;
detect fraud or unlawful activity; and
maintain required business records.

6.7 Marketing

Where permitted by applicable law, we may process personal data to send:

promotional communications;
offers;
newsletters;
information concerning Samara Stays;
information concerning new properties or services; and
other marketing communications.

Marketing communications shall be subject to applicable consent and/or other legal requirements.

You may object to direct marketing at any time. The right to object to direct marketing is specifically recognized under Article 21 GDPR.

7. Legal Bases for Processing

Depending on the particular processing activity, personal data may be processed on one or more of the following legal bases.

7.1 Contract

Processing may be necessary to enter into or perform a contract with you, including processing necessary to administer a reservation.

Consent is not generally the appropriate legal basis where processing is objectively necessary to perform the contract.

7.2 Legal obligation

Processing may be necessary to comply with obligations imposed by applicable law.

7.3 Legitimate interests

Processing may be necessary for legitimate interests pursued by Serenity or another relevant party, provided those interests are not overridden by your rights and freedoms.

Such interests may include:

website security;
fraud prevention;
business administration;
service improvement;
customer-service management;
protection of legal rights;
enforcement of contractual terms; and
network and information security.

7.4 Consent

Where consent is the appropriate legal basis, we shall request consent in accordance with applicable law.

You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

8. Special Categories of Data

We do not generally require Guests to provide special-category personal data.

However, Guests may voluntarily provide information relating to matters such as health, accessibility, dietary requirements or other personal circumstances when requesting particular services or arrangements.

Where such information constitutes special-category personal data under applicable law, it shall only be processed where an appropriate legal basis and applicable exception under data-protection law exists.

Guests should avoid providing unnecessary sensitive personal information.

9. Children

The Samara Stays Services are not directed specifically at children.

Where a Booking includes children, information concerning them may be processed where necessary to administer the reservation and provide the Accommodation.

Parents or legal guardians are responsible for ensuring that information concerning children is provided appropriately and lawfully.

10. Disclosure of Personal Data

Personal data may be disclosed to persons or organizations where necessary for the purposes described in this Privacy Policy.

These may include:

10.1 Property Operators

Relevant reservation and Guest information may be shared with the Property Operator responsible for the applicable Accommodation.

The information shared shall be limited to what is reasonably necessary for the relevant purpose.

10.2 Payment service providers

Payment-related information may be shared with payment service providers used to process transactions.

The applicable provider may process payment information under its own privacy documentation and contractual obligations.

10.3 Technology and service providers

We may use service providers supporting:

website hosting;
booking systems;
databases;
communications;
email delivery;
customer support;
analytics;
security;
payment processing;
cloud infrastructure; and
other business functions.

Such providers may process personal data on our behalf where applicable.

10.4 Professional advisers

Personal data may be disclosed to lawyers, accountants, auditors, insurers or other professional advisers where reasonably necessary.

10.5 Public authorities

Personal data may be disclosed where required or authorized by applicable law or where necessary to comply with a lawful request.

10.6 Business transactions

Personal data may be transferred or disclosed in connection with a merger, acquisition, restructuring, sale of assets, financing, corporate reorganization or similar transaction, subject to applicable law.

11. Property Operators and Allocation of Responsibilities

Samara Stays operates through a hospitality portfolio that may include properties operated by different legal entities.

Where a Property Operator is responsible for the physical provision of Accommodation, Serenity may provide that Property Operator with personal data necessary to fulfil the reservation and its operational obligations.

The Property Operator may independently process personal data in connection with its own legal and operational obligations.

Where the Property Operator acts as an independent controller for particular processing activities, that processing may be governed by the Property Operator's own privacy information.

Where required, additional information concerning such processing shall be provided to the Guest.

12. International Transfers

Samara Stays may use service providers or operate through entities located in countries outside the European Economic Area (“EEA”).

Where personal data is transferred outside the EEA, we shall ensure that an appropriate transfer mechanism recognized under applicable data-protection law is in place where required.

Such mechanisms may include:

an adequacy decision;
Standard Contractual Clauses;
applicable contractual safeguards;
another lawful transfer mechanism; or
an applicable derogation permitted by law.

Information concerning specific international transfers may be provided upon request where required.

13. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it is processed, taking into account:

the nature of the information;
the purpose of processing;
the duration of the customer relationship;
legal and regulatory obligations;
accounting and tax requirements;
dispute resolution;
limitation periods;
fraud prevention;
security requirements; and
the establishment, exercise or defence of legal claims.

Different categories of data may therefore be retained for different periods.

Where personal data is no longer required, it shall be deleted, anonymized or otherwise securely disposed of, subject to applicable legal obligations.

14. Data Security

We implement appropriate technical and organizational measures designed to protect personal data against:

unauthorized access;
unlawful processing;
accidental loss;
destruction;
alteration;
disclosure; and
other forms of unauthorized processing.

Security measures may include access controls, authentication, encryption where appropriate, monitoring, backup procedures, contractual controls and other technical or organizational measures appropriate to the risks involved.

No electronic transmission or storage system can be guaranteed to be completely secure.

15. Cookies and Similar Technologies

The Samara Stays website may use cookies and similar technologies.

These may be used for purposes including:

essential website functionality;
session management;
security;
remembering preferences;
analytics;
performance measurement; and
marketing, where applicable.

Further information is provided in the separate Samara Stays Cookie Policy.

Where consent is required, non-essential cookies shall not be used without the applicable consent.

16. Analytics

We may use analytics technologies to understand how visitors use the Samara Stays website and to improve its performance and functionality.

The specific analytics services used may change over time.

Where analytics technologies process personal data or require consent under applicable law, the relevant controls shall be applied.

17. Marketing

Where lawful, Samara Stays may send marketing communications concerning:

Accommodation;
destinations;
promotions;
special offers;
new properties;
services;
events; and
other Samara Stays activities.

Marketing communications shall be sent in accordance with applicable law.

You may unsubscribe from marketing communications at any time.

Unsubscribing from marketing communications does not affect necessary Booking-related communications.

18. Automated Decision-Making and Profiling

Samara Stays does not intend to make decisions producing legal effects or similarly significant effects concerning Guests solely through automated processing unless such processing is specifically disclosed and permitted under applicable law.

Certain automated systems may nevertheless be used for operational purposes, including:

fraud detection;
payment-security screening;
website security;
spam prevention;
system administration; and
analytics.

Where automated decision-making subject to specific GDPR requirements is used, additional information shall be provided as required by law.

19. Your Data Protection Rights

Subject to applicable legal conditions and limitations, you may have the following rights:

19.1 Right of access

You may request confirmation as to whether your personal data is being processed and request access to that data and relevant information concerning its processing.

19.2 Right to rectification

You may request correction of inaccurate or incomplete personal data.

19.3 Right to erasure

You may request deletion of personal data where the legal conditions for erasure are satisfied.

19.4 Right to restriction

You may request restriction of processing in circumstances provided by law.

19.5 Right to object

You may object to certain processing based on your particular circumstances where the applicable legal conditions are satisfied.

You may object to direct marketing at any time.

19.6 Right to data portability

Where applicable, you may request to receive personal data provided by you in a structured, commonly used and machine-readable format and request its transmission to another controller where the legal conditions are satisfied.

19.7 Right to withdraw consent

Where processing is based on consent, you may withdraw your consent at any time.

Withdrawal does not affect processing carried out lawfully before withdrawal.

These rights are provided for under the GDPR, subject to the applicable conditions and limitations. CNPD confirms that individuals may exercise rights including access, rectification, objection, restriction and erasure through the relevant controller.

20. Exercising Your Rights

Requests concerning your personal data should be submitted to:

legal@samarastays.com

Requests may also be submitted in writing to:

SERENITY HIDEAWAY – EMPREENDIMENTOS IMOBILIÁRIOS, UNIPESSOAL, LIMITADA
Rua Bernardino Machado, 50, 2D
3030-299 Coimbra
Portugal

We may request information reasonably necessary to verify the identity of the person making the request.

Requests relating to data-protection rights are generally handled without charge, although applicable law may permit reasonable charges in exceptional circumstances or permit refusal of manifestly unfounded or excessive requests.

Under the GDPR, requests should generally be answered within one month, subject to applicable extensions where legally permitted. CNPD similarly states that the response period is generally one month and may be extended by a further two months where necessary.

21. Complaints to the Supervisory Authority

If you consider that the processing of your personal data infringes applicable data-protection law, you have the right to lodge a complaint with the competent supervisory authority.

For processing subject to Portuguese data-protection supervision, the relevant authority is:

Comissão Nacional de Proteção de Dados (CNPD)

Av. D. Carlos I, 134, 1.º
1200-651 Lisboa
Portugal

Telephone: +351 213 928 400
Email: geral@cnpd.pt

Website: www.cnpd.pt

CNPD is the Portuguese supervisory authority responsible for monitoring compliance with the GDPR and Portuguese data-protection legislation.

22. Third-Party Websites

The Samara Stays website may contain links to websites operated by third parties.

This Privacy Policy does not govern the privacy practices of those websites.

Guests should review the privacy information applicable to any third-party website before providing personal data.

23. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

changes to our services;
changes to the Samara Stays hospitality portfolio;
changes to technology;
changes to service providers;
changes to applicable law; or
changes to our data-processing practices.

The updated version shall be published on the Samara Stays website together with its effective date.

Where required by law, material changes shall be communicated through an appropriate additional channel.

24. Contact

For questions concerning this Privacy Policy or the processing of personal data: