Privacy Policy

This Privacy Policy explains how Amaia Trancoso Hotel processes personal data in connection with accommodation, reservations, customer service, events, communications, marketing and the operation of its digital channels. Its purpose is to provide clear information about the data used, the purposes of processing, necessary disclosures and the rights of data subjects.

This Policy applies to data processed through the official website, booking engine, customer service channels, social media, instant forms, advertising campaigns, event enquiries and during the provision of accommodation services. Third-party services accessed through their own links may also have specific policies and practices.

• Personal data: information relating to an identified or identifiable natural person.
• Sensitive personal data: information subject to special protection, such as health or biometric data.
• Processing: any operation performed on personal data, from collection to deletion.
• Data subject: the person to whom the personal data relates.
• Controller: the party that makes decisions about data processing.
• Processor: a service provider that processes data on behalf of the controller.

• identification and contact details, such as name, telephone number, WhatsApp, email, city and address;
• reservation and accommodation data, such as dates, number and composition of guests, preferences and requests;
• data required for check-in, billing and compliance with legal obligations;
• commercial information about events, celebrations, planned date, guests and investment range;
• the content of messages, requests, reviews and customer service history;
• transaction and payment data processed through the payment methods used;
• technical data, such as IP address, device identifiers, browser, pages visited, clicks and campaign parameters;
• data relating to children and adolescents provided by parents or guardians;
• health, accessibility, allergy or dietary information when provided to enable appropriate service.

Data may be provided directly by the data subject or their guardian through the website, WhatsApp, email, telephone, social media, advertising forms, booking engine, in-person service and documents relating to a reservation or event. Technical information may also be collected automatically through cookies, tags, pixels and measurement tools. Agencies, advisers and other representatives may provide data when authorised to act on behalf of the interested person.

• respond to enquiries, answer questions and prepare proposals;
• check availability, make reservations and perform accommodation or event contracts;
• organise check-in, stays, service, security and requested preferences;
• process charges, payments, tax documents and financial controls;
• comply with legal and regulatory obligations and requests from competent authorities;
• prevent fraud, incidents and misuse of channels;
• measure website performance, improve services and understand the customer journey;
• carry out advertising, measurement and commercial communications in accordance with the law;
• protect the rights of Amaia, guests, visitors, suppliers and third parties.

Depending on the purpose and context, processing may be based on preliminary procedures requested by the interested person, performance of a contract, compliance with a legal or regulatory obligation, legitimate interests assessed proportionately, the regular exercise of rights, protection of the life or physical safety of the data subject or a third party where applicable, and consent when this is the appropriate legal basis. Amaia does not consider all processing to depend on consent.

Enquiries and reservations may be directed to the Omnibees booking engine or handled through Amaia's direct channels. Dates, guest composition, contact details, preferences and data necessary for contracting may be used to check availability, confirm the reservation, provide services and comply with legal obligations. Payment data may be processed by the financial institutions, acquirers or processors actually used in the booking journey.

To assess event projects, Amaia may process contact details, the person's relationship to the event, type of celebration, intended date or period, estimated number of guests, accommodation requirements, investment range and information provided in the brief. This data will be used to assess compatibility, availability, format, commercial conditions and continuation of service, without guaranteeing approval or availability before validation.

Instant forms made available on Facebook or Instagram may collect name, WhatsApp, email, city and qualification responses relating to the event. Meta performs the initial processing on its platform, and Amaia uses the data received to assess the request and begin providing assistance. Individuals should also consult Meta's privacy notices and controls.

Amaia may send responses, service information and commercial communications through channels appropriate to the relationship. Where consent is required, communication will depend on that authorisation. In other cases, legitimate interests may be relied upon after assessing the context and the person's expectations. Requests to stop receiving communications will be respected without affecting messages necessary to fulfil reservations, contracts or obligations.

Data may be shared, to the extent necessary for the purpose, with providers actually used for website infrastructure, the booking engine, messaging, social media, analytics, advertising and payment processing. Depending on the journey used, this includes Cloudflare, Omnibees, Meta, Google and OpenAI. Data may also be disclosed to public authorities or third parties when required by law, necessary for the regular exercise of rights or to protect individuals.

Global booking, communications, infrastructure, analytics and advertising platforms may process data outside Brazil or allow access from other countries. Where an international transfer takes place, processing observes the mechanisms and safeguards provided for by Brazil's General Data Protection Law (LGPD) and the regulations of the Brazilian National Data Protection Authority.

Information relating to children and adolescents is normally provided by parents or guardians and processed with the child's best interests in mind. Collection is limited to data necessary for reservations, accommodation, security or service. Amaia does not knowingly direct commercial communications to children. Requests relating to minors must be made by the responsible adult, whose identity may be verified.

Personal data is retained for the period necessary to fulfil the purposes described in this Policy, perform contracts, comply with legal and regulatory obligations and exercise rights. Where applicable, data may be deleted, anonymised or retained on a restricted basis after the original purpose has ended, subject to the circumstances permitted by law.

Amaia adopts administrative and technical measures to protect personal data, considering the nature of the information, the processing contexts and the risks involved. No system is completely immune to incidents and, if a relevant event is identified, the measures provided for by applicable law will be taken.

Under applicable law, data subjects may request confirmation of processing, access, correction, anonymisation, blocking or deletion where applicable, portability subject to applicable rules, information about disclosures, withdrawal of consent, objection where applicable and review of automated decisions that affect their interests. They may also lodge a complaint with the competent authority. Some requests may be limited by legal obligations, trade secrets, third-party rights or the need for legitimate retention.

The website may direct users to Omnibees, WhatsApp, Instagram, Facebook, maps, menus and other external services. When accessing these environments, individuals also interact with the respective providers, which have their own terms and policies. Amaia recommends reading those documents and does not fully control the independent practices of third parties.

This Policy may be updated to reflect legal, technological or operational changes or changes to the services used. The current version remains available on the website with its update date. Material changes may be communicated through appropriate means according to the context.

Last updated: 1 October 2026.