Privacy

Who we are

Clareza Selvagem, Lda · NIPC 519 536 460 · Rua das Murças 78, Sala 3, 9000-058 Funchal, Madeira, Portugal.

For anything about your data: clarezaselvagem@clarezaselvagem.com, or +351 961 122 701 — the same number on WhatsApp. The people who run the company answer.

When we are the controller, and when we are not

For the data of people who contact us — owners, the curious, anyone who writes — we are the controller, and that is what this page is about.

For the data of guests staying in the houses we operate, we are the controller: we sell the stay in our own name, and Clareza determines the purposes and the means. The owner receives no guest data, except what is strictly necessary to claim for damage. There is one exception: the communications the law reserves to the registration holder — guest bulletins, statistics and tourist tax — are their obligation, and there we act on their behalf. These rules live in the cession contract and its Annex E, not here.

What we collect

• What you write or tell us: your name, the contact you use, and whatever you choose to tell us about your property.
• If you use a form on this site: name and contact; optionally the property address and the listing link. We also keep the language and the page you filled it on, so we know what to answer.
• WhatsApp conversations and calls to our number.
• Technical logs from whoever hosts this site — IP address, time, page requested — generated to serve and secure it, and the aggregate audience measurement described below. We do not use them to follow you.

Cookies and audience measurement

There are no cookies on this site. No advertising pixel, no social button, no profile that follows you from one site to another.

The site keeps two technical keys in your browser, and only two: cs-film-warm, which avoids loading the film twice and disappears when you close the tab; and cs-analytics, which exists only if you press the button below not to be counted — keeping it is how that choice is respected.

We measure our audience in aggregate with the tools of the company that hosts this site (Vercel Web Analytics and Speed Insights). For each page view they record: the page and language, the page you came from, country and region, device type, operating system and browser, and how fast the page loaded. They do not keep your IP address or any identifier of yours: a visit is tied to a code derived from the request, which expires after 24 hours and cannot recognise you on another site or another day. We only ever see totals.

What for: to know which pages and languages are read, where visitors come from, and whether the film loads well on phones. Basis: legitimate interest (GDPR art. 6(1)(f)) — measuring the audience of our own site, with no profiling, no advertising and no cross-site matching. You can object right here with the button below, and we also honour your browser’s Global Privacy Control and Do Not Track signals.

These totals are processed by the company hosting the site, in the United States, under standard contractual clauses (see “Outside the European Economic Area”); the reporting window we use is 12 months.

The measurement has no name and no number attached, which is why the switch is here and not in a conversation: if you wrote asking not to be counted, we would have no way to find you in the totals. For what does have a name — what we hold about you, deletion, no more contact — talk to the team (see “Your rights”).

What for, and on what basis

If we contacted you first

When we contact you without your having written to us, your data did not come from you: it came from the National Register of Local Accommodation (RNAL), the public register kept by Turismo de Portugal, consulted on the date shown in that first contact. From it we take the registration number, the holder’s name, the establishment’s address and the professional contact. Where the phone number is not in the register, it comes from the property’s own public presence — its website, its listing, its social pages — never from purchased lists.

We do this on the basis of legitimate interest (GDPR art. 6(1)(f)): presenting a short-let operation service to those who carry out the activity it is meant for. The balancing test is written down and we send it to anyone who asks. We say this in the first contact itself, as GDPR art. 14(3) requires.

• Objection to commercial contact is absolute and immediate (GDPR art. 21(2)): say so, on any channel, and we stop on all of them.

Clara is an artificial intelligence

Clara is our assistant and she is an artificial intelligence. She says so at the end of the first reply of every conversation — she introduces herself as a virtual assistant — and whenever you ask whether she is a person. When the team takes over the conversation, she says that too. Article 50 of Regulation (EU) 2024/1689 requires it, and we would do it anyway.

What you write to Clara is processed by a language model to produce the answer. That processing happens in data centres in Europe — in the European Union and also in Switzerland — with the supplier engaged on terms that neither use the content to train models nor keep it after answering. Your guests’ conversations do not leave Europe.

Anything sensitive goes to a person on our team.

Who else touches your data

The chain has two steps and it is short. Clareza contracts Eclipse Alquímico, Lda (NIPC 519 538 021), which runs the platform, under a contract with its own data-protection annex. The hosting, artificial-intelligence and site providers answer to Eclipse, and Eclipse answers to us. By category, your data may pass through:

• These are not our processors and act on their own account: the booking platforms (Airbnb, Booking and the like) and the public authorities the law requires us to report to.
• The subprocessors that process guest data on the owner’s behalf are named in Appendix 2 of Annex E, the data-protection annex of the cession-of-operation contract; the owner has the right to know them (GDPR art. 28(2) and (4)), is told of any change 15 days in advance and may object on reasoned grounds — and if you want the list before signing, ask and we will send it. Here we give categories because that is what the law owes someone who is only reading the page, and because a list of names on a web page ages: the one in the annex is the one that stays true.

Outside the European Economic Area

The rule is to process inside the European Economic Area, and that is what happens with the platform, the channels and e-mail. These are the points that leave it, and we state them because declaring less than the truth is worse than declaring more:

• The model that writes Clara’s replies may process in data centres in Switzerland as well as in the European Union. Switzerland is in Europe but outside the EEA; the European Commission has recognised it as providing an adequate level of protection (GDPR art. 45), so the transfer is lawful and needs no standard clauses. It is still a transfer, which is why it is written here rather than hidden behind an “everything stays in the EEA”.
• This site’s hosting and audience measurement belong to a United States company, even though the hosting region is in the EU — covered by standard contractual clauses approved by the European Commission.
• The messaging and payment providers may involve transfers within their own groups, also under standard clauses.

How long we keep it

Periods run from the last contact. You can ask for deletion before that, at any time.

Your rights

• To see what we hold about you, correct it, delete it, restrict what we do with it, object, and ask us to hand it over in a format you can take elsewhere.
• How: write to clarezaselvagem@clarezaselvagem.com or say it on WhatsApp. No form and no reason needed.
• The objection is yours, not the channel’s: if you say you do not want to be contacted, we stop contacting you everywhere — phone, e-mail and WhatsApp — not only where you said it.
• A “stop” is enough. We do not argue and we do not ask why: we confirm and close.
• We check that list at the moment of sending, not when we prepare it, so a request made at night stops the morning’s message.
• If you think we handled your data badly, you can complain to the Portuguese data protection authority, CNPD (cnpd.pt). We would rather you told us first, but the right is yours and does not depend on that.