Website Privacy Policy

Last updated · 23 May 2026

VIVA Quinta is a brand of Musas Encantadoras Lda, a Portuguese limited company. In this Privacy Policy, "we", "us", and "our" refer to Musas Encantadoras Lda, trading as VIVA Quinta. This policy explains what personal data we collect when you visit vivaquinta.com or interact with us, how we use it, who we share it with, and the rights you have over your data.

This policy applies to all visitors to our website and prospective and current guests of VIVA Quinta, regardless of where you are located. Where applicable, it complies with the EU General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA).

1. Who we are

If you have any questions about this policy or how your personal data is handled, contact us at reservations@vivaquinta.com.

2. What data we collect

We collect the following categories of personal data:

a) When you sign up for our Private Guest List

• First name
• Last name
• Email address

b) When you contact us through the Plan Your Visit form or by email

• Name
• Email address
• Phone number (if provided)
• The content of your message and any details you choose to share

c) When you make a booking inquiry or reservation

• All of the above
• Travel dates, party size, and stay preferences
• Special requirements (dietary, accessibility, occasion)
• Payment information (handled directly by our payment processor — see Section 5)

d) Automatically collected when you visit our website

• IP address
• Browser type and version, device type, operating system
• Pages visited, time spent on site, referring URL
• Cookies and similar technologies (see Section 7)

We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us.

3. How we use your data and the legal basis for doing so

Under GDPR we must have a lawful basis for processing your personal data. We rely on the following:

You can withdraw your consent at any time by emailing stay@vivaquinta.com or using the unsubscribe link in any marketing email.

4. How long we keep your data

We retain personal data only as long as needed for the purpose it was collected:

• Email subscribers: until you unsubscribe, then up to 30 days for record-keeping
• Contact form / inquiry data without a resulting booking: up to 12 months
• Booking and guest data: up to 10 years, as required by Portuguese tax and accounting law (Código Comercial Art. 40)
• Website analytics: anonymized or aggregated after 14 months
• Marketing preferences and consent records: until withdrawn, plus 3 years for proof of compliance

5. Who we share your data with

We do not sell your personal data. We share data only with the service providers we need to run our business, all of whom are required by contract to protect it:

• Webflow, Inc. (USA) — hosting our website and storing form submissions. Webflow is certified under the EU–U.S. Data Privacy Framework.
• Our email service provider — we are currently evaluating options; once selected, we will update this policy and notify subscribers. Submissions are currently stored within Webflow's secure environment.
• Our future booking platform — for reservation management. We will update this policy once selected.
• Our payment processor (e.g., Stripe) — payment data is collected directly by them; we do not store credit card numbers ourselves.
• Portuguese authorities (SEF, AT — Autoridade Tributária) — guest registration and tax reporting where required by law.
• Professional advisers — accountants, lawyers, IT consultants when necessary, bound by confidentiality.

We do not transfer personal data outside the European Economic Area (EEA) or UK unless one of the following safeguards is in place: an adequacy decision, Standard Contractual Clauses (SCCs), or another legal mechanism under GDPR Chapter V.

6. Your rights

You have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate or incomplete data
• Erasure ("right to be forgotten") — ask us to delete your data, subject to legal retention requirements
• Restriction — ask us to limit how we use your data
• Objection — object to processing based on legitimate interests, including direct marketing
• Portability — receive your data in a structured, commonly used format
• Withdrawal of consent — withdraw consent at any time where processing is based on consent

To exercise any of these rights, email stay@vivaquinta.com. We will respond within 30 days. There is no fee unless your request is excessive or unfounded.

For EU residents: if you believe we have not handled your data lawfully, you have the right to lodge a complaint with the Portuguese supervisory authority:

You may also complain to the data protection authority of your EU country of residence.

For UK residents: you may complain to the Information Commissioner's Office (ICO) at ico.org.uk.

For California residents: see Section 9 below for your CCPA/CPRA rights.

7. Cookies

A cookie is a small text file stored on your device when you visit a website. We use cookies for the following purposes:

• Strictly necessary cookies — required for the website to function (e.g., session cookies, form anti-spam). These do not require consent.
• Functional cookies — remember your preferences (e.g., language).
• Analytics cookies — help us understand how visitors use the site. We do not currently use Google Analytics or similar third-party tracking, but if we do in the future, we will update this policy and request your consent through a cookie banner.
• Marketing cookies — not currently used. If we add Meta Pixel or similar advertising trackers, we will obtain your consent first.

You can control cookies through your browser settings. Blocking all cookies may affect how the website functions.

8. Security

We use appropriate technical and organizational measures to protect your personal data, including:

• HTTPS encryption on all pages
• Access controls limiting who can view personal data
• Vetted service providers contractually bound to protect your data
• Regular review of our security practices

No system is completely secure. If we become aware of a data breach affecting your personal data, we will notify you and the relevant authority within 72 hours, as required by GDPR.

9. California residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

• Right to know what personal information we collect, use, disclose, and sell or share
• Right to delete personal information we have collected
• Right to correct inaccurate personal information
• Right to opt out of the sale or sharing of personal information — we do not sell or share personal information, so there is nothing to opt out of
• Right to limit use of sensitive personal information — we do not collect sensitive personal information as defined under CCPA
• Right to non-discrimination — we will not discriminate against you for exercising your rights

To exercise any of these rights, email stay@vivaquinta.com. We will verify your request and respond within 45 days.

10. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of this page indicates when it was last revised. Material changes will be communicated by email to our subscribers and prominently posted on this page.

11. Contact

For any questions, requests, or concerns about this Privacy Policy or how we handle your personal data, contact us at: