Privacy Policy
1. Who We Are
Madeirabook is operated by Andrei Kurochkin, Empresário Individual em Portugal.
- Registered address: Estrada Avelino Pinto, 9125-024, Caniço, Madeira, Portugal
- NIF: available on request
- Contact: hello@madeirabook.com
Madeirabook is the Data Controller for personal data collected through the Platform (www.madeirabook.com).
We process personal data in accordance with the EU General Data Protection Regulation (GDPR) (Regulation EU 2016/679) and Portuguese data protection law.
2. What This Policy Covers
This Privacy Policy explains:
- What personal data we collect
- How and why we collect it
- The legal basis for processing
- Who we share it with
- How long we keep it
- Your rights under GDPR
- How to contact us
By using the Platform, you acknowledge this Policy.
3. What Personal Data We Collect
From Guests (when you make a booking):
- Full name
- Email address
- Phone number
- Country of residence
- Billing address (street, postal code, city)
- Number of guests (adults/children)
- Arrival and departure dates
- Estimated arrival time
- Special requests (optional)
From Owners (when you list a property):
- Full name / company name
- Email address
- Phone number
- Business address
- NIF / tax number
- Bank account details (via Stripe — see Section 5)
- Property information (address, description, photos)
Automatically collected:
- IP address
- Browser type and version
- Device type and operating system
- Pages visited and time spent
- Referring URL
We do NOT collect or store:
- Payment card numbers (handled entirely by Stripe)
- CVC / CVV codes
- Passwords (never seen in plain text)
4. How We Collect Data
We collect personal data:
- Directly from you — when you fill out a booking form, register as an Owner, or contact us by email or WhatsApp.
- Automatically — through cookies and similar technologies when you browse the Platform.
- From third parties — Stripe (payment status), Smoobu and Zeevou (property management systems used by Owners to confirm bookings).
5. How We Use Your Data
We use personal data for:
| Purpose | Legal basis (GDPR) |
|---|---|
| Processing your booking and payment | Performance of contract (Art. 6(1)(b)) |
| Sending booking confirmations and updates | Performance of contract |
| Communicating about your stay | Performance of contract |
| Responding to enquiries and complaints | Legitimate interest (Art. 6(1)(f)) |
| Fraud prevention and security | Legitimate interest |
| Compliance with tax and legal obligations | Legal obligation (Art. 6(1)(c)) |
| Sending marketing emails (only with consent) | Consent (Art. 6(1)(a)) |
| Analysing Platform usage to improve it | Legitimate interest |
You can withdraw consent for marketing at any time (see Section 10).
6. Who We Share Data With
We share personal data only with:
- Stripe Payments Europe, Ltd. — for payment processing. Stripe receives card data directly; we never see it.
- Smoobu GmbH — property management system. Booking details (name, dates, contact) are passed to the Owner's PMS.
- Zeevou — alternative PMS for some Owners.
- Resend — email delivery service (booking confirmations, marketing if consented).
- Vercel Inc. — hosting and blob storage.
- Neon Inc. — database hosting.
- Portuguese Tax Authority (AT) — if legally required (invoicing, audits).
- Law enforcement — only if legally compelled.
We never sell personal data to third parties.
International transfers: Some service providers (Stripe, Vercel, Resend, Neon) may process data outside the EU. They operate under EU Standard Contractual Clauses or EU-US Data Privacy Framework where applicable.
7. How Long We Keep Data
| Data | Retention |
|---|---|
| Booking data | 10 years (Portuguese tax law) |
| Owner data | 10 years after last transaction |
| Marketing subscribers | Until you unsubscribe |
| Server logs (IP, browser) | 90 days |
| Support emails | 3 years |
After retention periods, data is deleted or anonymised.
8. Data Security
We take the security of your data seriously:
- All data transmitted over HTTPS/TLS.
- Payments handled by Stripe (PCI-DSS Level 1 certified).
- Database encrypted at rest (Neon).
- Access to personal data restricted to authorised personnel only.
- Regular security reviews.
No system is 100% secure. If a data breach occurs that affects you, we will notify you and the CNPD within 72 hours as required by GDPR.
9. Your Rights Under GDPR
You have the right to:
- Access — request a copy of your personal data.
- Rectification — correct inaccurate data.
- Erasure ("right to be forgotten") — request deletion, subject to legal retention requirements.
- Restriction — limit how we process your data.
- Portability — receive your data in a machine-readable format.
- Object — object to processing based on legitimate interest.
- Withdraw consent — for marketing at any time.
- Lodge a complaint — with the CNPD (see Section 12).
To exercise any right, email hello@madeirabook.com. We respond within 30 days.
10. Marketing
If you subscribe to our newsletter (PDF guide, flight alerts, etc.):
- We only send emails with your explicit consent (checkbox on form).
- Every email contains an unsubscribe link.
- We use Resend to send emails — your email address is stored there.
- You can unsubscribe at any time.
11. Cookies
We use cookies for:
- Essential — session management, login (owner cabinet).
- Analytics — Google Search Console, basic traffic analysis.
For full details, see our Cookie Policy.
12. Complaints
If you have a complaint about how we handle your data:
- Contact us first: hello@madeirabook.com
- If unsatisfied, you may contact the CNPD — Comissão Nacional de Proteção de Dados (Portuguese Data Protection Authority):
- Website: https://www.cnpd.pt
- Email: geral@cnpd.pt
13. Changes to This Policy
We may update this Privacy Policy. Material changes will be notified by email. The current version is always available on the Platform.
14. Contact
Madeirabook Andrei Kurochkin, Empresário Individual Estrada Avelino Pinto, 9125-024, Caniço, Madeira, Portugal Email: hello@madeirabook.com NIF: available on request
Last updated: 10/17/2026