Menu

Privacy Notice – 8Roots Vacations 

Last updated: 

22.06.2026 

8ROOTS VACATIONS UNIPESSOAL, LDA  (“8Roots”, “we”, “us”, “our”) operates holiday accommodation in Portugal and this website for guests and interested visitors (the “Site”). We take the protection of your personal data seriously. This Privacy Notice explains what personal data we collect when you visit our Site, make a booking or contact us, and how we use that data. 

Where we refer to “EU/EEA data protection law”, we mean in particular the EU General Data Protection Regulation (GDPR).

Controller and contact details

The controller responsible for the processing of your personal data in connection with this Site is: 

8ROOTS VACATIONS, UNIPESSOAL LDA 
Rua dos Arneiros, nº 25, Geraldes, 2525-523 Atouguia da Baleia
Portugal 

Email: vacations@8roots.de

If you have any questions about this Privacy Notice or about how we process your personal data, you can contact us at any time using the above details. 

If you use our Invest pages or services, the controller is 8Roots GmbH, Germany. For those pages, a separate privacy notice applies. 

2. Categories of data and purposes of processing

2.1 Website usage data (server logs, security, basic analytics) 

When you access our Site, the servers of our hosting provider (currently Hostinger) automatically process certain information, such as: 

  • IP address and device identifiers 
  • date and time of access 
  • URL and file requested 
  • referrer URL (previous page) 
  • browser type and version, operating system, language settings 
  • error codes and similar technical information 

We use this data to: 

  • provide the Site and ensure its technical operation 
  • maintain IT security and prevent misuse (e.g. attacks, fraud) 
  • compile anonymous statistics on use of the Site 

Legal basis: Art. 6(1)(f) GDPR (legitimate interests: operation, security and optimisation of the Site). 

 

2.2 Cookies and similar technologies 

Our Site uses cookies and similar technologies. Cookies are small text files stored on your device by your browser. 

  • Strictly necessary cookies: required for the basic functioning of the Site (e.g. language selection, cookie consent tool). These are used without consent on the basis of our legitimate interests (Art. 6(1)(f) GDPR). 
  • Analytics / marketing cookies (e.g. Google Analytics, Meta Pixel – only if you actually use them): used to analyse the use of our Site and to display interest-based advertising. 

Where required by law, we only use analytics / marketing cookies if you have consented via our cookie banner. 

You can change or withdraw your consent at any time via the cookie settings on the Site and you can also disable cookies in your browser. If you do so, parts of the Site may not function correctly. 

Legal basis: Art. 6(1)(a) GDPR (consent) for analytics/marketing cookies; Art. 6(1)(f) GDPR for necessary cookies. 

 

2.3 Booking and reservation data 

When you send us a booking enquiry or make a reservation (for example via contact form, email, phone or a booking engine integrated on the Site), we process: 

  • identification and contact details (e.g. name, email address, phone number, address) 
  • stay details (travel dates, number of guests, property, price, payment status) 
  • optional information you provide about preferences, remarks or special requests 
  • communication history relating to your booking 

We use this data to: 

  • process and confirm your enquiry or reservation 
  • provide our accommodation services 
  • manage payments and invoices 
  • communicate with you before, during and after your stay 
  • comply with legal obligations (e.g. tax, accounting, local accommodation registration) 

Legal basis: Art. 6(1)(b) GDPR (performance of a contract or steps prior to entering into a contract); Art. 6(1)(c) GDPR (legal obligations under tax and accommodation laws); Art. 6(1)(f) GDPR (legitimate interests in managing our business and preventing fraud). 

If you provide information about co-travellers, you are responsible for ensuring that they are informed about this Privacy Notice. 

 

2.4 Contact via email, phone or forms 

If you contact us (for example with general questions, collaboration proposals or feedback), we process: 

  • your contact details 
  • the content of your message 
  • date and time and internal notes on the processing of your request 

We use this data to handle and respond to your request. 

Legal basis: Art. 6(1)(b) GDPR where related to a booking or contract; otherwise Art. 6(1)(f) GDPR (legitimate interest in communicating with guests and visitors). 

 

2.5 Newsletter / marketing communication (optional) 

If you register for a newsletter or agree to receive offers and information about 8Roots, we process: 

  • your email address and, if provided, your name and language 
  • your consent and preferences 
  • information about whether you open or click our emails (for optimisation, optional) 

We use this data to send you emails with news about our properties, offers and services. 

Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw consent at any time, for example via the unsubscribe link in each email or by contacting us directly. 

We do not sell your personal data to third parties. 

 

3. Recipients and data transfers

We may share your personal data with the following categories of recipients, where necessary and lawful: 

  • Service providers (processors), e.g. hosting providers (Hostinger), email providers, booking systems, payment service providers, IT and marketing support. These act on our instructions and are contractually bound to data protection obligations. 
  • Affiliated entities within the 8Roots group (e.g. 8Roots GmbH) where this is necessary for internal administrative purposes or for combined services (for example, if an Invest client also books a stay). In such cases, we implement appropriate safeguards. 
  • Public authorities, tax authorities, law enforcement where required by law or where we need to protect our rights or those of third parties. 
  • Professional advisers such as lawyers, tax advisers or auditors, where necessary. 

Some recipients may be located in countries outside the EU/EEA where the level of data protection may not be equivalent. In such cases, we will ensure an adequate level of protection, for example by using EU Standard Contractual Clauses or by relying on adequacy decisions by the European Commission. 

 

4. Retention periods

We store your personal data only for as long as necessary for the purposes described in this Privacy Notice or as required by law. 

  • Booking and accounting data are retained for the statutory retention periods (typically 6–10 years under tax and commercial law). 
  • Basic customer / guest data may be stored for a longer period where we have an ongoing relationship (e.g. repeat guests, investors) and where permitted by law. 
  • Server logs are usually deleted or anonymised after a short period, provided no security-relevant incident has occurred. 
  • If you withdraw consent for marketing, we will stop using your data for that purpose, but may retain limited information to document your preference. 

 

5. Your rights under the GDPR

Subject to the requirements and exceptions under applicable law, you have the following rights: 

  • Right of access (Art. 15 GDPR): to obtain confirmation as to whether we process personal data about you and receive a copy. 
  • Right to rectification (Art. 16 GDPR): to have inaccurate data corrected and incomplete data completed. 
  • Right to erasure (Art. 17 GDPR): to have your data deleted, for example if it is no longer needed or processed unlawfully. 
  • Right to restriction of processing (Art. 18 GDPR). 
  • Right to data portability (Art. 20 GDPR) for data you provided to us on the basis of consent or contract. 
  • Right to object (Art. 21 GDPR): you can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests, and we will stop processing unless we have compelling legitimate grounds. You can also object at any time to processing for direct marketing. 
  • Right to withdraw consent (Art. 7(3) GDPR): where processing is based on your consent, you can withdraw it at any time with effect for the future. 

To exercise your rights, please contact us using the contact details above. We may request additional information to verify your identity. 

If you believe that our processing of your personal data violates applicable law, you also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU/EEA country of your habitual residence, your place of work or the place of the alleged infringement. In Portugal, the competent authority is the Comissão Nacional de Proteção de Dados (CNPD). 

 

6. Security

We take appropriate technical and organisational measures to protect your personal data against unlawful or unauthorised access, loss, destruction or damage. These include, for example, access controls, encryption where appropriate and regular review of our security measures. 

However, transmission of information over the internet can never be completely secure. If you send us confidential information, we recommend using secure transmission methods (for example, encrypted communication) where possible. 

 

7. Links to third-party websites

Our Site may contain links to third-party websites (for example booking platforms, social networks, partners). We are not responsible for the privacy practices or content of those third-party sites. Please refer to the privacy notices of the respective providers. 

 

8. Changes to this Privacy Notice

We may update this Privacy Notice from time to time, for example if we add new services or if legal requirements change. The current version is always available on our Site. We indicate the date of the last update at the beginning of the Notice.