Privacy Policy
This policy explains, in plain language, how personal data shared through the website and the Quinta da Costa proposal request form is handled.
The controller is Quinta da Costa. The registered entity and address are shown below.
Quinta da Costa, Daniele Oliveira, Unipessoal Limitada, NIF 510059848.
Rua de Azevedo, n.º 1284505-685 Caldas de São JorgeSanta Maria da FeiraPortugal.
Data collected
The form may request first name, optional surname, email, phone, event type, expected date, approximate guest count and message. Email or phone is used as a contact method; at least one must be provided. The reservation simulator (for example, the New Year’s Eve one) asks for the person in charge’s name and the number of guests only to prepare a WhatsApp message, which is sent only by you.
Purposes and legal basis
Data is processed to answer your enquiry, confirm availability, clarify questions, arrange visits and prepare an event proposal. The form presents consent to the Privacy Policy; pre-contractual steps may also apply when you request a proposal.
Use and sharing
Request data is used by the Quinta da Costa team for the purpose of the request. It is not sold or used for newsletters. It is not used for profiling or personalised advertising, except as described in “Marketing and advertising”, which applies only if you accept the Marketing category. Otherwise it may only be shared when needed to provide the service or operate the website, with a limited purpose and appropriate safeguards.
Marketing and advertising (only with your consent)
The privacy banner has a Marketing category, off by default. If you accept it, the site uses advertising tools from Meta (Meta Pixel and Conversions API, operated by Meta Platforms Ireland Limited) and Google (Google Ads conversion and remarketing tags, operated by Google Ireland Limited). If you do not accept it, none of these tools is loaded and nothing is sent.
Marketing: data and purposes
Data processed: browsing and conversion events (for example page views, button clicks such as the WhatsApp reservation request in the simulator, and sending a proposal request); browser online identifiers (such as the _fbp and _fbc cookies or an ad click identifier); IP address and user agent; and, when you type them into a form or the simulator, hashed identifiers (SHA-256) such as first name, surname, email or phone, known as advanced matching. These identifiers are only sent if you accepted Marketing and only to the extent they are actually collected. Hashing does not make data anonymous: Meta and Google may use it to link events to their users’ accounts. Purposes: measuring campaign results, attributing conversions, optimising ads, building audiences (including remarketing) and showing personalised advertising on Meta and Google platforms.
Marketing: legal basis and parties
Legal basis: consent (Article 6(1)(a) GDPR), which is also the basis for accessing information stored on your device (Portuguese Law 41/2004). Marketing consent is separate and optional; refusing it does not affect your proposal request or access to the website. Parties: Meta Platforms Ireland Limited and Google Ireland Limited. Under the terms of their tools, Quinta da Costa and Meta may act as joint controllers for the collection and transmission of data through the Pixel; Meta and Google then process the data under their own policies and may transfer it outside the European Economic Area with the safeguards they apply. Retention: your choice is stored in your browser; retention on Meta and Google platforms is set by those companies in their policies.
Changing or withdrawing consent
You can change or withdraw Marketing consent at any time through “Cookie preferences” in the footer. When you withdraw it, the site stops sending data to these tools and nothing collected while Marketing is refused is sent later. Withdrawal does not affect processing carried out before it. You can also manage the ads you see in your Meta and Google account settings. Marketing consents given before this version of the policy no longer count and the banner asks for a new choice.
Retention
Data is kept for as long as needed to manage the request, answer related questions and meet applicable obligations. The exact period depends on the context of the contact and whether a commercial relationship exists.
Your rights
You may request access, correction, deletion, restriction, objection or portability of your data, and withdraw consent where processing relies on it. You may also complain to the competent supervisory authority.
Privacy contact
For rights requests or questions about processing, contact Quinta da Costa at the email address below. geral@quintadacosta.com.
Security and external services
Reasonable measures are used to protect data, but no internet transmission is completely risk-free. The website links to external services such as maps and social networks, whose policies apply when you access them.
Changes
This policy may be updated to reflect changes to the website, form or applicable obligations.
Last updated: 30 October 2026.