Version of 11 October 2026
1. Data controller
Slow Travel - Turismo Lda., VAT no. 503969052, with premises at Avenida Infante D. Henrique 734, 3880-355 Ovar, is the controller of the personal data collected on this website. For any privacy matter, contact spa@furadourohotel.com or +351 256 590 090. The person responsible for data protection within the company can be reached through this email.
2. What data we collect and why
When you make a booking we collect your first name, surname, email address, mobile number and, if you provide it, your tax number. Without a tax number the invoice is issued to a final consumer. You may also write notes with preferences or health information (for example pregnancy, allergies or medical restrictions). These notes are optional.
From hotel guests we ask for the room number and the preferred payment method. Booking the wet circuit on the guest page requires a code provided on arrival at the hotel.
When the reception registers a booking, a waiting-list entry, access to the wet circuit or a voucher on your behalf, it collects the same identification and contact details.
We use this data only to: manage the booking and its payment; communicate with you about the booking (confirmation, changes, a reminder the day before and a calendar file); issue the invoice and comply with legal obligations, mainly tax obligations; and deliver the treatment safely.
For security reasons we also keep, temporarily, the IP address of visitors and the attempts to access the management area.
3. Legal basis
We process your data because it is necessary to perform the service contract you request (article 6(1)(b) GDPR) and to comply with legal obligations (article 6(1)(c)). The record of IP addresses and access attempts is based on our legitimate interest in keeping the website secure (article 6(1)(f)).
Health information you choose to share in the notes is processed only with your explicit consent (article 9(2)(a)), given when booking, and is used solely to adapt the treatment to your condition. You may withdraw that consent at any time by contacting us, without affecting your booking.
Regulation (EU) 2016/679 (GDPR) and Portuguese Law no. 58/2019 of 8 August apply.
4. How long we keep the data
- Notes with health information: deleted 30 days after the treatment.
- Identification and contact details of the booking: 3 years after the last booking; then anonymised.
- Invoices: 10 years, as required by tax law.
- Waiting list: 6 months after the requested date.
- Wet-circuit access data: 12 months.
- Vouchers: contact details are anonymised 12 months after expiry or use; the issued voucher document is kept as commercial proof for 10 years.
- IP addresses and access attempts: 24 hours. Technical logs of the website: 90 days.
- Backups: 14 days.
5. Who we share the data with
We do not sell or share your data for marketing purposes. Data may be processed on our behalf by: Hostinger International Ltd., which hosts the website, the database and the sending of emails; and Reduniq/UNICRE, which processes the payment through the link we send you. We disclose data to public authorities only where the law requires it.
The internal staff assistant may use an artificial-intelligence service provided by Anthropic PBC (United States) to answer staff questions about how the SPA operates. Client data is not sent to that service.
6. Your rights
You may, at any time, request access to your data, its rectification or erasure, the restriction of processing, portability, and object to processing. Simply write to spa@furadourohotel.com. We reply within one month at the latest. To protect your data we may ask you to confirm your identity.
You also have the right to lodge a complaint with the Portuguese supervisory authority, Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt.
7. Cookies
This website uses no advertising or analytics cookies. It uses only three strictly necessary cookies, which require no consent: a cookie with the language you chose (PT or EN), kept for 180 days; a session cookie on the guest page, to validate the access code during your visit; and a session cookie in the management area, reserved for staff.
8. Security
We protect your data with an encrypted connection (HTTPS), management access restricted by staff credentials, passwords stored irreversibly, periodic backups of the database, kept in a non-public folder and retained for 14 days, and a record of the actions performed in the management panel.
9. Changes
This policy may be updated. The version in force is the one published on this page, with the date at the top.