Policy on Privacy

1. Data controller

The controller of personal data is:

• Quinta Picouto de Cima
• R. Portelinha 260, 4800-429 Guimarães, Portugal
• Email: Email

2. What data we collect and when

Contact form

When you send us a message at /contact details We collect: name, email address, telephone number (optional), subject and message. This data is stored in our database (Cloud Firestore, provided by Google) and is also sent to us by email so that we can reply.

Bookings (accommodation, events, experiences)

When requesting a booking in /reservar We collect: name, email, telephone number, desired days and times, number of people — including the number of children and the age of each one — and notes you want to leave us. The data is stored in Cloud Firestore and sent by email to the Quinta's team.

Requests made through an AI assistant

A booking request can reach us via an AI assistant (ChatGPT, Gemini and the like), made in his name. This request includes your name, email, phone number, the day and time of the visit, and the number of people — including the number of children and the age of each one. This request Not a reserve: we send an email to your address asking for confirmation, and it is your click that authorises the processing of the data. Without this confirmation, the order is deleted after 24 hours and does not reach us.

Orders from the online shop

When buying wine at /wines We collect the following information: name, email address, telephone number, delivery address and confirmation that you are aged 18 or over. Payment is not processed on the website — we will contact you by email to arrange this.

Website navigation

With consent, we use the Google Analytics (through Firebase Analytics) to understand, in aggregate, how the site is used: pages visited, device, country, session duration. This information is pseudonymized and used only in the aggregate, and not to identify anyone.

Also with consent, we use the Google Ads to measure the results of our campaigns and to show our ads to those who have already visited the website (remarketing).

The Google map is only loaded when the visitor asks for it, with one click. Until then, the page does not make any requests to Google; from that click, the browser connects to Google's servers and Google receives the visitor's IP address.

3. What do we use this data for?

• Replying to your messages, confirming bookings and processing orders;
• To comply with legal and accounting obligations (in the case of orders);
• To improve the presentation and usability of the website, based on aggregated statistics;
• With consent, measure the results of our campaigns and show our ads to those who have already visited the site.

We do not sell personal data to third parties.

4. Legal basis

• Performance of the contract or pre-contractual measures – to respond to booking requests, orders and messages received;
• Compliance with a legal obligation — to keep invoices and sales records as required by law;
• Consent — for analytics cookies (Google Analytics) and advertising cookies (Google Ads), which are only activated once they have been accepted and can be refused or withdrawn at any time;
• Legitimate interest — for cookieless visit counting (Cloudflare Web Analytics) and for website security.

5. Who we share personal data with

Personal data is processed by us and the following technical processors, all of whom have contractual data protection obligations:

• Google (Firebase / Google Cloud) — database and file hosting and e-mail queue. Data stored in data centres in the European Union (region eur3).
• Google (Google Analytics and Google Ads) — measurement of visits and campaigns and remarketing, with consent only. For these purposes, Google also processes data on its own account in accordance with the Google privacy policy.
• Google Maps — the map of contact pages and the like. It is only loaded from Google's servers after a click by the visitor.
• Cloudflare — website hosting (Cloudflare Pages) and protection against attacks.
• Resend — Delivery of confirmation and notification emails. The content of the message, which includes the name, email and telephone number, goes through this service to reach you.
• Microsoft (Azure Translator) — automatic translation of pages and emails. When the reservation is made in another language, the text of the email goes through this service, and it also contains your name, email and telephone number.
• OpenAI, Google and other companies that operate assistants "When the order reaches us through this route, the data goes through this company before reaching us. This processing is governed by that service's privacy policy, not ours.

Outside of the above, we do not share personal data with third parties.

6. How long do we keep it for?

• Contact messages: for up to 24 months after the last contact, unless you ask us to delete them before then;
• Bookings: up to 36 months, for record-keeping and managing repeat customers;
• Orders and data relating to invoices: 10 years, for tax purposes;
• Google Analytics Statistics: Google-defined period (typically 14 months);
• Analysis and browser advertising cookies: up to 2 years (Google Analytics) and 90 days (Google Ads).

7. Rights of data subjects

Under the General Data Protection Regulation (GDPR, EU 2016/679), anyone has the right to:

• Access the personal data we hold;
• Correct incorrect or out-of-date data;
• Request the deletion of the data ("right to be forgotten"), except where the law obliges us to keep it;
• To request restriction of processing or to object to processing;
• Request data portability in a structured format;
• Submit a complaint to National Data Protection Commission (CNPD).

To exercise any of these rights, simply send an email to Email. We will reply within 30 days.

8. Cookies and similar technologies

This website uses cookies and local storage that are strictly necessary for the operation of the website (language preference, shopping basket and the choice of cookies itself). Only with consent, it also uses analysis cookies (Google Analytics, such as _ga) and advertising (Google Ads, such as _gcl_au, as well as Google cookies on Google's own domains, such as doubleclick.net).

Analysis and advertising cookies are only activated after they have been accepted in the warning that appears on the first visit. Without this acceptance, they are not used. The choice can be changed at any time by going to "Manage cookies" in the footer.

We also use the Cloudflare Web Analytics to count visits and measure page speed. This tool Does not use cookies, it doesn't save anything on the visitor's device and doesn't follow anyone between sites: it only collects aggregated data — page visited, source of visit, country, browser type, and load times. As it does not store or access information on the visitor's equipment, it does not depend on prior consent. Those who prefer not to be counted can block it in their browser settings or with an extension such as uBlock Origin, without affecting their browsing on the site.

9. International transfers

The data is stored in Google’s data centres in the European Union (eur3, Belgium/Netherlands). In specific cases (technical support, maintenance), Google may access the data from other countries; these transfers are covered by the European Commission's Standard Contractual Clauses (SCCs). Google Analytics and Google Ads data may be processed outside the European Union; Google is certified under the EU-US Data Privacy Framework.

10. Safety

We apply reasonable technical and organisational measures to protect personal data: encrypted communication (HTTPS), database access rules that limit who can read/write each collection, mandatory authentication for the back office, and anti-spam protection on forms.

11. Changes to this policy

We may update this policy to reflect changes to our services or to legislation. The date of the last update is shown at the end. In the event of material changes, we will give advance notice on our website.

12. Contacts

For any questions about privacy or personal data processing:

• Email: Email
• Telephone: Phone
• Address: 260 Rua Portelinha, 4800-429 Guimarães