Privacy notice

The rooms on this site are rented directly by the owner, Miguel. He is the data controller: the person who decides what happens to your data.

How to reach him

Message us on WhatsApp

WhatsApp is the way to reach Miguel, and the only channel this site publishes. Anything about your data goes there and he answers it himself.

The form does not send anything by itself. It writes what you typed into a WhatsApp message and opens WhatsApp with that text ready, so nothing leaves your device until you press send there, and no form service ever sees it. What you send Miguel this way is:

• Your name and email address
• Your nationality
• Whether you are a student, a professional or something else
• Your university or employer
• The room you are interested in, or “Any room / not sure”
• Your arrival date, if you are coming from abroad
• The month you want to move in
• How long you plan to stay
• Your message

Only your name, email, move-in month and the consent box are required; the rest is optional. Empty fields are left out of the message entirely. Because it arrives on WhatsApp, Miguel also sees your phone number and your WhatsApp name, and you can read and edit the whole message before you send it.

Your details are used for two things:

1. To answer your request on WhatsApp, or by email if you gave one.
2. To keep you on the waiting list and tell you when a room that fits frees up.

That is all. No newsletter, no advertising, no selling or sharing of your data with other landlords or agencies.

Two grounds in the GDPR cover this.

Pre-contractual steps (Article 6(1)(b)) is the main one: you write to Miguel about renting a room, and answering you and arranging a viewing are steps towards a rental contract, taken at your request.

Consent (Article 6(1)(a)) covers two things. One is staying on the waiting list after the room you asked about is gone: tell Miguel on WhatsApp and you come off it, and the messages are deleted with it.

The other is the visit statistics. Nothing is measured until you press yes on the bar at the bottom of the page, and you can take that back on this page whenever you want.

The tick box on the form is not the consent record. It confirms you have read this notice before the form writes your details into a message. It never leaves your browser.

• Requests and waiting-list entries are deleted 12 months after the last contact, or sooner once you rent a room or tell Miguel you found something else.
• You can ask for deletion at any time; the data is then deleted before those 12 months are up.
• If you rent a room, the rental contract is kept for as long as Portuguese tax and rental law require.
• Visit statistics, if you allowed them, are kept by Google for 14 months and are not linked to you.

Miguel does not sell your data or pass it to other landlords or agencies. One service carries your message, one serves this page, and one counts visits if you allow it:

• WhatsApp. Everything you send Miguel goes through WhatsApp, including the message the contact form writes for you. WhatsApp (Meta) processes the conversation under its own terms and privacy policy.
• Hosting. The site is hosted on AWS Amplify (Amazon Web Services). It never sees your message: it serves static files and keeps standard server logs, which include IP addresses and the pages requested.
• Google Analytics. Only if you accepted it on the bar. Google counts visits and pages so Miguel knows which rooms people look at. It never receives your name, your email or your message, and Miguel cannot use it to work out who you are.

All three process data outside the EU. Those transfers rely on the safeguards each of them publishes for European customers: the EU–US Data Privacy Framework and the EU standard contractual clauses.

Nothing goes to Google until you say yes. On your first visit a bar at the bottom asks whether Google Analytics may count the visit. Say no and nothing from Google is loaded at all — there is no tag sitting on the page waiting to be switched on.

Say yes and Google Analytics sets cookies that tell Miguel which rooms get looked at, which pages people arrive on and which country they are in. It is never used for advertising and never joined up with your name, your email or anything you write on WhatsApp.

Two small things are remembered in your browser without asking, because they do nothing but carry out what you told the site to do: the language you picked with the language switcher, and how you left the filters on the rooms page. They are not cookies, they are never sent to Miguel or to anyone else, and they identify nobody. Clearing your browser data removes them.

Your answer about the statistics is kept the same way, rather than in a cookie, so the bar does not have to ask again. A no is honoured for 30 days, and then the bar asks once more. You can change your mind at any time:

Under the GDPR you can:

• Access: ask for a copy of the data Miguel has about you.
• Rectification: have wrong or outdated details corrected.
• Erasure: have your data deleted.
• Restriction: ask Miguel to keep your data but stop using it.
• Portability: receive your data in a common file format.
• Objection: object to a use of your data.
• Withdraw consent: at any time, without affecting what was done before.

To use any of these rights, message Miguel on WhatsApp. You get an answer within one month, as the GDPR requires. No form to fill in, no fee.

If you think your data has been handled badly, you can complain to the Portuguese data protection authority, the CNPD (Comissão Nacional de Proteção de Dados).

If you live in another EU country, you can also complain to the authority there. Writing to Miguel first is usually quicker.

If anything here changes, the new version is published on this page with a new date at the top.