1. Controller and contact
Wabitat is the service brand used for sustainable hospitality commerce and delivery services for accommodation properties in Portugal.
Wabitat operates the hospitality commerce and delivery service described on this website. Privacy questions and requests to exercise your rights can be sent to general@wabitatservices.com.
2. Personal data we may collect
The information depends on the workflow you use and the information you choose to provide. We aim to collect what is needed for the stated service, not unrelated information.
- Guest and checkout data: name, email address, telephone number, accommodation, delivery address, region, delivery date, and preferred delivery slots.
- Account data: name, email address, phone number, password and authentication records, verification status, passkey or two-factor security data, and account status.
- Host and partner data: contact details, company and property information, tax or payout information, property configuration, partner messages, and support requests.
- Technical and operational data: session identifiers, IP address, user agent, language preference, essential browser storage, QR visit events, order, payment, delivery, inventory, and audit records.
3. Why we use personal data
We use personal data only for purposes connected to operating, securing, and improving the Wabitat service.
- To provide the requested account, catalog, checkout, payment, delivery, partner, and support services.
- To authenticate users, verify email addresses, protect accounts, prevent fraud, and investigate security incidents.
- To coordinate delivery routes, communicate order updates, issue confirmations or invoices, and handle payment or refund records.
- To meet accounting, tax, legal, regulatory, and dispute-resolution obligations.
- To understand operational use, including property QR visits and service performance, while keeping measurement proportionate to the purpose.
4. When we share personal data
We do not sell personal data. We share only the information needed for a particular operational, contractual, legal, or security purpose.
- Payment providers such as Stripe receive payment and checkout information needed to process card payments and payment status.
- Email, hosting, storage, messaging, accounting, and technical service providers process data on our instructions where needed to operate the platform.
- Hosts and assigned delivery drivers receive the guest, property, address, and order details needed to fulfil an attributed delivery.
- Professional advisers, insurers, authorities, courts, or law-enforcement bodies may receive information where required or legally permitted.
- A successor or transaction party may receive relevant records if Wabitat’s business or assets are reorganised, subject to applicable safeguards.
5. Payments and order records
For card checkout, Stripe processes payment details. Wabitat records payment attempts, provider references, amounts, currency, status, and refund information, but does not intend to store full card numbers or security codes.
For pay-on-delivery orders, Wabitat records the selected payment method and the operational payment status. Payment or invoice records may be retained for accounting and legal obligations.
6. Cookies and browser storage
The service uses essential cookies and browser storage to keep the site functional, remember preferences, and preserve a checkout in progress. If you accept the cookie banner on our public pages, Google Analytics also sets cookies to measure how those pages are used; checkout, login and account pages are never measured, and you can change your choice at any time with “Cookie preferences” in the footer. The current implementation does not identify a marketing or advertising tracker.
- A Laravel session cookie supports security, authentication, and server-side session state.
- The locale, appearance, and sidebar-state values remember language, visual, and navigation preferences.
- The checkout cart is kept in session storage so selected packs and add-ons survive navigation during checkout.
- A property slug may be kept in session storage to pre-fill a property delivery address and preserve property context.
7. Retention
We keep personal data only for as long as it is needed for the purpose collected, to complete a transaction, maintain an account, resolve disputes, protect the service, or comply with legal and accounting obligations.
Retention periods depend on the type of data, the purpose for which it was collected, and applicable legal or accounting obligations. We keep order and accounting records for as long as those obligations require, and keep support, security, and QR visit records only as long as needed for their operational purpose. When data is no longer needed, it will be deleted, anonymised, or securely isolated where deletion is not immediately possible.
8. Your rights
Subject to applicable law, you may ask us to access, correct, delete, restrict, or provide a portable copy of your personal data. You may also object to processing based on legitimate interests and withdraw consent where processing relies on consent.
- Send a privacy request to general@wabitatservices.com with enough information for us to identify the relevant account or order.
- You can request correction when information is inaccurate or incomplete.
- You can request deletion, subject to records we must retain for legal, accounting, security, or dispute purposes.
- You may complain to the Portuguese data protection authority, CNPD, or another competent supervisory authority.
- We may ask for reasonable verification before fulfilling a request and will respond within the period required by applicable law.
9. International processing and automation
Some service providers may process information outside the European Economic Area. Where a transfer applies, Wabitat will use a lawful transfer mechanism and appropriate safeguards required by data-protection law.
Wabitat does not make decisions producing legal or similarly significant effects solely through automated processing. Operational tools may use data to route deliveries, prevent abuse, or surface service information, with human oversight where appropriate.
10. Changes to this policy
We may update this policy when the service, providers, legal requirements, or data practices change. The version and review date at the top will identify the current notice.
Material changes will be communicated through the service or another appropriate channel. Where a new Terms version is required, the new version will be recorded when an account or order accepts it.