Privacy Policy

Introduction

Once Upon a House respects the privacy of visitors to its corporate website and is committed to processing personal data transparently, securely and in accordance with applicable law.

This Privacy Policy explains which personal data may be collected through the website, the purposes for which they are used, with whom they may be shared, how long they may be retained and how you may exercise your rights.

This is a corporate website presenting the group, its brands, properties, venues, services and experiences. It does not provide direct booking or payment functionality. Links to brand, property or third-party websites may lead to pages governed by their own privacy policies.

1. Data controller

Once Upon a House, Portuguese corporate taxpayer number (NIPC) 518074200, is the controller of personal data processed through this website where it determines the purposes and means of such processing.

Address: Rua João de Barros 29B, 1300-319 Lisbon, Portugal. Email for privacy enquiries and the exercise of rights: geral@ouh.pt.

If an enquiry is referred to another group company or property, responsibility for the subsequent processing of the data should be identified in the privacy information applicable to that entity.

2. What is personal data?

Personal data means information relating to an identified or identifiable natural person, such as a name, email address, telephone number or certain electronic identifiers, including an IP address where it can identify an individual.

Processing includes operations such as collecting, consulting, using, storing, disclosing and deleting such data.

3. What data may we collect?

Enquiries and information requests: name, email address, telephone number, company or organisation (where applicable) and the content of messages you send us by email or through a form, if one is available on the website.

Professional contacts and collaboration proposals: name, position, company, contact details and information included in the enquiry or proposal.

Newsletter and marketing communications, if subscription is available: name (if provided), email address, communication preferences and records of consent or objections.

Job applications, if submitted to us: name, contact details, CV and other information voluntarily provided by the applicant.

Technical browsing data: IP address, browser, device, pages visited, access date and time, and information collected through cookies or similar technologies, depending on the tools actually used and the visitor's preferences.

Please do not include sensitive or unnecessary information in messages you send us.

4. How do we collect data?

You may provide data directly when contacting us by email, telephone or through features available on the website. Data may also be collected automatically when you browse, insofar as necessary for the operation and security of the website or with consent where required.

Fields marked as mandatory, where applicable, are necessary to deal with your request. If you do not provide them, we may be unable to respond appropriately.

5. Purposes and legal bases for processing

Responding to enquiries and managing contacts: we use data to answer questions about the group, its brands and activities. The legal basis may be our legitimate interest in responding to incoming communications or taking pre-contractual steps at your request, depending on the enquiry.

Business proposals and partnerships: we review and follow up on proposals and professional contacts on the basis of pre-contractual steps, performance of a contract or our legitimate interest in managing business relationships, as applicable.

Newsletter and marketing, if available: we send marketing communications on the basis of your consent or another basis permitted by applicable law. You may unsubscribe or object to direct marketing at any time.

Recruitment, if applications are received: we process data to assess applications and manage selection processes on the basis of pre-contractual steps or another applicable legal basis. Any retention for future vacancies will be subject to an appropriate legal basis.

Website operation, security and improvement: we process technical data to operate the service, prevent misuse and resolve issues, relying on our legitimate interests where applicable. Non-essential cookies will require consent whenever required by law.

Compliance with legal obligations: we may process data as necessary to comply with legal obligations or respond to lawful requests from competent authorities.

6. With whom do we share data?

Where necessary and supported by an appropriate legal basis, data may be disclosed to website hosting, maintenance and security providers; email and communications platforms; professional advisers; group entities responsible for handling an enquiry; and public authorities in cases provided for by law.

Service providers processing data on our behalf must be subject to appropriate contractual data protection obligations. We do not sell personal data.

7. Your rights

Under the conditions and within the limits set out in applicable law, you may request access to, rectification or erasure of, restriction of processing of and portability of your personal data. You may also object to certain processing and withdraw consent where processing is based on consent. Withdrawal of consent does not affect processing lawfully carried out beforehand.

Where applicable, you also have the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you.

To exercise your rights, contact us at geral@ouh.pt or by post at Rua João de Barros 29B, 1300-319 Lisbon, Portugal. We may request information necessary to verify your identity. We will respond within the time limits set by law.

You may lodge a complaint with the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados — CNPD) at www.cnpd.pt, without prejudice to any other remedies available under law.

8. Data retention

We retain data only for as long as necessary for the purpose for which they were collected and for any applicable statutory retention periods. Enquiries are retained for the time needed to respond and follow up; marketing data are retained for as long as there is a legal basis for sending communications, without prejudice to records needed to honour an objection; and application data are retained for the time necessary to manage the recruitment process and meet applicable obligations.

Technical browsing data are retained in line with their purpose of operation, security or analytics and the settings of the tools actually used. At the end of the applicable period, data will be deleted or anonymised unless further retention is legally required.

9. Data security

We implement technical and organisational measures appropriate to the risks of processing to protect data against loss, alteration, disclosure or unauthorised access. Access is restricted to persons and entities that need the information for the stated purposes.

Despite the measures adopted, no electronic transmission or storage system can guarantee absolute security.

10. Cookies and similar technologies

The website may use cookies strictly necessary for its operation and, depending on the tools installed, analytics, functionality or advertising cookies. Non-essential cookies will only be used with prior consent where required by law.

You may manage your choices through the cookie management mechanism made available on the website, if cookies requiring consent are used. Information on the cookies actually deployed, their providers, purposes and duration should be provided in the website's Cookie Policy.

11. International transfers

Certain technology providers may process data, or permit access to data, from countries outside the European Economic Area. Whenever international transfers of personal data take place, we will comply with the applicable rules, including by relying on adequacy decisions or appropriate safeguards, where required.

You may request further information on applicable transfers and safeguards at geral@ouh.pt.

12. External websites and social media

The website may contain links to websites of the group's brands and properties, third-party platforms and social media. When leaving our website, please consult the destination's privacy policy to understand how your data are processed on that platform.

Whenever Once Upon a House is responsible, alone or jointly with others, for any processing on such platforms, it will comply with its applicable legal obligations.

13. Changes to this policy

We may update this Privacy Policy to reflect legal, technical or operational changes. The updated version will be published on the website with its date. Where a change requires renewed consent or individual notice, we will act in accordance with applicable law.

Last updated: 23 September 2026