Skip to content
Cão com Cão

Privacy Policy

Last updated: November 2026

Cão com Cão, Pet Hotel, Lda (hereafter «Cão com Cão», «we» or «our»), based in Portugal, is the controller of your personal data. This Privacy Policy explains what data we collect, for what purposes, how long we keep it and what your rights are under the General Data Protection Regulation (GDPR — Regulation (EU) 2016/679) and Portuguese Law no. 58/2019 of 8 August.

1. Data Controller

Cão com Cão, Pet Hotel, Lda, based in Portugal (full address to be published before the hotel opens in August 2027). For questions about the processing of your personal data, contact us at privacidade@caocomcao.pt. We will respond within 30 working days.

2. Personal Data We Process

2.1 Owner Data

We collect your full name, email address, telephone number, postal address and, where required for invoicing, your tax identification number (NIF). If you choose to sign in with your Google account, we receive from Google your name, email address, whether your email is verified and the address of your profile photo, together with a Google account identifier and sign-in tokens. Bank transfers are processed by your own bank: we neither collect nor store any of your banking details, and payer details are visible to us only on our own bank statement. MB WAY and Multibanco payments are processed exclusively by Ifthenpay (supervised by the Bank of Portugal). We never store card details on our systems.

2.2 Pet Data

Data relating to your pet — species, breed, name, date of birth, vaccination history, health conditions and photographs — is treated as an extension of the owner's personal data under Article 4(1) of the GDPR. This data is strictly necessary to provide our services (hotel, day care, grooming, training, walks and transport), including the vaccination status verification required by law for animal boarding establishments, and benefits from the same level of protection applied to owner data.

3. Purposes and Legal Bases

3.1 Booking and service management

We process your data to enter into and perform the service contract, including booking management, payment confirmation, stay communications and invoice issuance. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

3.2 AT-certified invoicing

We issue invoices certified by the Portuguese Tax Authority (AT) through Moloni, as required by Portuguese tax law. Billing data is retained for 10 years. Legal basis: legal obligation (Art. 6(1)(c) GDPR).

3.3 Transactional WhatsApp messages

With your express consent, we send automated WhatsApp messages (booking confirmation, check-in reminders, expiring vaccination alerts) via the Meta Cloud API. Consent can be withdrawn at any time in your account under «Account» → «Privacy», without affecting the lawfulness of processing carried out before withdrawal. Legal basis: consent (Art. 6(1)(a) GDPR).

3.4 Traffic analytics

We use PostHog (EU Cloud) to measure website traffic in cookieless mode — visits and events are recorded without placing cookies and without individual identification. Session recording, an optional feature, requires your express consent via the cookie banner. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) for aggregated anonymous analytics; consent for session recording.

3.5 Security and fraud prevention

We maintain audit logs to detect and prevent unauthorised access and fraud. These logs are retained for 1 year and are not used for marketing or profiling purposes. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

4. Data Recipients

4.1 Processors

We share your data, only to the extent strictly necessary for the delivery of each service, with the following processors. All are bound by GDPR-compliant data processing agreements:

  • Supabase Inc. (Ireland, EU) — database, authentication and file storage (vaccination records, photographs).
  • Vercel Inc. (European infrastructure) — web application hosting and execution.
  • Resend (EU infrastructure) — transactional email delivery.
  • PostHog, Inc. (EU Cloud, Frankfurt) — anonymous traffic analytics.
  • Functional Software, Inc. / Sentry (EU infrastructure) — error monitoring.
  • Bank transfer — no subprocessor: the transfer is carried out by your own bank and we see only the credit on our account statement.
  • Ifthenpay, Lda. (Portugal, reg. #8707, supervised by the Banco de Portugal) — MB WAY and Multibanco payment processing.
  • Moloni (Portugal) — AT-certified invoicing.
  • Meta Platforms Ireland Ltd. (Ireland, EU) — transactional WhatsApp messages (exclusively with your prior consent).
  • Cloudflare, Inc. (EU infrastructure) — R2 storage for database backups, and Turnstile for spam protection on the contact form.
  • Upstash, Inc. (EU infrastructure) — scheduled jobs and reminders.

4.2 Independent controllers

The following entities receive some of your data but process it for their own purposes, as independent controllers, not on our behalf. That processing is governed by their own privacy policies:

  • Google Ireland Limited (Ireland, EU) — only if you choose to sign in with your Google account: Google confirms your identity, learns that you are signing in to Cão com Cão, and shares with us your name, email address, whether your email is verified and the address of your profile photo, together with a Google account identifier and sign-in tokens. Google processes this data as a controller in its own right, under its own privacy policy.

5. Data Retention

We retain your data only for as long as necessary for the purposes for which it was collected or to comply with legal obligations:

  • Invoices and billing data: 10 years (tax obligation — Decree-Law no. 28/2019, art. 19; VAT Code (CIVA), art. 52).
  • Booking and service contract data: 5 years.
  • WhatsApp messages, including proof-of-payment messages sent that way: 30 days (data minimisation — Art. 5(1)(e) GDPR).
  • Security audit logs: 1 year.
  • Profile and account data: until deletion is requested by the data subject or 5 years after last activity, whichever comes first.

6. Your Rights

Under the GDPR (Arts. 15–22) and Law no. 58/2019, you have the following rights:

  • Access (Art. 15): request a copy of the personal data we process about you.
  • Rectification (Art. 16): correct inaccurate or incomplete data.
  • Erasure (Art. 17): request the deletion of your data («right to be forgotten»), except where a legal retention obligation applies.
  • Portability (Art. 20): receive your data in a structured, commonly used, machine-readable format.
  • Objection (Art. 21): object to processing based on legitimate interest.
  • Restriction (Art. 18): request the suspension of processing in certain circumstances.
  • Withdrawal of consent (Art. 7(3)): withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

How to exercise your rights

You can export your data or request its deletion at any time through your account under «Account» → «Privacy». Alternatively, send an email to privacidade@caocomcao.pt with the subject «Data Access/Deletion Request» and your full name. We will respond within 30 days, which may be extended by a further 60 days in cases of particular complexity, with prior notification.

Manage my data

7. Right to Lodge a Complaint with the CNPD

If you consider that the processing of your data violates the GDPR or Law no. 58/2019, you have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), the competent supervisory authority in Portugal. You can do so at cnpd.pt or in writing to: CNPD, Rua de São Bento, no. 148-3.º, 1200-821 Lisboa, Portugal.

cnpd.pt

8. Changes to This Policy

We may update this Privacy Policy to reflect changes to our services, legal obligations or data processing practices. When we make material changes, we will notify you by email or via a prominent notice on the site at least 30 days in advance. The «Last updated» date at the top of this page indicates the version in effect.

Privacy Policy — Cão com Cão