Privacy policy

Data controller

The Enora restaurant and this website are operated by Costumes Incógnitos Lda, NIF 516942743, R. do Telhal 8A, 1150-346 Lisboa, Portugal. For any privacy question or request: enoragrouppt@gmail.com · +351 932 651 310.

Data we process and why

Reservations: when you book through our partner UMAI, we receive your name, contact details, party size, date and any notes you add, to manage your booking (legal basis: performance of a contract, Art. 6(1)(b) GDPR).

Direct contact: when you call, message us on WhatsApp or email us (including group enquiries), we use the details you share to answer you and organise your visit (legal basis: pre-contractual steps and our legitimate interest in replying, Art. 6(1)(b) and (f) GDPR).

Invoices: if you request an invoice with your tax number, we keep it to meet Portuguese tax and accounting obligations (legal basis: legal obligation, Art. 6(1)(c) GDPR).

Website analytics and map: only with your consent (Art. 6(1)(a) GDPR). See the cookie policy for details.

This website has no contact form and no user accounts.

How long we keep data

Reservation data is kept in UMAI according to its retention settings and terms. Messages and contact details from direct enquiries are kept only as long as needed to handle your request and your visit, then deleted. Invoices are kept for 10 years, as required by Portuguese law. Analytics data is kept by Google Analytics for up to 14 months.

Who receives data

We only share data with service providers that help us run the restaurant and this website: UMAI (reservations), Google Ireland Ltd. (Google Analytics, Google Tag Manager and Google Maps, only with consent), Meta Platforms Ireland Ltd. (WhatsApp, when you choose to message us), Cloudflare and our hosting provider (secure delivery of the website). We do not sell personal data.

Transfers outside the EU

Some providers, such as Google, Meta and Cloudflare, may process data in the United States. These transfers rely on the EU-US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.

Your rights

You can ask to access, correct or delete your data, restrict or object to its processing, and receive it in a portable format. Where processing is based on consent, you can withdraw it at any time, for example through the Cookie settings link at the bottom of every page, without affecting earlier processing. Write to enoragrouppt@gmail.com; we answer within one month.

You also have the right to complain to the Portuguese data protection authority: Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt.

Changes

We may update this policy when our services change. The date at the top shows the latest version.