The Club keeps a register. This is how it treats it.

Who is responsible

The controller for this service is KOSACK LDA, Portugal. The Sunset Club Monchique is operated as a curated hospitality and membership experience by KOSACK LDA.

Privacy contact: privacy@kosack.pt

What we collect

• Account data: name, email address, authentication provider, and session information.
• Club profile data: availability windows, membership status, candidacy records, booking attempts, event bookings, and alumni artefact records.
• Optional WhatsApp data: phone number, explicit WhatsApp opt-in, opt-out status, and message-attempt records.
• Payment data: Stripe checkout, customer, payment intent, invoice, and payment status references. We do not store full card numbers.
• Technical data: security logs, server logs, device/browser metadata, cookies required for login, and operational diagnostics.

Why we use the data

• To create and secure your member account.
• To manage 2026 Season Candidacy, availability windows, daily offer eligibility, event bookings, and alumni status.
• To send eligible daily sky-call links by email and, only if you opt in, by WhatsApp.
• To process payments, prevent abuse, handle no-shows, and keep tax/accounting records.
• To answer support, B2B, and operational requests.

Legal bases

• Account, candidacy, booking, and payment handling: contract or pre-contractual steps.
• Operational security, fraud prevention, capacity management, and service improvement: legitimate interests.
• WhatsApp alerts and non-essential marketing-style communication: your explicit opt-in, which you can withdraw at any time.
• Google Analytics: your analytics-cookie consent, if you grant it in the cookie banner.
• Tax, accounting, and legal records: legal obligations.

Services we rely on

• Supabase for authentication, account sessions, and the member registry.
• Vercel for hosting, deployment, security, and server logs.
• Stripe for payment checkout and payment status records.
• Google for Google Login if you choose that method.
• Meta/WhatsApp if you choose WhatsApp communication.
• Google Workspace for the first manual email communication from the KOSACK LDA account.
• Manual WhatsApp communication by KOSACK LDA at the beginning, if you explicitly opt in.
• Google Analytics 4 for consent-based page analytics.

WhatsApp communication

WhatsApp is optional. Providing a phone number alone does not enable WhatsApp communication. You must actively tick the WhatsApp opt-in box in your profile.

If enabled, WhatsApp may be used for availability alerts, private booking links, event updates, and practical service messages. You can opt out by changing your profile or by telling us to stop.

Cookies and analytics

The site uses cookies required for authentication and security. These are separate from analytics consent.

Google Analytics 4 is loaded only if you allow analytics cookies in the banner. The current Google tag is G-14H0KBYFC0.

Analytics helps KOSACK LDA understand page views and general referral patterns. We do not intentionally send account details, payment data, WhatsApp numbers, or candidacy profile fields to Google Analytics.

You can decline analytics or reopen Cookie settings on the site to change your choice.

Retention

• Account and profile records are kept while your account or membership status is active.
• Payment and accounting records are kept for the legally required retention period.
• WhatsApp opt-in records are kept while the opt-in is active and for a reasonable proof period after withdrawal.
• Analytics consent is stored in your browser. Google Analytics reporting data is kept according to the settings in the Google Analytics property.
• Alumni artefact records, membership cards, certificates, and sunset/starlight memories are intended to be kept permanently as part of the Club history, unless deletion or anonymisation is legally required or agreed.

Your rights

You may request access, correction, deletion, restriction, portability, or objection where applicable. You may withdraw consent-based communication at any time.

Contact privacy@kosack.pt. You may also contact the Portuguese data protection authority, CNPD, if you believe your rights are not being respected.