Privacy Policy

1. INTRODUCTION

DOURO GUEST has adopted the best practices in terms of privacy and will only use the Personal Data (physical and onine) of its customers (actual or potential) for clearly identified purposes and with their consent for this purpose.

2. PERSONAL DATA

Personal Data is all information, of any nature and regardless of its support, relating to a natural person, directly or indirectly identified or identifiable.

3. DATA COLLECTION

Within the scope of its activity, DOURO GUEST may request from its clients, actual or potential, in person, by telephone, e-mail or through its website with its own domain, the following Personal Data:

• Name
• Number, issuer and validity of the Civil Identification Card
• Genre
• Date of birth
• Telephone
• Mobile phone
• Address
• Email
• Tax Identification Number
• Credit Card data (for collection purposes)

Such Personal Data may also be obtained through partners, associated companies or official entities, and it is necessary for that purpose that the respective owners have authorized their transmission.

4. TREATMENT OF DATA

The processing of Personal Data collected by DOURO GUEST is carried out in accordance with the applicable legislation, in a fair and transparent manner towards the respective holders and guaranteeing their privacy.

The treatment is intended for clearly identified, objective and legitimate purposes for which the holders of Personal Data have given their consent and are not subsequently treated in a way contrary to these purposes.

The holders of the Personal Data may withdraw their consent, however, this does not compromise the legality of the treatment made based on the consent previously provided.

Treatment of Personal Data may occur without the consent of the respective owners if it is necessary for the fulfillment of legal obligations to which DOURO GUEST is obliged, in order to execute a contract in which the holders are party, for pre-contractual procedures to holders or for the defense of other fundamental rights of the holders or of third parties.

The treatment of Personal Data includes your:

• Collection
• Organization
• Conservation
• Query
• Use
• Adaptation
• Change
• Registration
• Recovery
• Making available

5. PURPOSE OF DATA PROCESSING

The treatment of Personal Data requested from customers is intended to:

• To fulfill the legal obligations to which DOURO GUEST is obliged as economic agent providing hotel services, including the provision of information to the competent entities (Foreigners and Borders Service, Tax Authority and National Statistical Institute, among others);
• Execute pre-contractual and contractual procedures requested by clients;
• Provide all types of hotel services, including lodging, catering, laundry, car parking and tourist programs, among others that are usually provided in hotel establishments;
• Billing and charging customers for services rendered;
• Contact customers by telephone, postal mail, electronic mail or other means of communication;
• Inform customers about new products and services, offers, campaigns, promotions, updated information or other content, including newsletters and opinion surveys, as well as general marketing actions of DOURO GUEST;
• Improve the experience of using the DOURO GUEST website;
• User registration on the DOURO GUEST website;
• Allow access to restricted areas of the DOURO GUEST website;

On websites with their own domain, DOURO GUEST also collects information about the characteristics of the users’ hardware device and its browser / software, as well as information about the pages visited within the sites.

Users of such sites will be required to consent to the creation and recording on their computers of a text file (Cookie) to allow easier and faster access to the sites as well as their customization according to the users’ preferences.

6. TERM OF CONSERVATION OF DATA

The period of time during which Personal Data is stored and stored varies according to the purpose for which the information is processed, and there are legal requirements that require you to keep the data for a period of time.

Whenever there is no specific legal obligation, Personal Data shall be stored and retained only for the period necessary for the purposes for which it was collected or further processed.

7. DATA TRANSFER

The Personal Data collected by DOURO GUEST is not shared with third parties without the consent of the respective owners, unless:

• Such is necessary for the fulfillment of a legal obligation to which DOURO GUEST is subject;
• The holders contract through DOURO GUEST services provided by other entities responsible for the processing of Personal Data, in which they may be consulted or accessed by such entities, to the extent necessary for the provision of such services;

In the event of a transmission of Personal Data to third parties, efforts will be made that are considered reasonable for the transmitter to use in a proper manner with this Privacy Policy.

8. SUBCONTRACTED ENTITIES

In the scope of processing of Personal Data, DOURO GUEST uses or may have recourse to third parties, subcontracted by itself, to process, on behalf of DOURO GUEST and in accordance with the instructions provided by it, to process Personal Data in accordance with the current legislation and this Privacy Policy.

These subcontracted entities may not transmit the Personal Data to other entities without prior written authorization from DOURO GUEST, and they are also prevented from contracting other entities without the prior authorization of DOURO GUEST.

DOURO GUEST undertakes to subcontract only entities that offer maximum security in the execution of the appropriate technical and organizational measures, in order to guarantee the protection of the rights of the holders of Personal Data.

9. DATA HOLDER RIGHTS

The holders of the Personal Data have the following rights:

• Right to Information

The holders of Personal Data have the right to be informed about:

• The contact of the Data Protection Officer or the lack of it,
• The purposes of the treatment to which the Personal Data is intended, as well as, if applicable, the legal reasons for the treatment;
• In the event that the processing of Personal Data is based on the legitimate interests of DOURO GUEST or a third party, to which interests it is referred;
• The term of conservation of Personal Data;
• The right to request from DOURO GUEST the permission to Personal Data, as well as its correction, elimination or limitation, the right to oppose the treatment and the right to access the data;
• If the treatment of Personal Data is based on the consent of the holder, the right to remove it at any time, without compromising the legality of the treatment made based on the consent previously given;
• The right to complain to the National Data Protection Commission or other supervisory authority;
• If DOURO GUEST wishes to proceed to the further processing of the Personal Data for a purpose other than that for which the data was collected, prior to such treatment, DOURO GUEST will provide the holder with information on this purpose and any other information of interest, under the terms above.

• Right of Access

DOURO GUEST guarantees the means that allow the holder to consult their Personal Data.

The holder has the right to obtain from DOURO GUEST the confirmation that the Personal Data concerning him is or is not subject to treatment and, if applicable, the right to access his Personal Data and the following information:

• The purposes of data processing;
• The categories of Personal Data in question;
• Recipients or categories of recipients to whom Personal Data has been or will be disclosed
• The term of conservation of Personal Data;
• If the data has not been collected from the holder, the available information on the origin of the data;
Upon request, DOURO GUEST will provide the holder, free of charge, with a copy of their Personal Data that is being processed.

The supply of other copies requested by the holder may entail the payment of administrative costs.

• Right of Rectification

The holder has the right to request, at any time, the rectification of his Personal Data and also the right to have his incomplete Personal Data completed, including by means of an additional declaration.

In case of rectification of the data, DOURO GUEST notifies each recipient to whom the data has been forwarded for rectification, unless such communication is considered impossible or involves a disproportionate effort for DOURO GUEST.

• Right to Erase

The holder has the right to obtain, on the part of DOURO GUEST, the elimination of his Personal Data when one of the following reasons applies:

• The Personal Data will no longer be necessary for the purpose that motivated its collection or treatment;
• The holder withdraws the consent on which the processing of Personal Data is based and there is no other legal basis for such treatment;
• The holder opposes treatment under the right of opposition and there are no prevailing legitimate interests justifying treatment;
• In case the Personal Data is treated illegally;

Under applicable legal terms, DOURO GUEST is under no obligation to delete Personal Data to the extent that the processing proves necessary to fulfill a legal obligation to which DOURO GUEST is subject or for the purposes of declaration, exercise or defense of a right of a DOURO GUEST in a judicial proceeding.

In the event of the deletion of Personal Data, DOURO GUEST notifies each recipient / entity to whom the data has been transmitted of its erasure, unless such communication proves impossible or involves a disproportionate effort for DOURO GUEST;

• Right to Limitation

The limitation is to insert a mark on the Preserved Personal Data in order to limit its processing in the future.

The holder has the right to obtain, on the part of DOURO GUEST, the limitation of the processing of the Personal Data if one of the following situations applies:

• If you dispute the accuracy of the Personal Data, for a period that allows DOURO GUEST to verify its accuracy;
• If the treatment is unlawful and the holder opposes the deletion of the data, requesting, however, the limitation of its use;
• If DOURO GUEST no longer needs Personal Data for treatment purposes, but such data is required by the holder for the purposes of declaration, exercise or defense of a right in a judicial process;
• If the holder has objected to the treatment, until it is verified that the legitimate reasons of DOURO GUEST prevail over those of the holder;
• When the holder’s Personal Data is subject to limitation, they may only, with the exception of conservation, be treated with the consent of the holder or for the purpose of declaring, exercising or defending a right in a judicial process, defending the rights of another person singular or collective, or for reasons of public interest legally envisaged.

The holder that has obtained the limitation of the treatment of their Personal Data in the above cases will be informed by DOURO GUEST before the limitation to the treatment is annulled.

In case of limitation of the processing of Personal Data, DOURO GUEST will communicate to each addressee to whom the data has been transmitted to the respective limitation, unless this communication proves impossible or involves a disproportionate effort for DOURO GUEST.

• Right of Opposition

The holder has the right to oppose at any time, for reasons related to his particular situation, the processing of his Personal Data which is based on the exercise of legitimate interests pursued by DOURO GUEST or when the treatment is carried out for purposes other than those for which Personal Data has been collected.

In this circumstance, DOURO GUEST will cease processing Personal Data, unless it presents urgent and legitimate reasons for such treatment that prevail over the interests, rights and freedoms of the holder, or for the purposes of declaration, exercise or defense of a right of DOURO GUEST proceedings.

When the Personal Data is processed for the purposes of direct marketing (Marketing or Telemarketing), the holder has the right to oppose at any time the processing of the data that concern him for the purposes of said commercialization.

If the holder opposes the processing of his Personal Data for the purposes of direct marketing, DOURO GUEST ceases the processing of the data for this purpose.

The holder also has the right not to be subject to any decision taken solely on the basis of automated processing, including profiling, having legal effects or significantly affecting it in a similar way, unless the decision:

• It is necessary for the execution or execution of a contract between the holder and DOURO GUEST;
• is authorized by legislation to which DOURO GUEST is subject;
• Is based on the explicit consent of the holder.

• Right to Portability

The holder has the right to receive the Personal Data that concerns him and which he has provided to DOURO GUEST in a structured, current and automatic reading format.

The portability right does not include inferred data or derived data, that is, Personal Data that are generated by DOURO GUEST as a consequence or result of the analysis of the data being processed.

The holder has the right to have his Personal Data transmitted directly between those responsible for the treatment, whenever this is technically possible.

• Right of Submission of Complaint

The holders of Personal Data have the right to submit a complaint to the Control Authority (Comissão Nacional de Proteção de Dados), through the website www.cnpd.pt.

The right of access, the right of rectification, the right of elimination, the right to limitation, the right of portability and the right to opposition may be exercised by the holder by contacting the Data Protection Officer of DOURO GUEST by email reservas@douroguest.pt

DOURO GUEST will respond in writing (including by electronic means) to the holder’s request within a maximum of one month from the date of receipt of the request, except in cases of special complexity, where this period may be extended up to two months.

If the applications submitted by the holder are manifestly unjustified or excessive, in particular because of their repetitive nature, DOURO GUEST reserves the right to charge administrative costs or to refuse to comply with the request.

10. IMPLEMENTED ORGANIZATIONAL AND SECURITY TECHNICAL MEASURES

In order to guarantee the security of the Personal Data and its maximum confidentiality, DOURO GUEST treats the information in an absolutely confidential way and in accordance with the legally established terms and conditions.

Depending on the nature, scope, context and purpose of the processing of Personal Data, as well as the risks arising from the treatment of the rights and freedoms of the holders, DOURO GUEST undertakes to apply, both when defining the means as well as technical and organizational measures necessary and appropriate for the protection of Personal Data and compliance with legal requirements.

It also undertakes to ensure that, by default, only data that is necessary for each specific purpose of treatment is processed and that such data are not made available without human intervention to an indeterminate number of persons.

Communication between the devices of the holders of Personal Data and the sites of DOURO GUEST is done through secure channels and communications that use the HTTPS protocol and the SSL security standard.

In order to guarantee the privacy and security of the Personal Data of its customers and employees, DOURO GUEST has implemented the following technical organizational and security measures:

• The Personal Data collected is adequate, justified and limited to what is strictly necessary for the purposes for which it is processed;
• Personal Data is accurate and up-to-date;
• Personal Data is kept in a form that allows the identification of the holders only for the period necessary for the purposes for which the data are processed;
• Personal Data is treated in a way that guarantees its security, including protection against its unauthorized or illegal treatment and against its loss, destruction or unforeseen damage;
• Adopted internal rules that ensure the rapid and effective exercise of their rights by the holders of Personal Data and the implementation of free procedures for such purposes;
• Ensured the continued confidentiality, integrity, availability and resilience of treatment systems and services;
• Ensured the ability to restore availability and access to Personal Data in a timely manner in the event of a physical or technical incident;
• carefully evaluates and implements appropriate technical and organizational measures and procedures from the outset to ensure that treatment is in compliance with current legislation and protects the rights of data subjects;
• Protects data by default, ie ensures that mechanisms are in place to ensure that by default only the required amount of Personal Data will be collected, used and retained for each task, which treatment, shelf life and accessibility.

In the event of a breach of data and to the extent that such breach is likely to pose a high risk to the rights and freedoms of the holder, DOURO GUEST undertakes to report the breach of Personal Data to the holder concerned within seventy two hours from the date of the incident.

DOURO GUEST undertakes to notify the Control Authority as soon as possible without undue delay and, where possible, up to seventy-two hours after it becomes aware of the data breach.

Under legal terms, notification to the holder is not required in the following cases:

• If DOURO GUEST has applied adequate protection measures, both technical and organizational, and these measures have been applied to the Personal Data affected by the violation of Personal Data, especially measures that make Personal Data incomprehensible to any person not authorized to access them such as encryption;
• If DOURO GUEST has taken subsequent action to ensure that the high risk to the rights and freedoms of the holder is no longer likely to materialize;
• If the communication to the holder implies a disproportionate effort to DOURO GUEST, it will make a public communication or take a similar action through which the holder will be informed.

12. RESPONSIBLE FOR THE PROTECTION OF DATA (DPO)

No DPO has been designated because DOURO GUEST is not a public authority or body, not regularly and systematically monitoring large-scale Personal Data Holders and not processing large-scale sensitive Personal Data.

13. AMENDMENTS TO PRIVACY POLICY

DOURO GUEST reserves the right to change this Privacy Policy at any time. If changes are substantial, a notice will be placed on your site.

14. APPLICABLE LAW AND FORUM

The Privacy Policy and the collection, processing or transmission of Personal Data are governed by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 and by the legislation and regulations applicable in Portugal.

Any disputes arising from the validity, interpretation or execution of this Privacy Policy or that are related to the collection, processing or transmission of Personal Data must be submitted exclusively to the jurisdiction of the courts of the Lamego district, without prejudice to applicable mandatory legal rules .