Privacy and Personal Data Policy

GENERAL PRINCIPLES APPLICABLE TO USER DATA PROCESSING

In terms of general principles relating to the processing of personal data, Alísios II commits to ensuring that User Data processed by it is:

• Subject to processing in accordance with the law, fairly and transparently in relation to the User;

• Collected for determined, objective and legitimate purposes, and not subsequently processed in a manner contrary to those purposes;

• Adequate, justified and limited to what is necessary in relation to the purposes for which it is processed;

• Accurate and up-to-date whenever necessary, with all necessary measures taken to ensure that inaccurate data, taking into account the purposes for which it is processed, is deleted or corrected without delay;

• Stored in a manner that permits the identification of the User only for the period necessary for the purposes for which the data is processed;

• Processed in a manner that ensures its security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, with appropriate technical or organisational measures adopted;

• Data processing carried out by Alísios II is permitted and lawful when at least one of the following circumstances applies;

• The User has unambiguously given their consent for the processing of User Data for one or more specific purposes;

• Processing is necessary for the performance of a contract to which the User is a party, or for pre-contractual procedures at the User's request;

• Processing is necessary for compliance with a legal obligation to which Alísios II is subject;

• Processing is necessary for the protection of vital interests of the User or another natural person;

• Processing is necessary for the purposes of the legitimate interests pursued by Alísios II or by third parties (except where the User's interests or fundamental rights and freedoms requiring the protection of personal data prevail).

Alísios II commits to ensuring that the processing of User Data is only carried out under the conditions listed above and in compliance with the principles mentioned above.

When the processing of User Data is carried out by Alísios II on the basis of the User's agreement, the User has the right to withdraw their consent at any time. The withdrawal of consent, however, does not affect the lawfulness of the processing carried out by Alísios II on the basis of the consent previously given by the User.

The period of time during which data is stored and retained varies according to the purpose for which the information is processed.

Indeed, there are legal requirements that require data to be retained for a minimum period of time. Thus, and whenever there is no specific legal obligation, data will be stored and retained only for the minimum period necessary for the purposes that motivated its collection or subsequent processing, after which it will be deleted.

USE AND PURPOSES OF USER DATA PROCESSING

In general terms, Alísios II uses User Data for the following purposes:

• Provision of hotel services and associated services (restaurants, bars, Spa, etc.);

• Management of contacts with the User;

• Billing and collection from the User;

• Informing the User, who has requested it, of new products and services available;

User Data collected by Alísios II is not shared with third parties without the User's consent.

TECHNICAL, ORGANISATIONAL AND SECURITY MEASURES IMPLEMENTED

To ensure the security of User Data and maximum confidentiality, Alísios II treats the information provided to it in a completely confidential manner, in accordance with its internal security and confidentiality policies and procedures, which are updated periodically according to needs, as well as in accordance with the terms and conditions legally provided.

According to the nature, scope, context and purposes of data processing, as well as the risks arising from processing to the User's rights and freedoms, Alísios II commits to applying, both at the time of defining processing means and at the time of processing itself, the necessary and appropriate technical and organisational measures to protect User Data and comply with legal requirements.

It also commits to ensuring that, by default, only data necessary for each specific processing purpose is processed and that such data is not made available without human intervention to an indeterminate number of people.


TRANSFER OF DATA OUTSIDE THE EUROPEAN UNION

The Website may transfer your personal data to recipients located in countries outside the European Union, which may have different levels of personal data protection.

Consequently, Alísios II is committed to adopting appropriate measures to ensure the secure transfer of the User's personal data, whenever there is a transfer to a third country whose level of personal data protection is different from that of the country where the personal data is collected.

Alísios II commits to ensuring that transfers of personal data to countries outside the European Union comply with applicable legal provisions, namely regarding the determination of the adequacy of such country with respect to data protection and the requirements applicable to such transfers.

RIGHTS OF USERS (DATA SUBJECTS)
1. RIGHT TO INFORMATION

1.1. Information provided to the User by Alísios II (when data is collected directly from the User):

• The identity and contact details of Alísios II, the controller and, if applicable, its representative;

• The contact details of the Data Protection Officer;

• The purposes of processing to which the personal data is intended, and if applicable, the legal reasons for processing;

• If the processing of data is based on legitimate interests of Alísios II or a third party, an indication of such interests;

• If applicable, the recipients or categories of recipients of personal data;

• If applicable, an indication that personal data will be transferred to a third country or international organisation, and whether or not a decision of adequacy has been adopted by the Commission or a reference to appropriate or adequate transfer safeguards;
  
  • Period for which personal data will be retained;
  
  • The right to request from Alísios II access to personal data, as well as its correction, deletion or limitation, the right to object to processing and the right to data portability;
  
  • If the processing of data is based on the User's consent, the right to withdraw it at any time, without affecting the lawfulness of processing carried out on the basis of previously given consent;
  
  • The right to lodge a complaint with the CNPD or other supervisory authority;
  
  • An indication of whether the provision of personal data is or is not a legal or contractual obligation, or a requirement necessary to enter into a contract, and whether the data subject is obliged to provide the personal data and any consequences of not providing such data;
  
  • If applicable, the existence of automated decision-making, including profiling, and information relating to the underlying logic, as well as the significance and envisaged consequences of such processing for the data subject.
  
  Where User Data is not collected directly by Alísios II from the User, in addition to the information mentioned above, the User is also informed about the categories of personal data subject to processing and, as well as the origin of the data and, if applicable, whether it comes from publicly accessible sources.
  
  Should Alísios II intend to carry out further processing of User Data for a purpose other than that for which the data was collected, prior to such processing Alísios II will provide the User with information about that purpose and any other information of interest, in accordance with the terms mentioned above.
  
  1.2. Procedures and measures implemented to comply with the right to information.
  
  The information referred to in 1.1. is provided in writing (including by electronic means) by Alísios II to the User prior to the processing of the personal data in question. Under applicable law, Alísios II is not obliged to provide the User with the information mentioned in 1.1 when and to the extent that the User is already aware of it.
  
  Information is provided by Alísios II at no cost.
  
  2. RIGHT OF ACCESS TO PERSONAL DATA
  
  Alísios II guarantees the means that allow the User to access their Personal Data. The User has the right to obtain from Alísios II confirmation of whether or not personal data concerning them is subject to processing and, if so, the right to access their personal data and the following information:
  
  • The purposes of data processing;
  
  • The categories of personal data in question;
  
  • The recipients or categories of recipients to whom the personal data has been or will be disclosed, including recipients established in third countries or belonging to international organisations;
  
  • The period for which personal data will be retained;
  
  • Right to request from Alísios II the correction, deletion or limitation of the processing of personal data, or the right to object to such processing;
  
  • Right to lodge a complaint with the CNPD or other supervisory authority;
  
  • If the data has not been collected from the User, the information available on the origin of such data;
  
  • The existence of automated decision-making, including profiling, and information relating to the underlying logic, as well as the significance and envisaged consequences of such processing for the data subject;
  
  • Right to be informed about the appropriate safeguards associated with the transfer of data to third countries or international organisations.
  
  Upon request, Alísios II will provide the User, free of charge, with a copy of the User Data that is being processed. The provision of other copies requested by the User may entail administrative costs.
  
  3. RIGHT TO RECTIFICATION OF PERSONAL DATA
  
  The User has the right to request, at any time, the rectification of their Personal Data and, as well as, the right to have their incomplete personal data completed, including by means of an additional statement.
  
  In case of rectification of data, Alísios II will communicate the rectification to each recipient to whom the data has been transmitted, unless such communication is deemed impossible or would entail a disproportionate effort for Alísios II.
  
  4. RIGHT TO ERASURE OF PERSONAL DATA ("RIGHT TO BE FORGOTTEN")
  
  The User has the right to obtain, from Alísios II, the deletion of their data when one of the following reasons applies:
  
  • The User Data is no longer necessary for the purpose that motivated its collection or processing;
  
  • The User withdraws the consent on which the processing of data is based and there is no other legal basis for such processing; •
  
  The User objects to processing under the right of objection and there are no overriding legitimate interests that justify processing;
  
  • If the User Data is being processed unlawfully;
  
  • If the User Data must be deleted to comply with a legal obligation to which Alísios II is subject;
  
  • Under applicable law, Alísios II is not obliged to delete User Data to the extent that processing is necessary for compliance with a legal obligation to which Alísios II is subject or for the purposes of establishing, exercising or defending a right of Alísios II in legal proceedings.
  
  In case of deletion of data, Alísios II will communicate to each recipient/entity to whom the data has been transmitted the respective deletion, unless such communication proves impossible or would entail a disproportionate effort for Alísios II.
  
  Where Alísios II has made User Data public and is required to delete it under the right of such deletion, Alísios II commits to ensuring reasonable measures, including technical measures, taking into account the available technology and the costs of its implementation, to inform those responsible for the actual processing of personal data that the User has requested them to delete links to such personal data, as well as copies or reproductions thereof.
  
  5. RIGHT TO LIMITATION OF PROCESSING OF PERSONAL DATA
  
  The User has the right to obtain, from Alísios II, the limitation of the processing of User Data, if one of the following situations applies (limitation consists of marking personal data retained with the aim of limiting its processing in the future):
  
  • If they contest the accuracy of personal data, for a period allowing Alísios II to verify its accuracy;
  
  • If processing is unlawful and the User objects to the deletion of data, requesting instead the limitation of its use;
  
  • If Alísios II no longer needs the User Data for processing purposes, but such data is required by the User for the purposes of establishing, exercising or defending a right in legal proceedings;
  
  • If the User has objected to processing, until it is established that the legitimate reasons of Alísios II prevail over those of the User.
  
  When User Data is subject to limitation, it may only be processed, with the exception of storage, with the User's consent or for the purposes of establishing, exercising or defending a right in legal proceedings, defending the rights of another natural or legal person, or for reasons of legally provided public interest.
  
  The User who has obtained the limitation of processing of their data in the cases referred to above will be informed by Alísios II before the limitation of processing is lifted.
  
  In case of limitation of data processing, Alísios II will communicate to each recipient to whom the data has been transmitted the respective limitation, unless such communication proves impossible or would entail a disproportionate effort for Alísios II.
  
  6. RIGHT TO DATA PORTABILITY
  
  The User has the right to receive personal data concerning them and which they have provided to Alísios II, in a structured, commonly used and machine-readable format, and the right to transmit such data to another controller, if:
  
  • Processing is based on consent or on a contract to which the User is a party;
  
  • Processing is carried out by automated means.
  
  The right to portability does not include inferred data or derived data, i.e., personal data generated by Alísios II as a consequence or result of the analysis of data subject to processing.
  
  The User has the right to have their personal data transmitted directly between controllers, whenever technically feasible.
  
  7. RIGHT TO OBJECT TO PROCESSING
  
  The User has the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them that is based on the exercise of legitimate interests pursued by Alísios II or when processing is carried out for purposes other than those for which the personal data was collected, including profiling, or when personal data is processed for statistical purposes.
  
  Alísios II will cease processing User Data, unless it presents urgent and legitimate reasons for such processing that outweigh the interests, rights and freedoms of the User, or for the purposes of establishing, exercising or defending a right of Alísios II in legal proceedings.
  
  Where User Data is processed for direct marketing purposes, the User has the right to object at any time to the processing of data concerning them for such marketing purposes, which includes profiling to the extent that it is related to direct marketing. Should the User object to the processing of their data for direct marketing purposes, Alísios II will cease processing the data for that purpose.
  
  The User also has the right not to be subject to any decision taken solely on the basis of automated processing, including profiling, that produces legal effects on them or similarly significantly affects them, unless the decision:
  
  Is necessary for the conclusion or performance of a contract between the User and Alísios II;
  
  • Is authorised by legislation to which Alísios II is subject; or
  
  • Is based on the explicit consent of the User.
  
  PROCEDURES FOR THE EXERCISE OF RIGHTS BY THE USER
  
  The right of access, the right of rectification, the right of erasure, the right to limitation, the right to data portability and the right to object can be exercised by the User through the platform available at:

http://www.hotelalisios.com/hotel-contacts.html

For more information please contact the Data Protection Officer of Alísios II via email reservas@hotelalísios.com or by mail addressed to the DPO of Alísios II at Avenida Infante D. Henrique nº 83, 8200-916 Albufeira, Portugal.

Alísios II will provide a written response (including by electronic means) to the User's request within a maximum period of one month from receipt of the request, except in cases of particular complexity, in which this period may be extended to two months.

If the requests submitted by the User are manifestly unfounded or excessive, in particular due to their repetitive nature, Alísios II reserves the right to charge administrative costs or refuse to act on the request.

PERSONAL DATA BREACHES

In case of a data breach and to the extent that such breach is likely to result in a high risk to the User's rights and freedoms, Alísios II commits to notifying the data breach to the User concerned within 72 hours of becoming aware of the incident.

Under applicable law, notification to the User is not required in the following cases:

If Alísios II has implemented appropriate protective measures, both technical and organisational, and such measures have been applied to the personal data affected by the data breach, in particular measures that render the personal data unintelligible to any person not authorised to access such data, such as encryption;

If Alísios II has taken subsequent measures that ensure that the high risk to the User's rights and freedoms is no longer likely to materialise; or

If notification to the User would entail a disproportionate effort for Alísios II. In that case, Alísios II will make a public announcement or take a similar measure by which the User will be informed.

AMENDMENTS TO THE PRIVACY POLICY

Alísios II reserves the right to amend this Privacy Policy at any time. In case of modification of the Privacy Policy, the date of the last amendment, available at the top of this page, is also updated. If the amendment is substantial, a notice will be placed on the Website.

APPLICABLE LAW AND JURISDICTION

The Privacy Policy, as well as the collection, processing or transmission of User Data, are governed by the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 and by the legislation and regulations applicable in Portugal.

Any disputes arising from the validity, interpretation or performance of the Privacy Policy, or which are related to the collection, processing or transmission of User Data, must be submitted exclusively to the jurisdiction of the judicial courts of the district of Lisbon, without prejudice to the applicable mandatory legal rules.