Privacy policy

1.1 Collection and processing of personal data

Privacy protection and personal data is a commitment by Ozìa Sociedade Hoteleira, Lda. (Designated by Guest House Douro) for its customers.

This Privacy Policy regulates the capture, processing or transmission of personal data allowed by Guest House Douro customers, as well as the exercise of their legal rights in relation to this data, pursuant to Regulation (EU) 2016/679, of the European Parliament and of the Council, of April 27, 2016, which entered into force on May 25, 2018.

The Guest House Douro collects data directly, namely from the Client, mainly by phone, by email, through the website or social networks.

1.2. The person responsible for the processing of personal data and the person in charge of the protection of the respective data

The responsible for the collection and treatment of your personal data will be the Guest House Douro, an entity that provides you with hotel, restaurant, bars, leisure spaces, exercise rooms, health treatment rooms, conference rooms, spaces for commerce or services, car parking and the organization of all types of tourist activities and events and which in this context decides what data is collected, means of treatment and purposes for which the data are used.

1.3. Personal Data, Personal Data Holders and Personal Data Categories

Personal Data is any information relating to an identified or identifiable natural person (data subject) of any nature and on any support.

The Personal Data collected and processed by the Guest House Douro consists essentially of information relating to the name, gender, date of birth, telephone, mobile phone, email, address, tax identification number, your consumer profile, and others may be collected. Personal Data that may be necessary or convenient for the provision or collection of services provided by Guest House Douro.

1.4. Subcontracted entities

Within the scope of the treatment of the Customer Data, the Guest House Douro may use third parties, subcontracted by itself, to, on their behalf, and in accordance with the instructions given by the latter, proceed with the treatment of the Customer Data, in accordance with the law and this Privacy Policy.

However, these subcontracted entities will not be able to transmit the Customer Data to other entities without the Guest House Douro having previously given written authorization to do so, and they are also prevented from hiring other entities without prior authorization from the Guest House Douro.

Guest House Douro is committed to subcontracting only entities that offer maximum security in the execution of technical and appropriate measures, in order to guarantee the defense of rights of the customer. All entities subcontracted by Guest House Douro are linked to the law through a written agreement regulating, in particular, the object and duration of the treatment, the nature and purpose of the treatment, the type of personal data, the categories of the owners data and the rights and obligations of the parties.

After collecting personal data, Guest House Douro provides the Client with information about the categories of subcontracted entities that, in the specific case, can carry out data processing on their behalf.

2. Treatment of Customer Data

Guest House Douro is committed to ensuring that the Customer Data processed by it is:

Object of treatment according to the law, loyal and transparent in relation to the Client;
Collected for specific, objective and legitimate purposes, not later being treated in a way contrary to those purposes;
Adequate and limited to the purposes for which they are treated;
Accurate and updated whenever necessary, providing all necessary measures so that the inaccurate data, taking into account the purposes for which they are processed, are erased or corrected without delay;
Kept in a way that allows the identification of the Customer only for the period necessary for the purposes for which the data are treated;
Treated in a way that guarantees your safety, including protection against its unauthorized or illegal treatment and against its unforeseen loss, destruction or damage, taking appropriate technical or organizational measures.

Data processing by Guest House Douro is permitted and legal when at least one of the following situations occurs:

If the Client has given, in a free way, specifies, informed and makes explicit his consent for the treatment of his personal data for one or more specific and determined purposes;
Treatment is necessary for the execution of a contract to which the Client is a party, or for pre-contractual procedures at the Client's request;
Treatment is necessary to comply with a legal obligation to which Guest House Douro is subject;
Treatment is necessary to defend the fundamental interests of the Client or another individual;
The treatment is necessary for the purpose of the legal interests pursued by the Guest House Douro or by third parties (except if the fundamental interests or rights and freedoms of the Client that require the protection of personal data prevail).

Guest House Douro undertakes to ensure that the processing of Personal Data is only carried out under the conditions listed above and with respect for the principles mentioned above.

When the processing of Personal Data is based on the Client's Consent, the Client has the right to withdraw his consent at any time. The withdrawal of consent, however, does not compromise the legality of the treatment carried out until then by Guest House Douro based on the consent previously given.

The period of time during which data is stored and preserved varies according to the purpose for which the information is processed.

Effectively, there are legal requirements that require data to be kept for a minimum period of time. Thus, and whenever there is no specific legal obligation, the data will be stored and preserved only for the minimum period necessary for the purposes that motivated its collection or its subsequent treatment, which will be deleted at the end.

3. Use and purpose of the Processing of Customer Data

In general terms, Guest House Douro uses Personal Data for the following purposes: Provision of hotel, restaurant, bars, leisure spaces, exercise rooms, health treatment rooms, conference rooms, spaces for trade or services, car parking and the organization of all types of activities and tourist events; Customer contact management; Billing and collection to the Customer; Customer Registration on the Site; Inform the Client, who has requested it, of new services made available, special offers and campaigns, updated information about his activity and, in general, for the purposes of marketing the Guest House Douro and its undertakings, through any means of communication, including electronic support; Provision of Services, such as newsletters, opinion surveys, or other information or services provided or treatments carried out to the Client.

4. Implementation of technical, organizational and security measures

In order to guarantee the security of the Client's Data and the maximum confidentiality, the Guest House Douro treats the information in an absolutely confidential manner, committing itself to apply the technical and organizational measures necessary and adequate to the protection of the Personal Data and to the fulfillment of the legal requirements.

The Guest House Douro is also committed to ensuring that only the data that are necessary for each specific purpose of the treatment are processed.

The communication between the Client's device and the Guest House Douro website is carried out through secure channels and communications that use the HTTPS protocol and an eventual SSL security standard.

In general terms, Guest House Douro adopts the following measures to implement the rules and principles established by the Data Protection Regulation:
Regular audits with a purpose to identifying the competence of the technical and organizational measures implemented;
Awareness and training of personnel involved in data processing operations; Pseudonymization and encoding of personal data;
Mechanisms capable of ensuring the confidentiality, availability and permanent resilience of information systems;
Mechanisms that ensure the restoration of information systems and access to personal data quickly in the event of a physical or technical incident.

5. Use of cookies

When you visit our website, you will be asked for your consent to the creation and recording on your computer of a text file (Cookie). This file will allow you to access the website more easily and quickly, as well as to personalize it according to your preferences. Most browsers accept these files (Cookies), but the Customer can delete them or automatically set their block. In your browser menu you will find how to make these settings. However, if you do not allow the use of cookies, there may be some features of the website that you will not be able to use.

6. Right to Information

Information provided to the Client by Guest House Douro (when data is collected directly from the Client):

The identity and contacts of the Guest House Douro, responsible for the treatment;
Contacts of the Data Protection Officer;
The purposes of the processing for which the personal data are intended, as well as, if applicable, the legal reasons for the processing;
If the processing of the data is based on the legitimate interests of the Guest House Douro or a third party, an indication of such interests;
If applicable, the recipients or categories of recipients of personal data;
Period of retention of personal data;
The right to request the Guest House Douro permission to personal data, as well as its correction, elimination or limitation, the right to object to the treatment and the right to access the data;
If the processing of the data is based on the consent of the data subject, the right to withdraw it at any time;
The right to file a complaint with the CNPD or another supervisory authority.

7. Right of Access to Personal Data

The Client has the right to obtain confirmation from the Guest House Douro that the personal data concerning him is or is not subject to treatment and, if applicable, the right to access his personal data.

Upon request, Guest House Douro will provide, free of charge, a copy of the Customer Data that is in the treatment phase. The provision of other copies requested by the Customer may incur administrative costs.

8. Right to Rectify Personal Data

The Client has the right to request, at any time, the rectification of his Personal Data and, as well, the right to have his incomplete personal data completed.

In case of rectification of the data, the Guest House Douro informs each recipient to whom the data has been transmitted the respective rectification, unless such communication is considered impossible or implies a disproportionate effort for the Guest House Douro.

9. Elimination of Personal Data (right to forget)

The Client has the right to obtain, from Guest House Douro, the deletion of your data when one of the following reasons applies:

Customer Data is no longer necessary for the purpose that motivated its collection or treatment;
The Client withdraws the consent on which the data processing is based and there is no other legal basis for such processing;
The Client opposes the treatment under the right of opposition and there are no prevailing legitimate interests that justify the treatment;
If Personal Data is processed illegally;
Under applicable legal terms, Guest House Douro is under no obligation to delete Customer Data to the extent that processing proves necessary to fulfill a legal obligation to which Guest House Douro is subject or for the purposes of declaration, exercise or defense of a right of the Guest House Douro in any dispute.

In the event of data deletion, Guest House Douro informs each recipient / entity to whom the data has been transmitted the respective deletion, unless such communication proves impossible or involves a disproportionate effort.

10. Personal Data Portability Right

The Client has the right to receive the personal data that concerns him and that he has provided to the Guest House Douro, in a structured format, in common use and automatic reading, and the right to transmit this data to another controller, whenever this is technically possible if:

Treatment is based on consent or a contract to which the Client is a party; and the treatment is carried out by automated means.

11. Procedures for exercising the Client's Rights

The right of access, the right of rectification, the right of elimination and the right of portability can be exercised by the Client by contacting the Data Protection Officer of Guest House Douro, via email geral@guesthousedouro.com

12. Personal Data Violations

In the event of a breach of personal data, Guest House Douro will notify the National Data Protection Commission within 72 hours, also committing to report such breach to the Client, owner of the data in question.

13. Changes to the Privacy Policy

Guest House Douro reserves the right to change this Privacy Policy at any time.
In case of change, the date of the change will be visible at the top of this page.

14. Applicable Law and Venue

The Privacy Policy, as well as the collection, processing or transmission of Customer Data, are governed by the provisions of Regulation (EU) 2016/679, of the European Parliament and of the Council, of 27 April 2016 and by the applicable laws and regulations in Portugal.

Guest House Douro reserves the right to update all the terms of the privacy policy at any time.
For more information, visit the website of the National Data Protection Commission, through the following URL https://www.cnpd.pt/

Porto, July 2020