Privacy Policy

A. GENERAL PART

1. COLLECTION AND PROCESSING OF USER DATA

As part of the availability of the website hosted at www.aguadalma.pt, and https://www.secure-hotel-booking.com/smart/Agua-D-alma-Hotel/2YUG/pt/, jointly aggregated and analyzed in the privacy policy of this website www.aguadalma.pt, ("Site"), the conclusion of any contracts (namely hotel services, vouchers, massages, and promotional packages), the provision of information, content, including newsletters, login areas, or any telephone contacts, client and loyalty cards (collectively, the “Services”) to its users (“User”) and other entities that relate to it, the managing entity of Água d’Alma Hotel, represented here by Mondim Domingues, Lda, a private limited company with its registered office at Rua dos Camarções, n.º 3, 2500-481 Foz do Arelho, registered at the Commercial Registry Office of Caldas da Rainha under the unique registration and legal entity number 513004416 (hereinafter “Mondim Domingues, Lda”) may request the User to provide personal data, that is, information provided by the User that allows Mondim Domingues, Lda to identify and/or contact them (“Personal Data”). As a rule, Personal Data is requested when the User fills out forms on the Site, requests contact and/or sending of newsletters, subscribes to a specific service, provides or requests information, purchases a product, or establishes a contractual relationship with Mondim Domingues, Lda. The Personal Data collected and processed essentially consists of information related to name, gender, date of birth, telephone, mobile phone, email, address, tax identification number, credit card data (collected only for billing purposes), although other Personal Data that may be necessary or convenient for the provision or collection of Services by Mondim Domingues, Lda may also be collected. After collecting the Personal Data, Mondim Domingues, Lda provides the User with detailed information about the nature of the data collected and about the purpose and processing that will be carried out regarding the Personal Data, as well as the information mentioned in clause 8. Mondim Domingues, Lda also collects and processes information about the characteristics of the User's hardware device and browser/software characteristics, as well as information about the pages visited by the User within the Site. This information may include their browser type, domain name, access times, and the hyperlinks through which the User accessed the Site (“Usability Information”). We use this information only to improve the quality of your visit to our Site. The Usability Information and Personal Data are referred to in this Privacy Policy as “User Data”. For the purposes of this Privacy Policy, a contractual relationship means any and all contracts established between Mondim Domingues and the entities that relate to it, regardless of their object.

• SUBCONTRACTED ENTITIES In the scope of User Data processing, Mondim Domingues, Lda uses or may use third parties, subcontracted by it, to, on its behalf, and according to the instructions given by it, carry out the processing of User Data, in accordance with the law and this Privacy Policy. These subcontracted entities may not transmit User Data to other entities without Mondim Domingues, Lda having given prior written authorization, and they are also prohibited from contracting other entities without prior authorization from Mondim Domingues, Lda. Mondim Domingues, Lda commits to subcontracting only entities that offer maximum security in the execution of adequate technical and organizational measures, in order to guarantee the defense of the User's rights. All entities subcontracted by Mondim Domingues, Lda are bound to the latter through a written contract in which the object and duration of the processing, the nature and purpose of the processing, the type of personal data, the categories of data subjects, and the rights and obligations of the parties are regulated, among others. After collecting personal data, Mondim Domingues, Lda provides the User with information about the categories of subcontracted entities that, in the specific case, may carry out data processing on behalf of Mondim Domingues, Lda.

• DATA COLLECTION CHANNELS Mondim Domingues, Lda may collect data directly (i.e., directly from the User) or indirectly (i.e., through partner entities or third parties). Collection can be done through the following channels: Direct collection: in person, by telephone, by email, and through the Site; Indirect collection: through partners or associated companies and official entities.

   

2. GENERAL PRINCIPLES APPLICABLE TO THE PROCESSING OF USER DATA

In terms of general principles related to the processing of personal data, Mondim Domingues, Lda commits to ensuring that the User Data processed by it is: Subject to processing in accordance with the law, loyal, and transparent in relation to the User; Collected for specific, explicit, and legitimate purposes, not being subsequently processed in a way incompatible with those purposes; Adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed; Accurate and updated whenever necessary, with all necessary measures being taken so that inaccurate data, considering the purposes for which they are processed, are erased or corrected without delay; Stored in a way that allows the identification of the User only for the period necessary for the purposes for which the data are processed; Processed in a way that guarantees its security, including protection against unauthorized or unlawful processing and against its accidental loss, destruction, or damage, with adequate technical or organizational measures being adopted; The data processing carried out by Mondim Domingues, Lda is permitted and lawful when at least one of the following situations occurs: The User has unequivocally given their consent for the processing of User Data for one or more specific purposes; The processing is necessary for the performance of a contract to which the User is a party, or for pre-contractual steps at the request of the User; The processing is necessary for compliance with a legal obligation to which Mondim Domingues, Lda is subject; The processing is necessary for the protection of the vital interests of the User or another natural person; The processing is necessary for the purposes of the legitimate interests pursued by Mondim Domingues, Lda or by third parties (except where the interests or fundamental rights and freedoms of the User that require the protection of personal data prevail). Mondim Domingues, Lda commits to ensuring that the processing of User Data is only done under the conditions listed above and in compliance with the principles mentioned above. When the processing of User Data is carried out by Mondim Domingues, Lda based on the User's agreement, the User has the right to withdraw their consent at any time. However, the withdrawal of consent does not compromise the legality of the processing carried out by Mondim Domingues, Lda based on the consent previously given by the User. The period of time during which the data is stored and retained varies according to the purpose for which the information is processed. In fact, there are legal requirements that oblige data to be kept for a minimum period of time. Thus, and whenever there is no specific legal obligation, the data will be stored and retained only for the minimum period necessary for the purposes that motivated its collection or subsequent processing, at the end of which they will be deleted.

3. USE AND PURPOSES OF USER DATA PROCESSING

In general terms, Mondim Domingues, Lda uses User Data for the following purposes: Provision of hotel services and associated services (meals, bars, massages, etc.); Management of contacts with the User; Billing and collection from the User; User registration on electronic platforms; Informing the User, who has requested it, of new products and services available on the Site and/or at the hotel unit, special offers and campaigns, updated information about the activity of Água d’Alma Hotel and, generally, for marketing purposes of Mondim Domingues, Lda, through any means of communication, including electronic support; Ensuring that the Site meets the User's needs, through the development and publication of content as adapted as possible to the requests and type of User, the improvement of the Site's search capabilities and functionalities, and obtaining associated or statistical information regarding the typical User profile (analysis of consumption profiles); Provision of Services, and other services, such as newsletters, opinion surveys, or other information or products requested or purchased by the User; Sending satisfaction questionnaires; Recording of telephone calls that may be made as part of the request or provision of information about reservations, vouchers, and other products or services and their commercial and usage conditions, as well as the establishment of any contractual relationship, both during the formation of the contract and during its duration; Mondim Domingues, Lda may combine Usability Information with anonymous demographic information for research purposes, and may use the result of this combination to provide more relevant content on the Site. In certain areas of the Site, Mondim Domingues, Lda may combine Personal Data with Usability Information to provide the User with more personalized content. The User Data collected by Mondim Domingues, Lda is not shared with third parties without the User's consent, with the exception of the situations mentioned in the paragraph below. However, if the User contracts services from Mondim Domingues, Lda that are provided by other entities responsible for the processing of personal data, the User Data may be consulted or accessed by these entities, to the extent necessary for the provision of the aforementioned services. Under the applicable legal terms, Mondim Domingues, Lda may transmit or communicate User Data to other entities if such transmission or communication is necessary for the execution of the contract established between the User and Mondim Domingues, Lda, or for pre-contractual steps at the User's request, if it is necessary for the fulfillment of a legal obligation to which Mondim Domingues, Lda is subject, or if it is necessary to obtain the legitimate interests of Mondim Domingues, Lda or a third party. If User Data is transmitted to third parties, reasonable efforts will be made to ensure that the transferee uses the transmitted User Data appropriately with this Privacy Policy.

4. TECHNICAL, ORGANIZATIONAL, AND SECURITY MEASURES IMPLEMENTED

To guarantee the security of User Data and maximum confidentiality, Mondim Domingues, Lda treats the information you provided to us with absolute confidentiality, in accordance with its internal security and confidentiality policies and procedures, which are updated periodically according to needs, as well as with the legally established terms and conditions. Depending on the nature, scope, context, and purposes of the data processing, as well as the risks arising from the processing for the rights and freedoms of the User, Mondim Domingues, Lda commits to applying, both at the time of defining the means of processing and at the time of the processing itself, the technical and organizational measures necessary and appropriate to the protection of User Data and compliance with legal requirements. It also commits to ensuring that, by default, only the data necessary for each specific processing purpose are processed and that this data is not made available without human intervention to an indeterminate number of people. Communication between the user's device and the Água d'Alma Hotel Site, as well as its integrated booking engine, is carried out through secure channels and communications that use the HTTPS protocol and the SSL security standard. The HeyTravel booking engine integrated into the Site is maintained and managed by the entity HHS – Host Hotel Systems, Lda, NIPC 503235903, with its registered office at Rua Paiva de Andrade, n.º 4, 1º andar, 2560-357 Torres Vedras, Portugal. For more information about the processing of personal data, consult the Host Hotel Systems Privacy Policy at: https://www.hostpms.com/pt/policy-pt Even so, in terms of general measures, Mondim Domingues, Lda adopts the following: Regular audits aimed at identifying the competence of the implemented technical and organizational measures; Awareness and training of personnel involved in data processing operations; Mechanisms capable of ensuring the permanent confidentiality, availability, and resilience of information systems; Mechanisms that ensure the restoration of information systems and access to personal data quickly in the event of a physical or technical incident.

5. USE OF COOKIES AND OTHER WEB TECHNOLOGIES

When you visit our Site, a small text file (Cookie) is created and saved on your computer's hard drive, consequently, by browsing the Site you are accepting the installation of this text file on your device. This file will allow you greater ease and speed in accessing the Site, as well as its personalization according to your preferences. If you wish to delete them or automatically define their blocking, in the "Help/Help" menu of your browser you will find how to make these settings. However, if you do not allow the use of cookies, there may be some Site functionalities that you will not be able to use. Google Analytics: Google Analytics, a network analysis service provided by Google, is used on the Site. Cookies that provide information about the use and navigability on the Site will be stored. This data, including the User's IP address, is transmitted to Google's servers, however, it is not related to any other data held by Google. The User can disable the tool by downloading and installing a browser add-on available from Google: https://tools.google.com/dlpage/gaoptout?hl=en Facebook and Instagram: There is interactivity on the Site with Facebook and Instagram, through a connection to the servers of these social networks, which will allow identifying the website the user is visiting and possibly storing other data, such as the IP address. If the User has their Facebook and/or Instagram session started, the data will be associated with their accounts. To prevent this from happening, the User must end their sessions on Facebook and Instagram before visiting the page. Information regarding the data processing carried out by these social networks is available at: https://www.facebook.com/about/privacy/ and https://help.instagram.com/519522125107875 TripAdvisor: The Site provides interactivity with TripAdvisor, through the respective button, establishing a connection to TripAdvisor servers, which will identify the Site the User is visiting and possibly store other data, such as the IP address. More information on how TripAdvisor processes data is available at: https://tripadvisor.mediaroom.com/PT-privacy-policy Youtube: There is interactivity on the Site with Youtube, through a connection to the servers of this website, which will allow identifying the website the user is visiting and possibly storing other data, such as the IP address. If the User has their Youtube session started, the data will be associated with their accounts. To prevent this from happening, the User must end their session on Youtube before visiting the page. Information regarding the data processing carried out by Youtube is available at: https://www.youtube.com/intl/pt-BR/yt/about/policies/#community-guidelines

B. USER RIGHTS (DATA SUBJECTS)

6. RIGHT TO INFORMATION

Information provided to the User by Mondim Domingues, Lda (when data is collected directly from the User): The identity and contacts of Mondim Domingues, Lda, responsible for the processing and, if applicable, its representative; The contacts of the Data Protection Officer; The purposes of the processing for which the personal data is intended, as well as, if applicable, the legal grounds for the processing; If the data processing is based on the legitimate interests of Mondim Domingues, Lda or a third party, indication of such interests; If applicable, the recipients or categories of recipients of the personal data; If applicable, indication that the personal data will be transferred to a third country or an international organization, and the existence or non-existence of an adequacy decision adopted by the Commission or reference to appropriate or adequate transfer safeguards; Personal data retention period; The right to request Mondim Domingues, Lda permission to access personal data, as well as its rectification, erasure, or restriction, the right to object to processing, and the right to data accessibility; If the data processing is based on the User's consent, the right to withdraw it at any time, without compromising the legality of the processing carried out based on the consent previously given; The right to lodge a complaint with the CNPD or another supervisory authority; Indication of whether the communication of personal data constitutes a legal or contractual obligation, or a necessary requirement to enter into a contract, as well as whether the data subject is obliged to provide personal data and the possible consequences of not providing this data; If applicable, the existence of automatic decisions, including profiling, and information regarding the underlying concept, as well as the importance and foreseen consequences of such processing for the data subject; In the event that User Data is not collected directly by Mondim Domingues, Lda from the User, in addition to the information referred to above, the User is also informed about the categories of personal data subject to processing and, as well, about the origin of the data and, possibly, if they are from publicly accessible sources. If Mondim Domingues, Lda intends to proceed with the further processing of User Data for a purpose other than that for which the data was collected, prior to this processing, Mondim Domingues, Lda will provide the User with information about this purpose and any other information of interest, under the terms mentioned above. Procedures and measures implemented to comply with the right to information. The information referred to in 6.1. is provided in writing (including by electronic means) by Mondim Domingues, Lda to the User prior to the personal data processing in question. Under applicable law, Mondim Domingues, Lda is not obliged to provide the User with the information mentioned in 6.1 when and to the extent that the User already has knowledge of it. The information is provided by Mondim Domingues, Lda free of charge.

7. RIGHT OF ACCESS TO PERSONAL DATA

Mondim Domingues, Lda guarantees the means that allow the User to consult their Personal Data. The User has the right to obtain from Mondim Domingues, Lda confirmation as to whether or not personal data concerning them is being processed and, if so, the right to access their personal data and the following information: The purposes of the data processing; The categories of personal data concerned; The recipients or categories of recipients to whom the personal data have been or will be disclosed, namely recipients established in third countries or belonging to international organizations; The personal data retention period; The right to request Mondim Domingues, Lda to rectify, erase, or restrict the processing of personal data, or the right to object to this processing; The right to lodge a complaint with the CNPD or another supervisory authority; If the data has not been collected from the User, the available information about the origin of this data; The existence of automated decisions, including profiling, and information regarding the underlying logic, as well as the importance and foreseen consequences of such processing for the data subject; The right to be informed about the appropriate safeguards associated with the transfer of data to third countries or international organizations; Upon written request, Mondim Domingues, Lda will provide the User, free of charge, with a copy of the User Data that is being processed. The provision of other copies requested by the User may incur administrative costs.

8. RIGHT TO RECTIFICATION OF PERSONAL DATA

The User has the right to request, at any time, the rectification of their Personal Data and, as well, the right to have their incomplete personal data completed, including by means of an additional statement. In case of rectification of data, Mondim Domingues, Lda communicates the respective rectification to each recipient to whom the data has been transmitted, unless such communication proves impossible or involves a disproportionate effort for Mondim Domingues, Lda.

9. RIGHT TO ERASURE OF PERSONAL DATA (“RIGHT TO BE FORGOTTEN”)

The User has the right to obtain, from Mondim Domingues, Lda, the erasure of their data when one of the following reasons applies: User Data is no longer necessary for the purpose that motivated its collection or processing; The User withdraws the consent on which the data processing is based and there is no other legal basis for the processing in question; The User objects to the processing under the right to object and there are no overriding legitimate interests that justify the processing; If the User Data is processed unlawfully; If the User Data must be erased for compliance with a legal obligation to which Mondim Domingues, Lda is subject; Under the applicable legal terms, Mondim Domingues, Lda is not obliged to erase User Data to the extent that the processing is necessary for compliance with a legal obligation to which Mondim Domingues, Lda is subject or for the purposes of declaring, exercising, or defending a right of Mondim Domingues, Lda in a judicial proceeding; In case of data erasure, Mondim Domingues, Lda communicates the respective erasure to each recipient/entity to whom the data has been transmitted, unless such communication proves impossible or involves a disproportionate effort for Mondim Domingues, Lda. When Mondim Domingues, Lda has made User Data public and is obliged to erase it under the right of erasure, Mondim Domingues, Lda commits to ensuring reasonable measures, including technical ones, taking into account the available technology and the costs of its application, to inform those responsible for the effective processing of personal data that the User has requested the erasure of links to that personal data, as well as copies or reproductions thereof.

10. RIGHT TO RESTRICTION OF PROCESSING OF PERSONAL DATA

The User has the right to obtain, from Mondim Domingues, Lda, the restriction of the processing of User Data, if one of the following situations applies (restriction consists of inserting a mark on the retained personal data with the aim of limiting its processing in the future): If the accuracy of the personal data is contested, for a period that allows Mondim Domingues, Lda to verify its accuracy; If the processing is unlawful and the User opposes the erasure of the data, requesting, instead, the restriction of its use; If Mondim Domingues, Lda no longer needs the User Data for processing purposes, but these data are required by the User for the purposes of declaring, exercising, or defending a right in a judicial proceeding; If the User has objected to the processing, until it is verified that the legitimate reasons of Mondim Domingues, Lda prevail over those of the User; When User Data is subject to restriction, it can only, with the exception of storage, be processed with the User's consent or for the purposes of declaring, exercising, or defending a right in a judicial proceeding, defending the rights of another natural or legal person, or for reasons of public interest legally provided for; The User who has obtained the restriction of the processing of their data in the cases mentioned above will be informed by Mondim Domingues, Lda before the restriction to processing is lifted. In case of restriction of data processing, Mondim Domingues, Lda will communicate the respective restriction to each recipient to whom the data has been transmitted, unless this communication proves impossible or involves a disproportionate effort for Mondim Domingues, Lda.

11. RIGHT TO DATA PORTABILITY

The User has the right to receive the personal data concerning them that they have provided to Mondim Domingues, Lda, in a structured, commonly used, and machine-readable format, and the right to transmit this data to another controller, if: The processing is based on consent or a contract to which the User is a party; and: The processing is carried out by automated means; The right to portability does not include inferred or derived data, i.e., personal data that is generated by Mondim Domingues, Lda as a consequence or result of the analysis of the data subject to processing. The User has the right to have their personal data transmitted directly between controllers, whenever technically possible.

12. RIGHT TO OBJECT TO PROCESSING

The User has the right to object at any time, for reasons related to their particular situation, to the processing of personal data concerning them that is based on the exercise of legitimate interests pursued by Mondim Domingues, Lda or when the processing is carried out for purposes other than those for which the personal data was collected, including profiling, or when personal data is processed for statistical purposes. Mondim Domingues, Lda will cease the processing of User Data, unless it presents urgent and legitimate reasons for this processing that prevail over the interests, rights, and freedoms of the User, or for the purposes of declaring, exercising, or defending a right of Mondim Domingues, Lda in a judicial proceeding. When User Data is processed for direct marketing purposes, the User has the right to object at any time to the processing of data concerning them for the purposes of the aforementioned marketing, which covers profiling to the extent that it is related to direct marketing. If the User objects to the processing of their data for direct marketing purposes, Mondim Domingues, Lda ceases the processing of the data for that purpose. The User also has the right not to be subject to any decision taken exclusively based on automated processing, including profiling, which produces legal effects concerning them or significantly affects them in a similar way, unless the decision: Is necessary for entering into or performing a contract between the User and Mondim Domingues, Lda; Is authorized by legislation to which Mondim Domingues, Lda is subject; or: Is based on the User's explicit consent.

13. PROCEDURES FOR THE EXERCISE OF RIGHTS BY THE USER

The right of access, the right to rectification, the right to erasure, the right to restriction, the right to portability, and the right to object can be exercised by the User by requesting via email to the Data Protection Officer (DPO). For more information, please contact the Data Protection Officer of Mondim Domingues, Lda via email [email protected] or by letter addressed to the Data Protection Officer of Mondim Domingues, Lda at Rua dos Camarções, 3, 2500-481, Foz do Arelho, Portugal. Mondim Domingues, Lda will respond in writing (including by electronic means) to the User's request within a maximum period of one month from the receipt of the request, except in cases of special complexity, where this period may be extended up to two months. If the requests presented by the User are manifestly unfounded or excessive, namely due to their repetitive nature, Mondim Domingues, Lda reserves the right to charge administrative costs or refuse to proceed with the request.

14. PERSONAL DATA BREACHES

In the event of a data breach and to the extent that such a breach is likely to result in a high risk to the rights and freedoms of the User, Mondim Domingues, Lda commits to communicating the personal data breach to the User concerned within 72 hours of becoming aware of the incident. Under legal terms, communication to the User is not required in the following cases: If Mondim Domingues, Lda has implemented adequate protection measures, both technical and organizational, and these measures have been applied to the personal data affected by the personal data breach, especially measures that make the personal data incomprehensible to anyone not authorized to access that data, such as encryption; If Mondim Domingues, Lda has taken subsequent measures that ensure that the high risk to the User's rights and freedoms is no longer likely to materialize; or If communication to the User involves a disproportionate effort for Mondim Domingues, Lda. In this case, Mondim Domingues, Lda will make a public communication or take a similar measure through which the User will be informed.

C. FINAL PART

15. CHANGES TO THE PRIVACY POLICY Mondim Domingues, Lda reserves the right to change this Privacy Policy at any time. In case of modification of the Privacy Policy, the date of the last change, available at the top of this page, is also updated. If the change is substantial, a notice will be placed on the Site.