A. GENERAL PART
1.1. COLLECTION AND PROCESSING OF USER DATA
In connection with the provision of the website hosted at www.pestanagolf.com (“Site”), the entering into any contracts, the provision of information, content, including tournament registration, field reservations, membership enquiries, infCarvoeiro Golfe, S.A., with registered office at Aldeamento Turístico do Gramacho, Lote 4, Escritórios – Apartado 1011 and with the VAT number 501276084, provides real estate and holiday accommodation information (collectively, the “Services”) to its users (“User”) (hereinafter “Pestana”) may require the user to provide personal data, i.e. information provided by the user allowing Pestana to identify and/or contact the user (“Personal Data”).
As a rule,Personal data is requested when the User registers on the Site, requests contact and/or newsletters, subscribes to a certain Service (e.g., booking of golf courses, registration for golf tournaments, requests for information to become a member and obtain privileges and requests to book golf lessons), acquires a product or establishes a contractual relationship with Pestana.
When collecting Personal Data, Pestana shall provide the User with detailed information about the nature of the data collected and the purpose and processing to be carried out on the Personal Data, as well as the information mentioned in clause 8.
Pestana also collects and processes information about its hardware and software, as well as information about the pages visited by the User within the Site. This information may include: your browser type, domain name, access times and the links through which you accessed the Site (“Usability Information”). We use this information only to improve the quality of your visit to our Site.
Usability Information and Personal Data are referred to in this Privacy Policy as “User Data”.
1.2. SUBCONTRACTED ENTITIES
In connection with the processing of User Data, Pestana uses or may use third parties subcontracted by it to process User Data on behalf of Pestana and in accordance with the instructions given by Pestana, in strict compliance with the provisions of the law and of this Privacy Policy.
These subcontracted entities may not transmit User Data to other entities without Pestana’s prior written authorisation and may not contract with other entities without Pestana’s prior authorisation.
Pestana undertakes to subcontract only entities that provide sufficient guarantees of execution of adequate technical and organisational measures, in order to ensure the defence of the User’s rights. All entities subcontracted by Pestana shall be bound to the latter by a written contract in which the object and duration of the processing, the nature and purpose of the processing, the type of personal data, the categories of data subjects and the rights and obligations of the parties are regulated.
When collecting personal data, Pestana will provide the user with information about the categories of subcontracted entities that, in the specific case, may process data on behalf of Pestana.
1.3. DATA COLLECTION CHANNELS
Pestana may collect data directly (i.e., directly from the User) or indirectly (i.e., through partner entities or third parties). Collection can be done through the following channels:
Direct collection: in person, by telephone, by e-mail and through the Website;
Indirect collection: through partners or group companies and official entities.
2. GENERAL PRINCIPLES APPLICABLE TO THE PROCESSING OF USER DATA
In terms of general principles concerning the processing of personal data, Pestana undertakes to ensure that the User Data it processes is:
›Subject to lawful, fair and transparent treatment in relation to the User;
›Collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes;
› Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
› accurate and up-to-date where necessary, with all appropriate steps being taken to ensure that inaccurate data, having regard to the purposes for which they are processed, are erased or rectified without delay;
› Kept in a form which permits identification of the User only for the period necessary for the purposes for which the data is processed;
›Processed in a manner that ensures their security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, and appropriate technical or organisational measures are taken.
Data processing carried out by Pestana is lawful when at least one of the following situations occurs:
Pestana undertakes to ensure that user data is processed only under the conditions listed above and in compliance with the aforementioned principles.
Where processing of User Data is carried out by Pestana based on the User’s consent, the User has the right to withdraw his or her consent at any time. The withdrawal of consent, however, does not compromise the lawfulness of the processing carried out by Pestana on the basis of the consent previously given by the User.
The period of time for which data is stored and retained varies according to the purpose for which the information is processed.
In fact, there are legal requirements to retain data for a minimum period of time. Therefore, and whenever there is no specific legal requirement, the data will be stored and kept only for the minimum period necessary for the purposes that motivated their collection or their subsequent processing, after which they will be eliminated.
3. USE AND PURPOSES OF PROCESSING USER DATA
In general terms, Pestana uses User Data for the following purposes:
· Provision of hotel services and associated services (e.g., accommodation reservations);
· Communications of offers and benefits for Golf members;
· Golf Lessons Booking;
· Booking times at the golf courses;
· Requests for information within the scope of the sale of property (Real Estate Sector);
· Entry to Golf tournaments at the Pestana Courses;
· User contact management;
· Invoicing and collection from the User;
· To inform the User, upon request, of new products and services made available on the Site and/or at hotel units, special offers and campaigns, updated information on Pestana’s activities and, in general, for the purposes of marketing Pestana and its hotel units, through any means of communication, including electronic support;
· Allow access to restricted areas of the Site, in accordance with previously established terms;
· Ensuring that the Site meets the User’s needs by developing and publishing content that is as appropriate as possible to the User’s requests and type, by improving the Site’s search capabilities and functionalities and by obtaining aggregate or statistical information regarding the User’s profile (analysis of consumer profiles);
· Recording of telephone calls that may be made within the scope of the contractual relationship, both during the contract formation phase and during its validity period;
· Pestana may combine Usability Information with anonymous demographic information for research purposes and may use the result of such combination to provide more relevant content on the Site. In certain restricted areas of the Site, Pestana may combine Personal Data with Usability Information to provide the User with more personalized content.
User Data collected by Pestana will not be shared with third parties without the user’s consent, with the exception of the situations mentioned in the following paragraph. However, should the User contract with Pestana for services that are provided by other entities responsible for the processing of personal data, the User Data may be consulted or accessed by these entities, insofar as this is necessary for the provision of these services.
Under the applicable legal terms, Pestana may transmit or communicate user data to other entities in the event that such transmission or communication is necessary for the performance of the contract established between the user and Pestana, or for pre-contractual procedures at the user’s request, in the event that it is necessary for compliance with a legal obligation to which Pestana is subject or in the event that it is necessary for the purpose of pursuing the legitimate interests of Pestana or of a third party. When User Data is transmitted to third parties, reasonable efforts will be made to ensure that the transmitting party uses the transmitted User Data in a manner consistent with this Privacy Policy.
4. TECHNICAL, ORGANISATIONAL AND SAFETY MEASURES IMPLEMENTED
To ensure the security of User Data and maximum confidentiality, Pestana handles the information you have provided us with in the strictest confidence, in accordance with its internal security and confidentiality policies and procedures, which are updated periodically as necessary, as well as in accordance with the terms and conditions provided by law.
Depending on the nature, scope, context and purposes of the data processing, as well as the risks arising from the processing for the rights and freedoms of the User, Pestana undertakes to implement, both when defining the means of processing and when processing itself, the necessary and appropriate technical and organisational measures to protect User data and to comply with legal requirements.
It further undertakes to ensure that, by default, only data that are necessary for each specific purpose of the processing are processed and that such data are not made available without human intervention to an indefinite number of persons.
In terms of general measures, Pestana adopts the following:
› Regular audits to assess the effectiveness of technical and organisational measures implemented;
› Awareness raising and training of staff involved in data processing operations;
› Pseudonymisation and encryption of personal data;
› Mechanisms capable of ensuring the permanent confidentiality, availability and resilience of information systems;
› Mechanisms to ensure the timely restoration of information systems and access to personal data in the event of a physical or technical incident;
5. TRANSFER OF DATA OUTSIDE THE EUROPEAN UNION
Personal data collected and used by Pestana are not made available to third parties established outside the European Union. If, in the future, such a transfer is made for the above-mentioned reasons, Pestana undertakes to ensure that the transfer complies with the applicable legal provisions, in particular as regards determining the suitability of such country with regard to data protection and the requirements applicable to such transfers.
6. USE OF COOKIES
When you visit our site, a small text file (Cookie) is created and saved to your computer’s hard drive, therefore, by browsing the Site you are accepting the installation of this text file on your device. This file will allow you to access the Site more easily and quickly and to personalise it according to your preferences.
If you wish to delete them or have them automatically blocked, in the “Help/Help” menu of your browser you will find how to make these settings. However, if you do not permit the use of cookies there may be some features of the Site that you will not be able to use.
7. TOOLS USED BY THE SITE TO READ STATISTICS AND USER BEHAVIOUR.
Google Analytics
The Site uses Google Analytics, a web analysis service provided by Google. Cookies will be stored that provide information on the use and navigability of the Site. This data, including the IP address of the user, is transmitted to Google’s servers, but is not related to any other data held by Google.
The user can disable the tool by downloading and installing a browser add-on available from Google: https://tools.google.com/dlpage/gaoptout?hl=en
Facebook e Instagram:
On the Site there is interactivity with Facebook and Instagram, through a connection to the servers of these social networks, this will allow to identify the website that the user is visiting and possibly store other data, such as the IP address.
If the User has their Facebook and/or Instagram session started, data will be associated with their accounts. In order for this not to happen, the User should end their Facebook and Instagram sessions before visiting the page.
Information regarding the data processing carried out by these social networks is available at:
https://www.facebook.com/about/privacy/
https://help.instagram.com/519522125107875
The Site offers an interactivity with Twitter, through the respective button, establishing a connection to Twitter’s servers, which will identify the Site the user is visiting and possibly store other data, such as the IP address.
The data will be stored in this way only for the purpose of displaying the button. More information on how Twitter processes data is available at: https://twitter.com/privacy
B. USERS’ (DATA SUBJECTS’) RIGHTS
8. RIGHT TO INFORMATION
8.1. Information provided to the user by Pestana (when data is collected directly from the user):
· The identity and contact details of Pestana, the controller and, if applicable, its representative;
· The Data Protection Officer’s contact details;
· the purposes of the processing for which the personal data are intended and, where applicable, the legal basis for the processing;
· If the processing of the data is based on the legitimate interests of Pestana or a third party, indication of these interests;
· where applicable, the recipients or categories of recipients of the personal data;
· Where applicable, indication whether personal data will be transferred to a third country or an international organisation, and whether or not there is an adequacy decision adopted by the Commission or reference to appropriate or adequate transfer safeguards;
· Term of conservation of personal data;
· The right to request from Pestana access to personal data, as well as their rectification, erasure or limitation, the right to oppose processing and the right to data portability;
· If the processing of data is based on the User’s consent, the right to withdraw consent at any time, without compromising the lawfulness of the processing carried out on the basis of the consent previously given;
· The right to lodge a complaint with the CNPD or another supervisory authority;
· Indication of whether the provision of personal data is a legal or contractual obligation or a necessary requirement for entering into a contract, as well as whether the data subject is obliged to provide the personal data and the possible consequences of failure to do so;
· where applicable, the existence of automated decisions, including profiling, and information concerning the logic involved and the significance and expected consequences of such processing for the data subject.
· In the event that User Data is not collected directly by Pestana from the User, in addition to the information referred to above, the User shall also be informed of the categories of personal data being processed and of the origin of the data and, if applicable, whether it comes from publicly available sources.
· Should Pestana intend to further process User Data for a purpose other than that for which the data was collected, prior to that processing Pestana shall provide the User with information about that purpose and any other relevant information, under the terms set out above.
8.2. Procedures and measures implemented with a view to fulfilling the right to information.
The information referred to in 8.1. is provided in writing (including by electronic means) by Pestana to the user prior to the processing of the personal data in question. Under the terms of the applicable law, Pestana is not obliged to provide the User with the information mentioned in 8.1 when and insofar as the User is already aware of it.
The information is provided by Pestana free of charge.
9. RIGHT OF ACCESS TO PERSONAL DATA
Pestana guarantees the means allowing the User access to his/her Personal Data.
Users shall have the right to obtain from Pestana confirmation as to whether or not personal data concerning them are being processed and, where applicable, the right to access their personal data and the following information:
› The purposes of data processing;
›The categories of personal data concerned;
›The recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients established in third countries or belonging to international organisations;
› The retention period of the personal data;
› Right to ask Pestana to rectify, erase or limit the processing of personal data, or the right to object to such processing;
› Right to lodge a complaint with the CNPD or another supervisory authority;
› If the data has not been collected from the User, the available information on the origin of such data;
›The existence of automated decisions, including profiling, and information concerning the logic involved and the significance and expected consequences of such processing for the data subject;
› Right to be informed about the appropriate safeguards associated with the transfer of data to third countries or international organisations.
On request, Pestana will provide the user, free of charge, with a copy of the user data being processed. The supply of further copies requested by the User may incur administrative costs.
10. RIGHT OF RECTIFICATION OF PERSONAL DATA
The User has the right to request at any time the rectification of his/her Personal Data as well as the right to have his/her incomplete Personal Data completed, including by means of an additional declaration.
In the event of data rectification, Pestana shall notify each recipient to whom the data have been disclosed of the rectification, unless such notification proves impossible or involves a disproportionate effort for Pestana.
11. RIGHT TO THE ERASURE OF PERSONAL DATA (“RIGHT TO BE FORGOTTEN”)
Users shall have the right to obtain from Pestana the erasure of their data where one of the following grounds applies
› The User Data is no longer necessary for the purpose for which it was collected or processed;
› The User withdraws the consent on which the processing of the data is based and there is no other legal ground for such processing;
› the User objects to the processing under the right to object and there are no overriding legitimate interests justifying the processing;
› If User Data is unlawfully processed;
› If User Data must be deleted in order to comply with a legal obligation to which Pestana is subject;
Under the applicable legal terms, Pestana is under no obligation to delete User Data to the extent that processing is necessary to comply with a legal obligation to which Pestana is subject or for the purposes of asserting, exercising or defending a right of Pestana in legal proceedings.
In the event of data being deleted, Pestana shall notify each recipient/entity to whom the data have been transmitted of their deletion, unless such notification proves impossible or involves a disproportionate effort for Pestana.
When Pestana has made public User Data and is obliged to delete it under the right to erasure, Pestana undertakes to ensure that reasonable measures, including those of a technical nature, taking into consideration the available technology and the costs of their implementation, are taken to inform those in charge of the actual processing of personal data that the User has requested them to erase links to such personal data, as well as copies or reproductions thereof.
12. RIGHT TO LIMITATION OF PROCESSING OF PERSONAL DATA
The User shall have the right to obtain from Pestana the limitation of the processing of User Data if one of the following situations applies (limitation consists in inserting a mark in the personal data stored with the aim of limiting their processing in the future):
› If you contest the accuracy of the personal data, for a period that allows Pestana to verify their accuracy;
› If the processing is unlawful and the User opposes the erasure of the data and instead requests the limitation of its use;
› If Pestana no longer needs the User Data for processing purposes, but such data is required by the User for the purposes of asserting, exercising or defending a right in legal proceedings;
› Where the User has objected to the processing, until it is ascertained that Pestana’s legitimate reasons prevail over those of the User.
Where User Data is subject to limitation, it may, with the exception of storage, only be processed with the consent of the User or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person, or for reasons of public interest as provided by law.
Users who have obtained the restriction of processing of their data in the aforementioned cases will be informed by Pestana before the restriction on processing is lifted.
In the event of limitation of data processing, Pestana will inform each recipient to whom the data have been disclosed of the limitation, unless such communication proves impossible or involves a disproportionate effort for Pestana.
13. RIGHT OF PORTABILITY OF PERSONAL DATA
The User shall have the right to receive the personal data concerning him or her that he or she has provided to Pestana, in a structured, commonly used and machine-readable format, and the right to transmit such data to another controller if:
› The processing is based on consent or a contract to which the User is a party;
and
› The treatment is carried out by automated means.
The right of portability does not include inferred data or derived data, i.e. personal data that are generated by Pestana as a consequence or result of the analysis of the data undergoing processing.
The User has the right to have personal data transmitted directly between controllers, where technically possible.
14. RIGHT TO OBJECT TO THE PROCESSING
The User shall have the right to object at any time, on grounds relating to his or her particular situation, to processing of personal data concerning him or her which is based on the exercise of legitimate interests pursued by Pestana or when the processing is carried out for purposes other than those for which the personal data were collected, including profiling, or when the personal data are processed for statistical purposes.
Pestana shall cease processing User Data, unless it provides compelling legitimate grounds for such processing that override the interests, rights and freedoms of the User, or for the purposes of the establishment, exercise or defence of Pestana’s right in legal proceedings.
Where User Data is processed for direct marketing purposes (marketing), the User has the right to object at any time to the processing of data concerning him or her for the purposes of such marketing, which includes profiling insofar as it relates to direct marketing. Should the User object to the processing of his or her data for the purposes of direct marketing, Pestana shall cease processing the data for that purpose.
The User shall also have the right not to be subject to any decision taken solely on the basis of automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her, unless the decision:
· It is necessary for the conclusion or execution of a contract between the user and Pestana;
· is authorised by legislation to which Pestana is subject; or
· Is based on the explicit consent of the User.
15. PROCEDURES FOR THE EXERCISE OF USER RIGHTS
The right of access, the right of rectification, the right of erasure, the right to limitation, the right of portability and the right to object may be exercised by the User through the platform available at the following link:
https://pestanahotelgroup.atlassian.net/servicedesk/customer/portal/5.
Pestana will respond in writing (including by electronic means) to the user’s request within a maximum period of one month from receipt of the request, except in cases of particular complexity, where this period may be extended to two months.
If requests submitted by the User are manifestly unfounded or excessive, in particular because of their repetitive nature, Pestana reserves the right to charge administrative costs or refuse to process the request.
For more information on data protection privacy, please contact dpo@pestana.com.
16. PERSONAL DATA BREACHES
In the event of a data breach and insofar as such breach is likely to involve a high risk to the rights and freedoms of the User, Pestana undertakes to communicate the personal data breach to the User concerned within 72 hours of becoming aware of the incident.
In legal terms, communication to the User is not required in the following cases:
· If the Pestana has implemented appropriate protection measures, both technical and organisational, and those measures were applied to the personal data affected by the personal data breach, in particular measures rendering the personal data unintelligible to any person not authorised to access it, such as encryption;
· where Pestana has taken subsequent measures to ensure that the high risk to the User’s rights and freedoms is no longer likely to materialise; or
· If the communication to the User implies a disproportionate effort for Pestana. In such a case, Pestana will make a public announcement or take a similar measure whereby the user will be informed.
C. FINAL PART
17. CHANGES TO THE PRIVACY POLICY
Pestana reserves the right to change this Privacy Policy at any time. In case of modification of the Privacy Policy, the date of the last modification, available at the top of this page, is also updated. If the change is substantial, a notice will be posted on the Site.
18. LEI E FORO APLICÁVEIS
The Privacy Policy, as well as the collection, processing or transmission of User Data, are governed by the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 and by the laws and regulations applicable in Portugal.
Any disputes arising from the validity, interpretation or execution of the Privacy Policy, or which are related to the collection, processing or transmission of User Data, shall be submitted exclusively to the jurisdiction of the judicial courts of the district of Lisbon, without prejudice to the applicable mandatory legal rules.
Subscribe to our newsletter!
