Privacy and Data Policy

PRIVACY POLICY

In the context of its activity and the contractual relationships established, Betamar Praia Dourada, Lda., acts to ensure the highest standards of personal data protection, understood as such any information, of any nature and regardless of its support, including sound and image, relating to an identified or identifiable natural person (data subject).

To achieve this goal, it complies with all legislation on the protection of personal data, namely the precepts of Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016 (General Data Protection Regulation/GDPR), ensuring the confidentiality, integrity and availability of such data.

Through this privacy policy, Betamar Praia Dourada, Lda., intends to inform all data subjects whose processing is ensured by it about the personal data collected, how and why they are used, to whom they are disclosed and how the protection of their privacy is ensured.

In this way, the completion of the forms and contractual documents of Betamar Praia Dourada, Lda., the use and navigation of the website, the circulation in its facilities, the enjoyment of its services and the provision of data, directly or indirectly, by the data subjects, imply knowledge and acceptance of the conditions of this privacy policy.

Data Controller

Betamar Praia Dourada, Lda., is a private limited company that is part of the Sousa Group, has its registered office at Rua Goulart Medeiros, 9400-164 Porto Santo, is registered at the Commercial Registry Office under the single number of legal person 511080042 and is responsible for the processing of data, under the terms of the GDPR, whose data protection officer can be contacted through the following e-mail:  rgpd@gruposousa.pt .

THE TREATMENT

This privacy policy applies to all personal data collected and processed by Betamar Praia Dourada, Lda., ensuring a high level of protection when it comes to the processing of personal data of vulnerable holders, especially children.

In general, Betamar Praia Dourada, Lda. collects and processes personal data for the development of its business activity, namely the provision of its services, the management of the contractual relationship with its customers, suppliers, partners and employees, from the pre-contractual diligences to the final execution of the contract, and also for the fulfillment of the legal obligations to which it is subject (including tax and regulatory obligations).

In order to pursue the specific purposes of processing, Betamar Praia Dourada, Lda. collects and processes, depending on the context and the commercial relationship established, the personal data of the following data subjects:

• Customers and customer representatives;
• Service users;
• Individual suppliers and suppliers' representatives;
• Other individual partners and representatives of partners and
• Workers and collaborators.

Therefore, the personal data collected by Betamar Praia Dourada, Lda. through the website, the contract entered into or another method of collection from the holders identified above, may include, among others, the following: surname, citizen card of the dependents, CVC code, date of birth of the dependents, date of birth, expiration date of the credit card, e-mail,  companies where you worked, marital status, functions performed, educational qualifications, age, spouse identification, place of birth, address, nationality, name of dependents, name, credit card number, civil identification number, spouse identification number, dependents' identification number, tax identification number, passport number, telephone number and country of residence.

The processing of personal data of minors under 13 years of age, within the scope of the direct provision of information society services, is preceded by the consent given by those who prove that they are the holder of the respective parental responsibilities.

The collection and processing, manual or automated, of the personal data referred to above by Betamar Praia Dourada, Lda. is intended exclusively for the following specific purposes:

• Accommodation reservations;
• Check-in e check-out;
• Supply of its products and provision of contracted services;
• Compliance with customer instructions,
• Management of customer contacts;
• Signing of employment and service contracts;
• Sending newsletters to website users, customers, suppliers and partners;
• Promotional communications to publicize products and services directed to customers;
• Automated decision-making, including profiling for marketing purposes;
• Completion of satisfaction questionnaires;
• Compliance with legal obligations, in which case Betamar Praia Dourada, Lda. may have to transmit the data to the requesting public entities whenever legally required;
• Satisfaction of legitimate interests of Betamar Praia Dourada, Lda., namely the sending of marketing information to all those who have commercial relations with it, namely its partners and customers.

SENDING NEWSLETTERS AND OTHER COMMUNICATIONS

Communications regarding the sending of newsletters and invitations to events will be made to inform customers, suppliers, partners, users of the website and other entities (through the individual contacts provided) of the relevant activities and diligences in the context of the activity of Betamar Praia Dourada, Lda. and the universe of entities that belong to the same group.

All users of the website who have given their consent to receive newsletters and other communications may withdraw it by sending an email to the rgpd@gruposousa.pt address or selecting the option "stop subscribing from the newsletter", where applicable.

The exercise of the right to withdraw consent does not invalidate the processing carried out up to that date on the basis of the consent previously given.

Regarding customers, suppliers and partners, the sending of newsletters is based on the legitimate interest of Betamar Praia Dourada, Lda. in making its activity known to those with whom it already has a commercial relationship.

Retention period of personal data

The personal data collected will be kept by Betamar Praia Dourada, Lda. for the period in which its relationship with the customer, supplier or partner in whose team the data subject is integrated, and may be kept for a longer period, as established by law for the defense of right/interest in legal proceedings or for the pursuit of the aforementioned purposes. For more details, please refer to the defined data retention periods.

Once the maximum retention period has been reached, the personal data of the subjects will be irreversibly anonymized or will be destroyed securely.

Rights of Data Subjects

Under the terms provided for by law, the data subject may exercise their following rights regarding the personal data concerning them, by means of a written request addressed to Betamar Praia Dourada, Lda. sent to the email address rgpd@gruposousa.pt

• Access – the data subject has the right to access their data and obtain information regarding the purposes of their processing, the categories of data processed, the recipients of the data and the period of storage of their personal data;
• Rectification – the data subject has the right to obtain the rectification of inaccurate personal data concerning him/her, as well as the right to complete incomplete personal data;
• Deletion of your data – the data subject has the right to request the deletion of their data in certain cases, namely personal data that are no longer necessary for the purpose for which it was processed, or those for which the data subject withdraws the consent previously given;
• Restriction of Processing – the data subject has the right to request the limitation of the processing of their data in certain cases, namely if they contest the accuracy of the personal data, for a period that allows Betamar Praia Dourada, Lda. to verify their accuracy, if the processing given to the data is unlawful and the holder opposes the deletion of the data, requesting, on the other hand, the limitation of its use, if Betamar Praia Dourada, Lda. no longer needs the data of the data subject for the purposes of processing, but such data is required by the latter for the purposes of declaring, exercising or defending a right in legal proceedings or if the data subject has objected to the processing, until it is verified that the legitimate reasons of Betamar Praia Dourada,  prevail over those of the former;
• Data Portability – the data subject may, in the cases provided for by law, request from Betamar Praia Dourada, Lda. the personal data concerning him/her and that he/she has provided to him/her, in a structured, commonly used and machine-readable format and the right to transmit such data to another controller;
• Opposition – the data subject may, for reasons related to his or her particular situation, oppose the processing of personal data concerning him/her that is based on the exercise of legitimate interests pursued by Betamar Praia Dourada, Lda. or when the processing is carried out for purposes other than those for which the personal data were collected, including profiling, or when personal data is processed for statistical purposes.
• Complaint – the data subject has the right to complain to the National Data Protection Commission or other competent supervisory authority under the terms of the law, if he considers that his or her data is not being subject to legitimate processing by Betamar Praia Dourada, Lda., as provided for in the applicable legislation and in this Privacy Policy.

Safety measures adopted by BETAMAR PRAIA DOURADA, LDA.

Betamar Praia Dourada, Lda. has as its main concern to ensure the protection of the personal data of the data subjects whose processing it ensures against unauthorized access through the network.

For this purpose, it maintains in operation all the technical means at its disposal to prevent the loss, misuse, alteration, unauthorized access, disclosure, loss or destruction and misappropriation of the personal data provided or transmitted, namely:

• Ensures that communication between the user's device and the Betamar Praia Dourada, Lda. website is carried out through secure channels and communications that use the HTTPS protocol and the SSL security standard;
• Transfers data only in encrypted form;
• Permanently monitors the accesses made to information technology systems to prevent, detect and prevent the misuse of personal data;
• Conducts regular audits to assess the capacity of the technical and organisational measures adopted;
• It promotes regular awareness and training actions in the field of personal data protection for its employees;
• Adopt mechanisms that ensure the confidentiality, integrity and availability of personal data and the resilience of the information systems in which they are processed;
• It has mechanisms in place to ensure the restoration of information systems and access to personal data quickly in the event of a physical or technical incident.

PERSONAL DATA BREACH

 Betamar Praia Dourada, Lda. will notify the holders of personal data when a breach occurs that implies a high risk to their rights and freedoms, and undertakes to do so within 72 hours of the incident.

COMMUNICATION OF DATA TO OTHER ENTITIES

Betamar Praia Dourada, Lda. makes data available to other companies that are part of the Sousa Group within the scope of measures to prevent money laundering, terrorist financing and fraud or for administrative and financial management purposes inherent to the Group.

Betamar Praia Dourada, Lda. uses other entities to provide certain services. Eventually, this provision of services may imply access, by these entities, to the personal data of their customers, suppliers and partners.

Any subcontractor of Betamar Praia Dourada, Lda. will process the personal data of the data subjects in the name and on behalf of Betamar Praia Dourada, Lda., under the strict obligation to follow its instructions.

Betamar Praia Dourada, Lda. ensures that such subcontractors offer sufficient guarantees for the execution of appropriate technical and organisational measures so that the processing meets the requirements of the applicable law and ensures the security and protection of the rights of the data subjects, under the terms of the subcontracting agreement entered into with the aforementioned subcontractors.

In certain situations, the personal data of data subjects may also be transmitted to third parties, when such data communications are necessary or appropriate (i) in light of the applicable law, (ii) in compliance with legal obligations/court orders, (iii) by determination of the National Data Protection Commission or other competent supervisory authority,  or (iv) to respond to requests from public or government authorities, such as tax authorities, courts, and regulatory bodies.

In any of the situations mentioned above, Betamar Praia Dourada, Lda. undertakes to take all reasonable measures to ensure the effective protection of the personal data it processes.

INTERNATIONAL DATA TRANSFERS

The supply of products and services by Betamar Praia Dourada, Lda. may imply the transfer of the personal data of the data subjects to third countries (which do not belong to the European Union or the European Economic Area).

In such cases, Betamar Praia Dourada, Lda. will adopt the necessary and appropriate measures in the light of the applicable law to ensure the protection of the personal data subject to such a transfer, strictly complying with the legal provisions regarding the requirements applicable to such transfers, namely by informing the data subject.

CONTACTS

The data subject may contact Betamar Praia Dourada, Lda. for more information about the processing of their personal data, as well as for any questions related to the exercise of their legal rights, through the following email address (without prejudice to the fact that, in some cases and as expressly resulting from the contractual relationship established, these rights may be exercised before customers,  relevant suppliers and partners Betamar Praia Dourada, Lda.): rgpd@gruposousa.pt