Belmar Spa & Beach Resort (Website)
The confidentiality of the personal information of our clients is fundamental and a commitment of “Oceânico Lusoirlandês – Investimentos Imobiliários e Turísticos, S.A.” (hereinafter “Oceânico Lusoirlandês”).
1. User Data (Data Holder)
1.1. Collection and Handling of User Data
There are many circumstances in which we request “Personal Data” of a user (“User”) from the website www.belmarresort.com ("Site"). This may happen within the scope of availability of the website; while entering into any contracts (namely hotel services, booking of accommodation, Spa treatments and products), supply of information, content, including newsletters, login areas, or any other telephone contact, (hereinafter collectively referred to as “Services”), to its users and other entities related to it.
As a rule, Personal Data is collected and handled when the User registers with the Site, requests to be contacted and/or to receive our newsletter, subscribes a specific Service, supplies or requests information, purchases a product or establishes a contractual relationship with Oceânico Lusoirlandês.
Personal Data is the information which allows for the identification or contact of the User when making a reservation, registers with our Site or subscribes our newsletter. The collected and handled Personal Data consists of information relating to name, nationality, date of birth, address, e-mail address, telephone, mobile phone, tax identification number, credit card details (only collected for invoicing purposes), however, other Personal Data may be collected which may prove necessary or useful for supply or charge of Services by “Oceânico Lusoirlandês – Investimentos Imobiliários e Turísticos, S.A.” – Responsible Entity for the collection and handling of Personal Data – better identified below.
After the collection of the Personal Data, more detailed information is given to the User in relation to the nature of the data collected, the purpose of the collection and the handling of the data, as well as the information referred to in paragraph 7 below.
It is also collected and handled, information relating to the characteristics of your hardware and browser/software characteristics, as well as information on the pages visited by the User within the Site. This information may include your IP (Internet Protocol) address, the operating system and the type of browser (“Usability Information”). We use this information only to improve the quality of your visit to our Site.
1.2. Handling Responsible Entity
The Responsible Entity for collection of the Personal Data is “Oceânico Lusoirlandês – Investimentos Imobiliários e Turísticos, S.A.”, a company with its registered office at Amendoeira Golf Resort, Oceânico Lusoirlandês, 8365-302 Alcantarilha, Algarve, Portugal, registered in the Commercial Registry of Silves, under registration and taxpayer number 500397503, with a share capital of EUR 1,000,000.00.
1.3. Subcontracted Entities
These Subcontracted Entities will not be allowed to supply the User Data to other entities without “Oceânico Lusoirlandês” giving prior written authorization to this effect, being always prevented from contracting other entities without “Oceânico Lusoirlandês” prior authorization.
“Oceânico Lusoirlandês” commits to subcontract only entities who offer maximum security in the performance of technical and adequate organizational measures, for the purpose of ensuring the User rights protection. All Entities subcontracted by “Oceânico Lusoirlandês” are bound to the latter by a written contract regulating, specifically, the subject and duration of the handling, the nature and purpose of the handling, the type of personal data, the categories of the data holders and the rights and obligations of the parties.
Following the collection of the Personal Data, and if applicable, “Oceânico Lusoirlandês” provides the User, information about the Subcontracted Entities that in this specific instance might handle the data on behalf of “Oceânico Lusoirlandês”.
1.4. Data Collection Channels
“Oceânico Lusoirlandês” may collect data in a direct way (i.e. directly from the user) or in an indirect way (i.e. through partner entities or third parties). The collection may be done through the following channels:
Direct collection: in person, by telephone, by e-mail or through the Site.
Indirect collection: through partners or group companies and official entities.
2. General Principles Applicable to the User Data Handling
2.1. Principles Relating to Personal Data Handling
“Oceânico Lusoirlandês” ensures the User Data collected is handled in accordance with the following general principles:
- Are handled in accordance with the law, licit, loyal and transparent in relation to the data holder (“lawfulness, loyalty and transparency”);
- Are collected for the specific, objective and legitimate purposes, set out in number 3. below, and are not subsequently handled in a manner incompatible with those purposes (“limitation of purpose”);
- Are adequate, pertinent and limited to what is required in relation to the purpose for which are being handled (“data minimization”);
- Are accurate and updated whenever necessary, with all adequate measures being adopted to delete or rectify without delay inaccurate data, considering the purpose for which they are handled (“accuracy”);
- Are stored in a way which allows the identification of the User only during the timeframe required for the purpose the data is being handled (“storage limit”)
- Are handled I a way which guarantees its safety, including protection against the unauthorized or unlawful use and against the loss, destruction or unforeseen damage, with the adequate technical and organizational measures being adopted (”integrity and confidentiality”).
2.2. Lawfulness of Handling
The data handling performed by “Oceânico Lusoirlandês” are permitted and legal when at least one of the following situations applies:
- The handling is necessary for completion of a contract where the User is a party, or for pre-contract procedures at the request of the User;
- The User has given without a doubt its consent for the handling of its Personal Data for one or more specific purposes:
- The handling is necessary for fulfilment of a legal obligation which “Oceânico Lusoirlandês” might be subject to;
- The handling is necessary for the protection of the vital interests of the User or other individual;
- The handling is necessary for the purpose of “Oceânico Lusoirlandês” pursuing its legitimate interests or by third parties on its behalf, except if the interest or rights and fundamental liberties of the User which demand the protection of personal data prevail.
“Oceânico Lusoirlandês” undertakes to ensure the handling of the User data is only performed in the conditions set out above and respecting the principles above mentioned.
2.3. Applicable Conditions to Consent
When the processing of the User Data is performed by “Oceânico Lusoirlandês” based on the consent of the User, it has the right to withdraw its consent at any time. However, the withdrawal of consent does not compromise the lawfulness of the processing done by “Oceânico Lusoirlandês” based on the consent previously granted by the User.
2.4. Term of Data Storage
The period of time during which the data is stored and maintained varies in accordance with the purpose for which the information is processed.
“Oceânico Lusoirlandês” will comply with the legal requirements that oblige us to keep Personal Data for a minimum period of time. Where there is no specific legal obligation, the data will be stored only for the minimum period necessary for the purposes for which it was collected or subsequently processed, being deleted on its expiry.
3. Usage and Purpose of User Data Processing
The collected Personal Data will be used solely for the following purposes:
- Provision of hotel and associated services (restaurants, bars, etc)
- Effectiveness of hotel bookings;
- Spa products and treatments;
- Management of contracts with the User;
- Invoicing to and collection from the User;
- Registration of the User on the Site;
- Information to the User, who has given consent, of new products and services made available on the Site and/or premises where the services are provided; offers and special campaigns; information on promotions and information about “Oceânico Lusoirlandês” (if subscribed to our newsletter), and finally, for marketing statistical analysis of the exclusive use of “Oceânico Lusoirlandês”;
- Allow access to restricted areas of the Site, in accordance with the terms previously established;
- Guarantee the Site meets the User’s needs, through the development and publication of content adapted as much as possible to the preference, requests and type of User, improve the search capability and Site functionality and the collection of associated information or statistics relating to the User’s profile type (analysis of consumer profiles);
- Provision of other services, such as newsletters, opinion surveys, or other information or products requested or purchased by the User;
- Oceânico Lusoirlandês” may combine Usability Information with anonymous demographic information for research purposes, and may use the result of this combination to supply more relevant content on the Site. In certain restricted areas of the Site, “Oceânico Lusoirlandês” may combine Personal Data with Usability Information to supply the User a more personalized content.
- The User Data collected by “Oceânico Lusoirlandês” are not shared with third parties without consent from the User, with exception of the situations referred to in the next paragraph. However, in the event the User contracts with “Oceânico Lusoirlandês” for services which are supplied by other entities responsible for processing Personal Data, the Personal Data may be consulted or accessed by that entity, in so far as it may be necessary for the provision of the referred to services.
4. Implemented Technical, Organizational and Security Measures
4.1. User Data Security
To guarantee the security of the User Data and maximum confidentiality, “Oceânico Lusoirlandês” processes the information supplied in a completely confidential manner, in accordance with its internal security and confidentiality procedures, which are periodically reviewed and updated in accordance with the needs and in accordance with the terms and conditions legally envisaged.
Considering the nature, scope, context and the purposes of the data processing, as well as the inherent risks for the rights and liberties of the User, arising from the processing of data, “Oceânico Lusoirlandês” commits itself to applying, not only at the time of defining the processing means, but also at the time of the actual processing, the necessary and adequate technical and organizational measures to the protection of User Data and to the compliance with the legal obligations.
Commits itself further to ensure that, by default, only the necessary data for each specific purpose is processed and that that data is not made available without human intervention and to an undetermined number of people.
The communication between the User device and the Site of “Oceânico Lusoirlandês” is made through secure communications channels which use the HTTPS protocol and the security standard SSL. Nevertheless, in terms of general measures, “Oceânico Lusoirlandês” adopts the following:
- Regular audits in order to identify the competence of the implemented technical and organizational measures;
- Raise awareness and training of the staff involved in data processing tasks.
- Mechanisms capable of ensuring the confidentiality, availability and the permanent resilience of the information systems.
- Mechanisms which ensure the fast recovery of the information systems and the access to Personal Data in case of a physical or technical incident.
5. Data transfer to outside the European Union
The Personal Data collected and used by “Oceânico Lusoirlandês” are not made available to third parties outside the European Union. If, in the future, this transfer comes to happen, “Oceânico Lusoirlandês” commits itself to ensure the transfer complies with the applicable legal terms, namely in terms of the determination of the suitability of such country for the protection of data and the requirements applicable to such transfers.
When visiting the Site of “Oceânico Lusoirlandês”, consent will be requested from the User for the creation and saving on your computer of a text file (Cookie). This file, when recognizing you, will allow the User an easier and faster access to the Site, as well as a personalized use in accordance with your preferences.
B) Users Rights (Data Holders)
7. Right to Information
7.1. Information provided by “Oceânico Lusoirlandês” to the User (when the Data is collected directly from the User):
- Identification and contact details of “Oceânico Lusoirlandês”, responsible for processing, and if applicable, of its representative.
- The contact details of the Data Protection Officer, if applicable;
- The purposes of the Personal Data processing, as well as, if applicable, the legal reasons for the processing;
- If the Personal Data processing is based on the legitimate interests of “Oceânico Lusoirlandês” or a third party, indication of such interests;
- If applicable, the recipients or categories of recipients of the Personal Data;
- If applicable, indication that Personal Data will be transmitted to another country or an international organization, and whether or not there is a compliance decision adopted by the Commission or reference to appropriate or adequate transfer guarantees;
- Personal Data storage period or the criteria used to define this term;
- The right to request from “Oceânico Lusoirlandês” permission to access the Personal Data, as well as its correction, deletion or processing limitations, the right to object to the processing and the right to the Portability of Data;
- If the processing of Data is based on the consent of the user, the right to withdraw it at any time, without compromising the lawfulness of the processing carried out on the basis of the consent previously given;
- The right to lodge a complaint with the National Commission for the Protection of Data (CNPD) or other supervisory authority;
- Indication as to whether or not the communication of personal data constitutes a legal or contractual obligation or a requirement to complete a contract, as well as whether the holder is obliged to provide Personal Data and the possible consequences of not providing such data;
- If applicable, the existence of automatic decisions, including the definition of profiles and information relating to the basic concept, such as the importance and expected consequences of such processing for the Data Holder;
7.2. Information provided by “Oceânico Lusoirlandês” to the User (when the Data is not collected directly from the User):
- In the event the Personal Data is not collected directly from the User by “Oceânico Lusoirlandês”, besides the information referred to above, the User is also informed of the Personal Data categories subject to processing and, also, the origin of the Data and eventually, if the sources are available to the public.
- In the event "Oceânico Lusoirlandês" intends to proceed to the later processing of the User Data for a purpose other than that for which the Data was collected, prior to such processing, it will provide the User with information about that purpose and any other information of interest, pursuant to the terms above.
7.3. Procedures and Implemented Measures for the Compliance with the Right to Information
The information set out in points 7.1 and 7.2 above shall be provided in writing (including by electronic means) by "Oceânico Lusoirlandês" prior to the processing of the Personal Data concerned. Under the applicable legislation, "Oceânico Lusoirlandês" has no obligation to provide the user the information mentioned in 7.1. and 7.2. above, when, and to the extent that the User is already aware of them.
The information is provided to the User by “Oceânico Lusoirlandês” at no cost.
8. Right of Access to Personal Data
"Oceânico Lusoirlandês" guarantees the means to enable the User to consult its personal data.
The User has the right to obtain confirmation from "Oceânico Lusoirlandês" whether its Personal Data is processed or not, and, as the case may be, the right to access its Personal Data and the following information:
- The purpose of the Data processing;
- The categories of the Personal Data in question;
- The recipients or categories of recipients to whom the Personal Data has been or will be disclosed, in particular those domiciled in other countries or belonging to international organizations, where appropriate;
- The expected Personal Data storage period or, if not possible, the criteria used to define this period;
- The right to request from “Oceânico Lusoirlandês” the correction, deletion or processing limitations of the Personal Data, or the right to object to such processing;
- The right to lodge a complaint with the National Commission for the Protection of Data (CNPD) or other supervisory authority;
- If the data was not collected from the User, the information available about the origin of such data;
- Where appropriate, the existence of automated decisions, including profiling, and information on the underlying logic, as well as the importance and expected consequences of such processing for the Data Holder;
- Right to be informed of the appropriate safeguards for the transfer of data to other countries or international organizations, if applicable.
- Upon request, "Oceânico Lusoirlandês" will provide the User, free of charge, a copy of the User Data that is being processed. The supply of other copies requested by the User may entail administrative costs
9. Right of Correction of Personal Data
The User has the right to request at any given moment, the correction of inaccurate Personal Data that concerns him or her, as well as the right to have his or her incomplete Personal Data completed, including by means of an additional declaration.
In case of data correction, "Oceânico Lusoirlandês" shall notify each recipient to whom the data has been forwarded of the correction, unless such communication is considered impossible or involves a disproportionate effort by "Oceânico Lusoirlandês".
10. Right to Deletion of Personal Data (“Right to be Forgotten”)
The User has the right to obtain, from "Oceânico Lusoirlandês", the deletion of his/her Personal Data when one of the following reasons applies:
- The User Data is no longer necessary for the purpose which motivated its collection or processing;
- The User withdraws the consent on which the Data processing is based and there being no other legal basis for such processing;
- The User opposes to the processing under the right of opposition and there being no legitimate interests which justify the processing;
- In the event the Personal Data is processed unlawfully;
- In the event the Personal Data has to be deleted to comply with a legal obligation “Oceânico Lusoirlandês” may be subject to;
In accordance with the applicable legal provisions, "Oceânico Lusoirlandês" is under no obligation to delete the User Data to the extent that the treatment proves necessary to fulfill a legal obligation that "Oceânico Lusoirlandês" is subject to or for the purpose of declaring, exercising or defending a right of "Oceânico Lusoirlandês" in a legal proceeding.
In the event of deletion of the Data, "Oceânico Lusoirlandês" communicates the deletion to each recipient/entity to whom the data has been transmitted, unless such communication proves impossible or involves a disproportionate effort by "Oceânico Lusoirlandês".
When "Oceânico Lusoirlandês" has made a User's Data publicly available and is obliged to delete it under the right to deletion, "Oceânico Lusoirlandês" undertakes to ensure that such measures as are reasonable, including taking into account the available technology and the costs of its application, to inform those responsible for the effective treatment of the Personal Data that the User has requested the deletion of the links to this Personal Data, as well as copies or reproductions thereof.
11. Right of Limitation of Personal Data Processing
The User has the right to obtain from "Oceânico Lusoirlandês" the limitation of the processing of its Personal Data if one of the following situations applies (the limitation consists of inserting a mark in the stored Personal Data with the objective of limiting processing in the future):
- If contesting the accuracy of its Personal Data, during a period of time which will allow “Oceânico Lusoirlandês” to verify its accuracy;
- If the processing is unlawful and the User opposes to the deletion of the Personal Data, and requests instead the limitation of its use;
- If “Oceânico Lusoirlandês” no longer needs the User Data for processing purposes, but that data is requested by the User for the purpose of declaring, exercising or defending a right in a legal proceeding;
- If the User has opposed to the processing, until it is verified that the legitimate motives of “Oceânico Lusoirlandês” prevail over those of the User.
When User Data is subject to limitation, it may only, with the exception of storage, be processed with the consent of the User for the purpose of declaration, exercise or defense of a right in a legal proceeding, to defend the rights of another person or company, or for reasons of public interest legally established.
The User who has attained the limitation of processing of its Personal Data in the above mentioned cases will be informed by "Oceânico Lusoirlandês" before the limitation to the processing is annulled.
In case of data processing limitation, "Oceânico Lusoirlandês" will communicate to each recipient to whom the data has been transmitted of the respective limitation, unless such communication proves impossible or involves a disproportionate effort by "Oceânico Lusoirlandês".
12. Right of Portability of Personal Data
The User has the right to receive its Personal Data, which it provided to "Oceânico Lusoirlandês", in a structured format, in current use and automatic reading, and the right to transmit this Data to another Responsible for Processing, if:
- The processing is based on the consent or a contract which the User is a party to;
- The processing was carried out by automated means.
The portability right does not include inferred data or derived data, i.e. personal data generated by "Oceânico Lusoirlandês" as a consequence or result of the analysis of the data being processed.
The User has the right to have its Personal Data transmitted directly between those responsible for the processing, whenever this is technically possible.
13. Right to Oppose Processing
The User has the right to oppose, at any time, for reasons relating to its particular situation, the processing of its personal data, for the purposes of the legitimate interests pursued by "Oceânico Lusoirlandês” or when the processing is carried out for purposes other than those for which the Personal Data has been collected, including the definition of profiles, or when Personal Data is processed for statistical purposes.
"Oceânico Lusoirlandês" will stop processing the User Data, unless it presents urgent and legitimate reasons for such processing that prevail over the interests, rights and freedoms of the User, or for the purposes of declaration, exercise or defense of a right in legal proceedings.
When the User Data is processed for the purpose of direct marketing, the User has the right to oppose at any time the processing of its Personal Data for the purposes of said marketing, which includes the definition of profiles, insofar as it is related to direct marketing.
If the User opposes the processing for the purposes of direct marketing, "Oceânico Lusoirlandês" will cease the processing of Personal Data for this purpose.
The User has also the right to not be subject to any decision solely based on automated processing, including profiling, which may affect its legal position or significantly affects it in a similar way, unless:
- It is necessary for the completion of a contract between the User and "Oceânico Lusoirlandês";
- It is authorized by legislation to which "Oceânico Lusoirlandês" is subject;
- It is based on explicit consent by the User.
14. Procedure for the Exercise of Rights by the User
"Oceânico Lusoirlandês" will respond in writing (including electronic media) to the request of the User within a maximum of one month from receipt of the request, except in cases of special complexity, where this period may be extended up to two months.
If the requests presented by the User are clearly unjustified or excessive, in particular due to their repetitive nature, "Oceânico Lusoirlandês" reserves the right to charge administrative costs or refuse to comply with the request.
15. Personal Data Breaches
In the event of a breach of Personal Data and to the extent that such breach is likely to pose a high risk to the User's rights, freedoms and warranties, "Oceânico Lusoirlandês" undertakes to notify the User in question of any Personal Data breach within 72 hours of becoming aware of the incident.
In legal terms, communication to the User is not required in the following cases:
- If "Oceânico Lusoirlandês" has applied adequate technical and organizational protection measures, and these measures have been applied to the Personal Data affected by the breach of Personal Data, especially measures that make Personal Data incomprehensible to anyone not authorized to access such data, such as encryption;
- If "Oceânico Lusoirlandês" has taken subsequent measures to ensure that the high risk to the rights and freedoms of the User is no longer likely to materialize or,
- If the communication by "Oceânico Lusoirlandês" involves a disproportionate effort for "Oceânico Lusoirlandês". In this case, "Oceânico Lusoirlandês" will make a public communication or take a similar action through which the User will be informed.
C) Final Part
17. Applicable Law and Forum
18. Declaration of Consent
Published on 21-03-2016. Updated on 15-05-2018.