The protection of individuals with regard to the processing of personal data is a fundamental right (Article 8(1) of the Charter of Fundamental Rights of the European Union and Article 16(1) of the Treaty on the Functioning of the European Union).
For that reason PBHS – Portugal Best Holiday Services, S.A. e a Lusco Fusco – Exploração Turística, S.A adopts appropriate measures to ensure the protection of your personal data, compliance with the applicable legislation, namely the Regulation (CE) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data or General Data Protection Regulation (hereafter “GDPR”).
We recommend that you read our Privacy Policy to ensure that you understand how your personal data are processed.
What is Personal Data?
Personal data is any information that relates to an identified or identifiable individual. Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal data. Examples of personal data: a name and surname, an address, an email address, an identification card number, location data, an Internet Protocol (IP) address, a cookie ID.
Who is the owner of the personal data?
The data subject is the individual to whom the data concern and who uses the website and digital platforms (Facebook, Instagram, Linkedin, among others) managed by PBHS – Portugal Best Holiday Services, S.A., as well as the products/services of Lusco Fusco – Exploração Turística, S.A.
Who is responsible for the processing of your personal data?
The data controller is PBHS – Portugal Best Holiday Services, S.A. (hereinafter “PBHS”), NIPC 513803076 and with registered office at Monte Novo Montargil, En2 7425-144 Montargil and, Lusco Fusco – Exploração Turística, S.A, (hereinafter “Lusco Fusco”), NIPC 508814472 and with registered office at Urbanização São Rafael, Lote 26, Fase 2 8200-613 Albufeira.
PBHS and Lusco Fusco shall jointly determine, on the basis of a written agreement, the purposes and means of processing your personal data.
The essence of the agreement can be consulted here.
How do we collect your personal data?
This Privacy Policy is applicable to the collection of personal data through the following channels:
- Websites managed by PBHS through which the data subject accesses this Privacy Policy;
- Social networks (Facebook, Instagram, Linkedin, among others) managed by PBHS, through which the data subject accesses this Privacy Policy;
- E-mail sent by PBHS and/or Lusco Fusco to the data subject with the link to the Privacy Policy at issue, as well as through online correspondence between the parties;
- In person when the data subject visits and/or stays at our hotel.
What categories of personal data do we process?
| Categories of personal data | Data |
| Identification data | First name, surname, ID/passport/residence permit number, photograph, TIN, NISS, date of birth, gender and nationality. |
| Contact data | Address, postcode, telephone number and e-mail address. |
| Invoicing data | IBAN, credit and/or debit card number or other payment details. |
| Image registration data | CCTV system installed in our hotels |
For what purposes and on what legal basis do we process your personal data?
PBHS and Lusco Fusco ensure that your personal data are processed, solely and exclusively, for the following purposes and on the following legal grounds:
- (a) Performance of a contract to which the data subject is party:
- Provision of hotel services and associated services (restaurants, bars, SPAs, gyms, etc.);
- Quote requests, information and booking confirmation;
- Purchase of vouchers;
- Register of preferences (type of room, mobility, newspapers/magazines, etc.);
- Customer support;
- Invoicing and accounting management;
- b) Consent by the data subject:
- Marketing (sending newsletters, campaigns, promotions and special offers);
- Profiling (assessment of personal preferences, interests, reliability and behaviour of the data subject for the purposes of improving our products and services);
- c) Compliance with legal obligations:
- Complaints management;
- Compliance with other legal or regulatory obligations;
- (d) legitimate interest of the controller:
- Protection of people and property (CCTV system installed in our hotel);
- Carrying out satisfaction surveys to improve the quality of our products and services;
- (e) pre-contractual inquiries at the request of the data subject:
- Recruitment and selection;
For how long do we keep your personal data?
Your personal data is processed by PBHS and Lusco Fusco only for the period of time strictly necessary for the fulfilment of the defined purpose or, as applicable, until you exercise your right to object, right to erasure or withdraw consent, unless specifically required by law.
Thus, taking into account the purposes of processing listed above, the retention periods are as follows:
| Purpose | Retention period |
| Provision of hotel and associated services | Duration of the contractual relationship, plus 5 (five) years counted from the check-out date |
| Request for quotation, information and booking confirmation | 1 (one) year from the date of dispatch of the reply to the request for quotation, information and/or booking confirmation |
| Voucher acquisition | 1 (one) year, counting from the date of issue of the voucher |
| Register of preferences (type of room, mobility, newspapers/magazines, etc.) | Duration of the contractual relationship, plus 5 (five) years counted from the check-out date |
| Customer service | Duration of the contractual relationship, plus 5 (five) years counted from the check-out date |
| Invoicing and accounting management | 10 (ten) years until 31/12/2013 and 12 (twelve) years as from 01/01/2014 |
| Marketing | 3 (three) years, counted from the date of the data subject’s consent |
| Profiling | 3 (three) years, counted from the date of the data subject’s consent |
| Complaints management | 3 (three) years, counted from the date of the complaint |
| Compliance with other legal or regulatory obligations | 20 (twenty) years |
| Protection of people and property (CCTV system) | 30 (thirty) days |
| Satisfaction questionnaires | 3 (three) years, as from the sending of the satisfaction questionnaire |
| Recruitment and selection | 5 (five) years, counted from the date of submission of the application or curriculum, in case the candidate is not selected, and during the period in which the professional relationship with the person responsible for the treatment is maintained, plus 5 (five) years after the termination of the employment relationship, in other cases. |
To whom do we transmit your personal data?
PBHS and Lusco Fusco do not transmit your personal data to third parties, except in cases where this is necessary for the provision of the services you have contracted or to comply with legal obligations.
The transmission of data to third parties is carried out in accordance with applicable data protection legislation and within the limits of the purposes and legal grounds defined in this Policy.
PBHS and Lusco Fusco may share personal data with the following entities:
- Public Authorities, such as the Tax Authority, regulatory authorities, police authorities, arbitral and judicial tribunals, government bodies, among others, in compliance with legal obligations;
- Commercial partners, such as tour operators, transfer and tour companies, reservation centres, among others, within the scope of the contracted services;
- Service providers who provide services to PBHS and Lusco Fusco, such as auditors, external consultants, IT services, communications services, lawyers, among others);
Where the transmission of personal data to the entities identified above involves an international transfer of data, i.e. outside the European Union, PBHS and Lusco Fusco shall ensure that:
- The transfer will take place on the basis of an adequacy decision adopted by the European Commission which ensures a level of data protection equivalent to that set out in the European legislation;
- In the absence of an adequacy decision by the European Commission, personal data will only be transferred if the third country provides adequate safeguards for protection and on condition that the data subject has enforceable rights and effective legal remedies.
The adequacy decisions can be found at www.eur-lex.europa.eu.
What are your rights and how can you exercise them?
| Rights | Definition |
| Right of Access and Right to Information | Right to obtain confirmation as to which personal data are being processed and information about them, such as the purposes of their processing, the categories of personal data concerned, the recipients or categories of recipients to whom the data have been or will be disclosed, their retention period and your rights. Upon request and without prejudice to the rights and freedoms of third parties, PBHS shall provide a copy of the personal data being processed. |
| Right of Rectification | Right to request the rectification of inaccurate personal data or to request that incomplete personal data be completed, such as address, VAT number, email address, telephone number, etc. |
| Right to Forget | Right to obtain, without undue delay, the erasure of your personal data, provided there are no valid grounds for retaining it. |
| Right to Limitation of Treatment | Right to request the limitation of the processing of your personal data, in the form of: – Suspension of processing; – Limitation of the scope of processing to certain categories of data or purposes of processing. |
| Right to Data Portability | Right to receive the data you have provided us with in a structured, commonly used and machine-readable format, as well as the right to request the direct transmission of your data to another controller, where technically possible. |
| Right of Opposition | Right to object to the processing of your personal data for reasons relating to your particular situation. |
| Right to Withdraw Consent | Right to withdraw consent to data processing at any time. Withdrawal of consent shall not affect the lawfulness of processing carried out on the basis of consent previously given. |
| Right not to be subject to a decision taken solely on the basis of automated processing | Right not to be subject to any decision taken solely on the basis of automated processing, including profiling, except where the basis for lawfulness is explicit consent, the conclusion or performance of a contract or if authorised by European Union or Member State law. |
| Right of Complaint | Right to lodge a complaint with the competent supervisory authority, the National Commission for Data Protection (CNPD), if you consider that the processing carried out on your personal data infringes your rights and/or the applicable data protection laws. |
You can exercise your rights by filling in the following form.
Is your data secure?
PBHS and Lusco Fusco adopt various security measures of a physical, technical and organisational nature in order to protect your personal data against destruction, disclosure, loss, misuse, alteration, unauthorised processing or access, as well as against any other form of accidental or illicit processing.
PBHS and Lusco Fusco have implemented the following measures:
- Physical security measures: Access control to our facilities by employees, partners and customers, as well as a very restricted and permanently guarded access to the areas exclusively assigned to our employees and technological infrastructures;
- Technical security measures: Use of firewalls and intrusion detection systems on our systems, the existence of a strict policy on access to systems and information and the recording of actions carried out by our employees on customers’ personal data (logging);
- Awareness and training of employees whose duties involve the processing of personal data;
- Scrutiny, audit and internal control measures in order to assess the effectiveness of the measures implemented;
- The use of technical means such as masking, encryption, pseudonymisation and anonymisation of personal data;
Privacy Policy Update
This Privacy Policy is periodically reviewed by PBHS and Lusco Fusco and may be updated from time to time.
The Privacy Policy was revised and published in June 2022.
