II. What data do we collect from our costumers and their purpose;
III. Who are the recipients of your data;
IV. Where we store your data;
V. Which rights you have when providing us with your data;
VI. How long we store your data;
IX. Collection of Data for reservation and stay or request for a Service by the customer at the accommodation;
X. Marketing actions
I. WHO IS RESPONSIBLE FOR THE PROCESSING OF YOUR DATA?
The person responsible for processing Personal Data is the commercial company ECOSURFRESORT, LDA "Bukubaki Eco Surf Resort", with the unique registration number and legal person 513148310, with registered office in Rua do Juncal, nº6, Casais de Mestre Mendo, 2525-331 ATOUGUIA DA BALEIA, Portugal.
To deal with matters/questions related to the processing of your personal data, you should get in touch with us through the following contacts:
Tel.: +351 967 138 917
Adress: Rua do Juncal, no. 6, Casais de Mestre Mendo, 2525-331 Atouguia da Baleia, Portugal.
II. WHAT DATA WE COLLECT FROM OUR COSTUMERS, HOW DO WE USE IT AND THE PURPOSE OF IT?
Our company collects the following types of personal data:
• Personal information: name, gender, nationality, data of birth and names of family members/companions and respective dates of birth and nationality, among other information;
• Information related to preferences: information related to the service being booked;
• Contact information: address, telephone number, email address, among other contacts;
• Payment information: credit card details, billing address and other payment and billing information;
• Loyalty and referral program: marketing and analytical data;
• Accommodation information: arrival and departure dates, room location, room type and bed requests, among other information;
• Comments: records of your contact with us, namely by phone or if you use our online services;
The purposes for processing personal data are as follow:
• To fulfill our costumer service obligations: managing reservations and costumer stay at our company - Bukubaki Eco Surf Resort, payments, catering services according to your requests, monitoring the use of our services (laundry, bar, among others), video surveillance in response to the contractual relationship between us and the user, such as booking a stay or requesting a service.
• Improvement and personalization of our services: evaluation of our services, improving the functioning of our activity as part of the contractual relationship between us and the user, customizing content and our experience and digital offer to the customer, understanding customer requirements for development segmented marketing programs, newsletter and promotions. We will always try to obtain and register the user's authorization to accept to participate in any marketing campaigns. Customizing our website based on your preferences is detailed in the Cookies section at the end of this policy.
• Security and video surveillance: protection of people and property.
• Sending newsletters and marketing communications: we will use your personal data to communicate with you, sending you information about our services, products and events, newsletter dissemination, promotions and invitations dissemination within the scope of the company's activity.
• Organization of events: management and organization of events, communication with third parties, payment.
• Surf: we use your data for booking, managing reservations, paying, monitoring the services provided, organizing events, etc.
• Real Estate: we ask for and use your contacts to share information with you regarding property construction and promotion.
III WHO ARE THE RECIPIENTS OF YOUR DATA?
Your personal data may be disclosed by our company, as well as ECOSURFRESORT LDA., may subcontract third parties to provide certain services. However, we emphasize that these companies will only be provided with the personal data necessary for the provision of the service in question. In these cases, these third-party companies may need to access certain information and data from the data subjects. ECOSURFRESORT LDA "Bukubaki Eco Surf Resort" guarantees that, in such cases, these third parties will have limited access to the information of the data subjects, restricted only to those data necessary for the execution of the contracted tasks and that a contract has been been entered into between the parties which regulates the protection of Personal Data, these third-party companies undertake not to reveal, in any way, Personal Data, nor to use them for purposes other than the provision of contracted services.
IV. WHERE WE STORE YOUR DATA
Data are recorded on paper and in computer systems. Our internal data retention procedures define where the data will be kept for the above purposes. Our company follows the necessary and adequate technical, electronic and organizational procedures to guarantee the security of your personal data and to prevent its loss, misuse or improper access.
V. WHICH RIGHTS YOU HAVE WHEN PROVIDING US WITH YOUR DATA?
In accordance with applicable law, our company undertakes to respect the confidentiality of your personal information and guarantee the exercise of your rights to:
a) Right to Information: our customers have the right to obtain clear, transparent and understandable information about how our company uses their personal data (article 13 RGPD - General Data Protection Regulation).
b) Right of access to information we have about the customer: in addition to the right to information, you can access your personal data that we process and keep, therefore, at any time, you can ask our company to access the information we have about you (article 15 RGPD General Data Protection Regulation).
c) Right of rectification: you have the right to rectify your personal data if they are incorrect, out of date or if you want to complete them. To do so, you can contact us for the aforementioned contacts (article 16 RGPD - General Data Protection Regulation).
d) Right of deletion or right to be forgotten: you can ask us to delete your data. The right to erase data is commonly known as the “Right to be forgotten”, therefore, the data subject has the right to obtain the erasure of his personal data from our company, without undue delay and the company has an obligation to erase his data personal, without undue delay, when one of the following reasons applies:
• Personal data are no longer necessary for the purpose for which they were collected or processed;
• The holder withdraws the consent on which the data processing is based pursuant to article 6, paragraph 1, point a), or article 9, paragraph 2, point a) of the RGPD and if not there is another legal basis for such treatment;
• The holder opposes the processing under the terms of article 21, paragraph 1 of the RGPD, and there are no prevailing legitimate interests that justify the processing, or the holder opposes the treatment under the terms of article 21, No. 2 of the RGPD;
• Personal data were processed unlawfully;
• Personal data must be erased in order to fulfill a legal obligation arising from the law of the Union or of a Member State to which the controller is subject;
•Personal data were collected in the context of the provision of information society services referred to in article 8, paragraph 1 of the RGPD ((Article 17 RGPD - General Data Protection Regulation).
e) Right of opposition, including direct marketing: You can unsubscribe from our company Newsletter or opt out of our direct marketing communications at any time. (Article 21 RGPD - General Data Protection Regulation).
f) Right to data portability: you have the right to move, copy or transfer data from our database to another (article 20 RGPD - General Data Protection Regulation).
g) Right to restriction of processing: you have the right to request restriction of the processing of your data in the following situations: if you dispute the accuracy of the data, if the processing is unlawful and you do not want to delete your data, but only limit them, if the data is no longer necessary for our company, but necessary for the customer or if you have exercised the above-mentioned right of opposition, during the period of time in which our company analyzes whether your legitimate interests for the processing prevail or not over that right . (Article 18 RGPD - General Data Protection Regulation).
h) Right to notification: The data subject has the right to be notified of any rectification, deletion or limitation of the processing that the controller has carried out as a result of a request for rectification, deletion or limitation of the processing (Art. 19º of the RGPD ).
i) Right not to be subject to autonomous decisions: The data subject has the right not to be subject to any decision taken solely on the basis of automated processing, including the definition of profiles, that produce effects in its legal sphere or that affect it significantly in a similar way (Article 22 of the RGPD).
The provisions of the previous paragraph do not apply if the decision:
• It is necessary for the conclusion or execution of a contract between the data subject and a data controller;
• Is authorized by the law of the Union or of the Member State to which the controller is subject, and in which appropriate measures are also foreseen to safeguard the rights and freedoms and legitimate interests of the data subject;
• Is based on the explicit consent of the data subject.
j) Right to be warned in case of breach of personal data: When the breach of personal data is likely to imply a high risk for the rights and freedoms of individuals, and our company will communicate the breach of personal data to the data subject without undue delay (Article 34 of the RGPD).
VI. FOR HOW LONG DO WE STORE YOUR DATA?
We only keep Personal Data for the time necessary to achieve the purpose for which it was collected, to respond to your needs or to comply with our legal obligations.
The retention period for your information will be determined based on the following criteria:
• Reasonable business needs: as long as we provide goods and services to you, or manage our relationship with you, in the context of managing our operations; and/or
• Legally reasonable periods: as long as someone can bring an action against us or as long as we have to comply with our tax and legal obligations; and/or
• Other retention periods in line with legal and regulatory guidelines and requirements.
After the above mentioned retention periods, the personal data will be deleted in a secure way.
The data owner guarantees that the Personal Data communicated to our company is correct and accurate and undertakes to notify any changes or modifications to them and assumes exclusive responsibility for damages caused by erroneous, inaccurate or incomplete data communication. The data holder is expressly warned that when disclosing Personal Data in our company's public media - Bukubaki Eco Surf Resort such as Facebook, Instagram, among other means of communication, this information may be seen and used by third parties.
A cookie is a set of information stored on the computers of users who visit certain web pages. Through cookies, websites can gather and store information about the activity and equipment of each user on the web and, depending on the type of data they contain and the way in which they are sent to the web browser, they can be used to recognize users individually. You can reset your browser to refuse all cookies or indicate when a cookie is being sent.
WHAT TYPE OF COOKIES ARE USED IN THIS WEBSITE?
• Technical Cookies
Technical cookies allow navigation on a website, platform or web application and use of different options and services, for example, control of web traffic and data transfers.
Personalization cookies allow users to access web services with certain predefined elements, established on the user's computer, based on a series of criteria; language preferences, the type of browser used to access the services, the regional configuration of the area where the service is accessed, etc.
• Analytical Cookies
Analytical cookies make it possible to track and analyze information about how users visit the various pages of the website. The data collected is used to measure activity on the page, application or web platform, etc.
• Google Analytics
This is a website reporting tool that allows you to analyze how users use our website and get there. It allows to store anonymous data on users' browsing, in order to detect the origin of visits to the website and other statistical information. Google Analytics does not store personal information about our visitors.
VIII. COLLECTION OF DATA FOR BOOKINGS AND STAYS OR ORDERING A SERVICE BY THE CUSTOMER IN THE ACCOMMODATION
The management of the contractual relationship may imply the collection for data processing, of the following types of personal data:
Personal information: name, gender, nationality, date of birth, names of the family members, and respective birth dates and nationalities, others;
Preference information: related information of the booked service;
Contact information: address, telephone number, e-mail address, others;
Loyalty program and reference: marketing and analytical data;
Accommodation information: arrival and departure dates, room location, room type and number of beds
Comments: registered communications, mainly through phone or if the online services are used.
X. MARKETING ACTIONS
In order to adapt our offer to your needs and to be able to inform you of the promotions and promotional campaigns that we periodically make available to our customers, through the various existing channels (email, messages, telephone, apps or in person) we need that confirm that you wish to continue to receive communications from us. These actions may be carried out by the controller or its subcontractors. For this purpose, your consent is asked for your personal data to be treated, in absolute confidentiality, for the indicated purpose. If you do not give your consent, we will not be able to continue to send you our communications.