Four Views Hotels

Privacy Policy

FOUR VIEWS HOTELS GROUP

GENERAL PROVISIONS

1.1. DATA COLLECTION AND PROCESSING OF THE DATA SUBJECT

Within the area of the availability of the website www.fourviewshotels.com (Site) and hotel services, vouchers, processing and spa products, the provision of information, content, including newsletter, login areas, click2call or any telephone contacts, credit cards customer and its data subjects (Data Subject) and other entities related to it, the member entities of the Four Views Hotels Group, represented here by:

• Nóbrega & Hipólito, SA. registered at the Commercial Registry Office of Funchal under the unique registration number and legal person number 511033575 (Four Views Oásis);
• Hipólito Franco & António Nóbrega, SA. registered at the Commercial Registry Office of Funchal under the unique registration number and legal person number 511030711 (Four Views Monumental);
• Quatro Vistas, SA, registered at the Commercial Registry Office of Funchal under the unique registration number and legal person number 511264305 (Four Views Baía);

may request the data subject to provide personal data, that is, information provided by the data subject that allows the Four Views Group to identify and/or contact him (Personal Data).

As a rule, Personal Data is requested when the data subject registers on the Site, requests a contact and/or sends newsletters, subscribes to a specific service, provides or requests information, purchases a product or establishes a contractual relationship with the Four Views Group Hotels.

The Personal Data collected and processed consists essentially of information related to the name, gender, date of birth, telephone, mobile phone, email, address, tax ID number, credit card data (collected only for billing purposes), although other Personal Data may be collected that may be necessary or convenient for the provision or collection of Services by the Four Views Hotels Group.

After the collection of Personal Data, the Four Views Hotels Group provides the data subject with detailed information about the nature of the data collected and the purpose and processing that will be carried out in relation to the Personal Data, and also the information mentioned in clause 7.

The Four Views Hotels Group also collects and treats information about the characteristics of the device of your hardware and the characteristics of the browser/software, and also information about the pages visited by the data subject within the Site. This information may include your browser type, domain name, access times and links through which the data subject accessed the Site (Usability Information). We only use this information to improve the quality of your visit to our Site.

Usability Information and Personal Data are referred to in this Privacy Policy as data of the Data Subject.

For the purposes of this Privacy Policy, a contractual relationship means any and all contracts established between the Four Views Hotels Group and the entities that relate to it, regardless of the respective object.

1.2. SUBCONTRACTED ENTITIES

Within the scope of the processing of data of the data subject, the Four Views Hotels Group uses or may use third parties, subcontracted by itself, to, on behalf of the Four Views Hotels Group and according to the instructions given by the latter, proceed with the processing of the data of the data subject, according to the law and this Privacy Policy.

These subcontracted entities will not be able to transmit the data of the data subject to other entities unless the Four Views Hotels Group has previously given written authorization to do so, and they are also prevented from hiring other entities without prior authorization from the Four Views Hotels Group.

The Four Views Hotels Group is committed to subcontracting only entities that offer maximum security in the execution of the appropriate technical and organizational measures to guarantee the defence of the data subject’s rights. All entities subcontracted by the Four Views Hotels Group are linked to the latter through a written contract which regulates, namely, the object and duration of the processing, the nature and purpose of the processing, the type of personal data, the categories of data subjects and the rights and obligations of the parties.

After the collection of personal data, the Four Views Hotels Group provides the data subject with information about the categories of subcontracted entities that, in the specific case, can carry out data processing on behalf of the Four Views Hotels Group.

1.3. DATA COLLECTION CHANNELS

The Four Views Hotels Group may collect data directly (i.e., directly from the data subject) or indirectly (i.e., through partner entities or third parties). Collection can be done through the following channels:

• Direct collection: in person, for telephone, e-mail and through the Site
• Indirect collection: through partners or group companies and official entities.

2. GENERAL PRINCIPLES GOVERNING THE DATA PROCESSING OF THE DATA SUBJECT

In terms of the general principles governing the processing of personal data, the Four Views Hotels Group undertakes to ensure that the data of the data subject processed by it is:

• Object of processing according to the principles of lawfulness, fairness and transparency in relation to the data subject
• Collected for specific, objective and legitimate purposes, not subsequently being processed in a way contrary to those purposes
• Adequate, justified and limited to what is necessary in relation to the purposes for which they are processed
• Accurate and updated whenever necessary, with all necessary measures being taken so that the inaccurate data, taking into account the purposes for which they are processed, are erased or corrected without delay
• Stored in a way that allows the identification of the data subject only for the period necessary for the purposes for which the data are processed
• Processed in a way that guarantees your security, including protection against its unauthorized or illegal processing and against its loss, destruction or unforeseen damage, taking appropriate technical or organizational measures.
• Data processing by the Four Views Hotels Group is permitted and legal when at least one of the following situations occurs:
• The data subject has given the consent without any doubt to the processing of Data for one or more specific purposes
• Processing is necessary for the execution of a contract to which the data subject is a party or for pre-contractual procedures at the request of the data subject
• Processing is necessary to fulfil a legal obligation to which the Four Views Hotels Group is subject
• Processing is necessary to defend the fundamental interests of the data subject or another individual
• The processing is necessary for the purpose of the legitimate interests pursued by the Four Views Hotels Group or by third parties (except if the fundamental interests or rights and freedoms of the data subject that require the protection of personal data prevail).

The Four Views Hotels Group agrees to ensure that the processing of data of the data subject is only carried out under the conditions listed above and with respect for the principles mentioned above. When the data processing of the data subject is performed by the Four Views Hotels Group based on the data subject agreement, the data subject has the right to withdraw the consent at any time. The withdrawal of consent, however, does not compromise the legality of the processing performed by the Four Views Hotels Group based on the consent previously given by the data subject. The period of time during which data is stored and preserved varies according to the purpose for which the information is processed. Effectively, there are legal requirements that require data to be kept for a minimum period of time. Therefore, and whenever there is no specific legal obligation, the data will be stored and preserved only for the minimum period necessary for the purposes that motivated its collection or its subsequent processing, which will be deleted at the end.

3. USE AND PURPOSES OF DATA PROCESSING OF THE DATA SUBJECT

In general terms, the Four Views Hotels Group uses data of the data subject for the following purposes:

Through the website of the Four Views Group hotels, available at https://www.fourviewshotels.com/ data subject may be used for the following purposes:

The data of the data subject collected by the Four Views Hotels Group is not shared with third parties without the data subject’s consent, except for the situations referred to in the following paragraph. However, if the data subject contracts with the Four Views Hotels Group services that are provided by other entities responsible for the processing of personal data, the data of the data subject may be consulted or accessed by those entities, to the extent that this is necessary for the provision of these services.

Under the applicable legal terms, the Four Views Hotels Group may transmit or communicate the data of the data subject to other entities in the event that this transmission or communication is necessary for the performance of the contract established between the data subject and the Four Views Hotels Group or for pre-contracts proceedings at the request of the data subject, if necessary to fulfil a legal obligation to which the Four Views Hotels Group is subject or, if necessary, to obtain the legitimate interests of the Four Views Hotels Group or third parties. In the event of a transmission of the data of the data subject to third parties, reasonable efforts will be made to ensure that the transferee uses the data of the data subject transmitted in an appropriate manner with this Privacy Policy.

4. IMPLEMENTED TECHNICAL, ORGANIZATIONAL AND SECURITY MEASURES

To ensure the security of the data of the data subject and maximum confidentiality, the Four Views Hotels Group treats the information provided to us in an absolutely confidential manner, in accordance with its internal security and confidentiality policies and procedures, which are periodically updated according to the needs, and also with the terms and conditions provided.

Depending on the nature, scope, context and purposes of processing the data, and also the risks arising from the processing for the rights and freedoms of the data subject, the Four Views Hotels Group undertakes it is intended to apply, both when defining the means of processing and at the time of the processing itself, the technical and organizational measures necessary and appropriate for the protection of the data of the data subject and compliance with legal requirements.

It also undertakes to ensure that, by default, only the data that is necessary for each specific purpose of processing are processed and that these data are not made available without human intervention to an undetermined number of people.

Communication between the data subject’s device and the Four Views Hotels Group website is carried out through secure and communication channels that use the HTTPS protocol and the SSL (digital certificate) security standard.

5. TRANSFER OF DATA OUTSIDE THE EUROPEAN UNION

The personal data collected and used by the Four Views Hotels Group are not made available to third parties established outside the European Union. If, in the future, this transfer takes place for the reasons mentioned above, the Four Views Hotels Group undertakes to ensure that the transfer complies with the applicable legal provisions, namely regarding the determination of the suitability of such country with regard to data protection and the requirements for such transfers.

6. USE OF COOKIES

When you visit our Site, your consent will be required for the creation and recording on your computer of a text file (Cookie). This file will allow you to access the Site more easily and quickly, and also to personalize it according to your preferences. Most browsers accept these files (Cookies), but the data subject can delete them or automatically block them. In the Help menu of your browser you will find how to make these settings. However, if you do not allow the use of cookies, there may be some features of the Site that you will not be able to use.

RIGHTS OF DATA SUBJECTS (DATA HOLDERS)

7. RIGHT TO INFORMATION

7.1. Information provided to the data subject by the Four Views Hotels Group (when data is collected directly from the data subject):

• The identity and contacts of the Four Views Hotels Group, responsible for the processing and, if applicable, of its representative
• Contacts of the Data Protection Officer
• The purposes of the processing for which the personal data are intended, and also, if applicable, the legal reasons for the processing
• If the processing of the data is based on the legitimate interests of the Four Views Hotels Group or a third party, an indication of such interests
• If applicable, the recipients or categories of recipients of personal data
• If applicable, an indication that personal data will be transferred to a third country or an international organization and whether or not there is an adequacy decision taken by the Commission or reference to appropriate or adequate transfer guarantees
• Period of retention of personal data
• The right to request permission from the Four Views Hotels Group to personal data, and also its correction, elimination or limitation, the right to object to the processing and the right to access the data
• If the processing of data is based on the data subject’s consent, the right to withdraw it at any time, without compromising the legality of the processing carried out based on the consent previously given
• The right to file a complaint with the CNPD (base de dados de identificação civil/national identification database) or other supervisory authority
• Indication whether or not the provision of personal data constitutes a legal or contractual obligation or a necessary requirement to conclude a contract, and also whether the holder is obliged to provide personal data and the possible consequences of not providing such data
• If applicable, the existence of automatic decisions, including the definition of profiles and information related to the basic concept, and also the importance and expected consequences of such processing for the data subject.
• If the data of the data subject is not collected directly by the Four Views Hotels Group from the data subject, in addition to the information referred to above, the data subject is also informed about the categories of personal data being processed and about the origin of the data and eventually whether they are from publicly accessible sources.
• If the Four Views Hotels Group intends to proceed with the processing of the data of the data subject for a purpose other than that for which the data was collected, before that processing the Four Views Hotels Group will provide the data subject with information about that purpose and any other information of interest under the terms referred to above.

7.2. Procedures and measures implemented to fulfil the right to information.

The information referred to in 7.1. is provided in writing (including by electronic means) by the Four Views Hotels Group to the data subject prior to the processing of the personal data concerned. Under the terms of the applicable law, the Four Views Hotels Group is under no obligation to provide the data subject with the information mentioned in 7.1 when and to the extent that the data subject is already aware of it.

The information is provided by the Four Views Hotels Group at no cost.

8. RIGHT OF ACCESS TO PERSONAL DATA

The Four Views Hotels Group guarantees the means that allow the data subject to consult their Personal Data.

The data subject has the right to obtain confirmation from the Four Views Hotels Group that the personal data concerned are or are not subject to processing and, if applicable, the right to access the personal data and the following information:

• The purposes of data processing
• The categories of personal data in question
• The recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients established in third countries or belonging to international organizations
• The period of storage of personal data
• Right to request the Four Views Hotels Group to correct, delete or limit the processing of personal data or the right to prevent this processing
• Right to file a complaint with the CNPD or other supervisory authority
• If the data has not been collected from the data subject, the information available on the source of that data
• The existence of automated decisions, including the definition of profiles and information related to the underlying logic, and also the importance and expected consequences of this processing for the data subject
• Right to be informed of adequate guarantees associated with the transfer data to third countries or international organizations.
• Upon request, the Four Views Hotels Group will provide the data of the data subject, free of charge, with a copy of the data of the data subject that is being processed. The supply of other copies requested by the data subject may incur administrative costs.

9. RIGHT TO RECTIFICATION OF PERSONAL DATA

The data subject has the right to request at any time the rectification of the Personal Data, and also the right to have the incomplete personal data completed, including by means of an additional declaration.

In the event of data rectification, the Four Views Hotels Group communicates to each recipient to whom the data has been transmitted the respective rectification, unless this communication is considered impossible or implies a disproportionate effort for the Four Views Hotels Group.

10. RIGHT TO ERASURE (RIGHT TO BE FORGOTTEN)

The data subject has the right to obtain, by the Four Views Hotels Group, the erasure of the data when one of the following reasons applies:

• The data of the data subject is no longer necessary for the purpose that motivated its collection or processing
• The data subject withdraws the consent on which the processing of the data is based and there is no other legal basis for this processing
• The data subject opposes the processing under the right of opposition and there are no prevailing legitimate interests that justify the processing
• If the data of the data subject is processed illegally
• If the data of the data subject has to be erased in order to fulfil a legal obligation to which the Four Views Hotels Group is subject

Under applicable legal terms, the Four Views Hotels Group is under no obligation to delete the data of the data subject to the extent that the processing is necessary to fulfil a legal obligation to which the Four Views Hotels Group is subject or for the purposes of declaration, exercise or defence of a right of the Four Views Hotels Group in a judicial proceeding.

In the event of data deletion, the Four Views Hotels Group communicates to each recipient/entity to whom the data has been transmitted the respective deletion, unless this communication proves impossible or implies a disproportionate effort for the Four Views Hotels Group.

When the Four Views Hotels Group has made the data of the data subject public and is obliged to delete it under the right of this deletion, the Four Views Hotels Group undertakes to ensure reasonable measures, including technical measures, taking into account the available technology and the costs of its application to inform those responsible for the effective processing of personal data that the data subject has requested that they remove the links to this personal data, and also copies or reproductions thereof.

11. RIGHT OF LIMITATION FOR PROCESSING PERSONAL DATA SUBJECT

The data subject has the right to obtain, on the part of the Four Views Hotels Group, the limitation of the processing of the data of the data subject, if one of the following situations applies (the limitation is to insert a mark in the personal data stored to limit the processing in the future):

• If you dispute the accuracy of personal data, for a period that allows the Four Views Hotels Group to verify its accuracy
• If the processing is illegal and the data subject opposes the deletion of the data, requesting, on the other hand, the limitation of its use
• If the Four Views Hotels Group no longer needs the data of the data subject for processing purposes, but this data is required by the data subject for the purposes of declaring, exercising or defending a right in a judicial process
• If the data subject has opposed the processing, until it is found that the legitimate reasons of the Four Views Hotels Group prevail over those of the data subject.
• When data subject is subject to limitation, it may only, with the exception of storage, be processed with the data subject’s consent or for the purpose of declaring, exercising or defending a right in a judicial proceeding, defending the rights of another natural person or collective action or for reasons of public interest provided for by law.
• The data subject who has obtained a limitation on the processing of the data in the cases referred to above will be informed by the Four Views Hotels Group before the limitation on processing is cancelled.
• In the event of a limitation in the processing of data, the Four Views Hotels Group will notify each recipient to whom the data has been transmitted the respective limitation, unless this communication proves impossible or involves a disproportionate effort for the Four Views Hotels Group.

12. RIGHT TO PORTABILITY OF PERSONAL DATA

The data subject has the right to receive the personal data that has been provided to the Four Views Hotels Group, in a structured format, in common use and automatic reading and the right to transmit that data to another controller, if:

• The processing is based on consent or a contract to which the data subject is a party
• The processing is carried out by automated means.

The portability right does not include inferred data or derived data, i.e., personal data that is generated by the Four Views Hotels Group as a consequence or result of the analysis of the data being processed.

The data subject has the right to have the personal data transmitted directly between the data controllers, whenever this is technically possible.

13. RIGHT OF OPPOSITION TO PROCESSING

The data subject has the right to object at any time, for reasons related to the particular situation, to the processing of personal data based on the exercise of legitimate interests pursued by the Four Views Hotels Group or when the processing is carried out for purposes other than those for which personal data were collected, including the definition of profiles or when personal data are processed for statistical purposes.

The Four Views Hotels Group will finalize the processing of the data of the data subject, unless it presents urgent and legitimate reasons for this processing that prevail over the interests, rights and freedoms of the data subject or for the purposes of declaring, exercising or defending a right of the Group Four Views Hotels in a lawsuit.

When the data of the data subject is processed for the purposes of direct marketing (marketing), the data subject has the right to object at any time to the processing of data concerning him for the purposes of said marketing, which covers the definition of profiles in insofar as it relates to direct marketing. If the data subject opposes the processing of the data for the purpose of direct marketing, the Four Views Hotels Group stops processing the data for that purpose.

The data subject also has the right not to be subject to any decision taken exclusively on the basis of automated processing, including the definition of profiles, which has effects in its legal sphere or which significantly affects him in a similar way, unless the decision:

• It is necessary for the conclusion or execution of a contract between the data subject and the Four Views Hotels Group
• It is authorized by legislation to which the Four Views Hotels Group is subject
• It is based on the explicit consent of the data subject.

14. PROCEDURES TO EXERCISE THE RIGHTS OF THE DATA SUBJECT

The rights of access, rectification, elimination, limitation, portability and opposition can be exercised by the data subject through the following email: dpo@fourviewshotels.com

The Four Views Hotels Group will respond in writing (including by electronic means) to the data subject’s request within a maximum period of one month from receipt of the request, except in cases of special complexity, in which this period may be extended up to two months.

If the requests submitted by the data subject are manifestly unjustified or excessive, namely due to their repetitive nature, the Four Views Hotels Group reserves the right to charge administrative costs or refuse to proceed with the request.

15. PERSONAL DATA BREACHES

In the event of a data breach and to the extent that this breach is likely to imply a high risk to the data subject’s rights and freedoms, the Four Views Hotels Group undertakes to report the breach of personal data to the data subject concerned within 72 hours after knowledge of the incident.

Under legal terms, communication to the data subject is not required in the following cases:

• If the Four Views Hotels Group has applied adequate protection measures, both technical and organizational, and these measures have been applied to the personal data affected by the personal data breach, especially measures that make the personal data incomprehensible to any unauthorized person to access such data, as encryption
• If the Four Views Hotels Group has taken subsequent measures to ensure that the high risk to the data subject’s rights and freedoms is no longer likely to materialize
• If communication to the data subject implies a disproportionate effort for the Four Views Hotels Group. In that case, the Four Views Hotels Group will make a public communication or take a similar measure through which the data subject will be informed.

16. CHANGES TO THE PRIVACY POLICY

The Four Views Hotels Group reserves the right to change this Privacy Policy at any time. In case of modification of the Privacy Policy, the date of the last review, available at the top of this page, is also updated. If the review is substantial, a notice will be posted on the Site.

17. APPLICABLE LAW AND JURISDICTION

The Privacy Policy, and also the collection, processing or transmission of the data of the data subject, are governed by the provisions of Regulation (EU) 2016/679, of the European Parliament and of the Council, of 27 April 2016 and by the applicable laws and regulations in Portugal. This Regulation ((EU) 2016/679) took effect from 05/25/2018.

Any disputes arising from the validity, interpretation or enforcement of the Privacy Policy or which are related to the collection, processing or transmission of the data of the data subject, must be submitted exclusively to the jurisdiction of the judicial courts of the Funchal district, without prejudice to the legal rules applicable imperatives.