Privacy and Data Policy
IN COMPLIANCE WITH THE GENERAL REGULATION ON THE PROTECTION OF PERSONAL DATA (EU REGULATION 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL OF 04/27/2016), WE ALSO INFORM THE FOLLOWING ABOUT OUR PRIVACY POLICY:
II. What data we collect from our customers and their purpose;
III. Who are the recipients of your data;
IV. Where we store your data;
V. What are your rights when you provide us with your data;
SAW. How long we store your data;
VII. guarantees
VIII. Cookies
IX. Collection of Data for reservation and stay or request for a Service by the customer at the accommodation
X. Marketing actions
I. WHO IS RESPONSIBLE FOR PROCESSING YOUR DATA?
The company responsible for processing Personal Data is the commercial company, ECOSURFRESORT, LDA “Bukubaki”, with the unique registration number and legal person 513148310, headquartered at Rua do Juncal, n.º 6, Casais de Mestre Mendo, 2525 - 331 ATOUGUIA DA BALEIA, Portugal.
To deal with matters/issues related to the processing of your personal data, you should contact us through the following contacts:
Phone: +351 967 138 917
E-mail addresses: adm@bukubaki.com or rgpd@carlosrosario.pt
Address: Rua do Juncal, n.º 6, Casais de Mestre Mendo, 2525 - 331 ATOUGUIA DA BALEIA, Portugal.
II. WHAT DATA DO WE COLLECT FROM OUR CUSTOMERS, HOW DO WE USE THEM, AND THE PURPOSE OF THEM?
Our company collects the following types of personal data:
• Personal information: name, gender, nationality, date of birth and names of family members/companions and respective dates of birth and nationality, among other information;
• Information related to preferences: information related to the service being booked;
• Contact information: address, telephone number, email address, among other contacts;
• Payment information: credit card details, billing address and other payment and billing information; • Loyalty and referral program: marketing and analytics;
• Accommodation information: arrival and departure dates, room location, room type and bed requests, among other information;
• Comments: records of your contact with us, namely by phone, or if you use our online services;
We also limit the information collected regarding children and young people under the age of 18, to their name, nationality and date of birth, which can only be provided to us by an adult who is the minor's father, mother or guardian or who has authorization from the minors. parents or guardian. We ask parents to ensure that children do not send us or provide us with any Personal Data without parental consent, and in cases where this information has been sent, please contact us and we will delete this information. We also collect information about the use of our website through the use of cookies.
The purposes of processing personal data are as follows:
• To fulfill our customer service obligations: management of reservations and customer stay at our company - Bukubaki, payments, catering services according to your requests, monitoring the use of services (laundry, bar, etc. others), video surveillance in response to the contractual relationship between us and the user, such as booking a stay or ordering a service.
• Improving and personalizing our services: evaluating our services, improving the functioning of our activity as part of the contractual relationship between us and the user, personalizing content and our experience and digital offer to the customer, understanding customer requirements with a view to segmented development of marketing programs, newsletters and promotions. We will always seek and record the user's authorization to accept to participate in any marketing campaigns. Customizing our website based on your preferences is detailed in the Cookies section at the end of this Policy.
• Security and video surveillance: protection of people and goods
• Sending newsletters and marketing communications: we will use your personal data to communicate with you, sending you information about our services, products and events, publishing newsletters, disclosing promotions and invitations within the scope of the company's activity.
• Organization of events: management and organization of events, communication with third parties, payment.
• Surf: we use your data for booking, booking management, payment, monitoring of services provided, organization of events, etc.
• Real estate: we ask for and use your contacts to share information with you regarding the construction and promotion of real estate.
III. WHO ARE THE RECIPIENTS OF YOUR DATA?
Your personal data may be disclosed by our company, as well as ECOSURFRESORT, Lda., may subcontract third parties to provide certain services. However, we emphasize that these companies will be provided with only the personal data necessary for the provision of the service in question. In these cases, these third-party companies may need to access certain information and data of data subjects. ECOSURFRESORT, LDA “Bukubaki”. guarantees that, in such cases, these third parties will have limited access to the information of the data subjects, restricted solely to those data necessary for the performance of the contracted tasks and that a contract has been signed between the parties in which the protection of Personal Data is regulated, these third-party companies undertake not to reveal, in any way, the Personal Data, nor to use them for purposes other than the provision of contracted services.
IV. WHERE DO WE STORE YOUR DATA?
Data are recorded on paper and in computer systems. Our internal data retention procedures define where they will be stored for the purposes indicated above. Our company follows necessary and appropriate technical, electronic and organizational procedures to guarantee the security of your personal data and to prevent its loss, misuse or improper access.
V. WHAT ARE YOUR RIGHTS WHEN YOU PROVIDE US WITH YOUR DATA?
In accordance with the applicable legislation, our company undertakes to respect the confidentiality of your personal information and guarantee the exercise of your rights to:
a) Right to Information: our customers have the right to obtain clear, transparent and understandable information about how our company uses their personal data (Article 13 GDPR - General Data Protection Regulation).
b) Right of access to the information we have about the customer: in addition to the right to information, you will be able to access your personal data that we process and keep, therefore, at any time you can request our company to access the information we have about you ( Article 15 GDPR General Data Protection Regulation).
c) Right of rectification: you have the right to rectify your personal data if they are incorrect, out of date or if you want to complete them. To do so, you can contact us using the contacts mentioned above (Article 16 GDPR - General Data Protection Regulation).
d) Right to erasure or right to be forgotten: you can ask us to delete your data. The right to erase data is commonly known as the “Right to be forgotten”, therefore, the data subject has the right to obtain from our company the erasure of his personal data, without undue delay and it is obliged to erase his data personal data, without undue delay, where one of the following reasons applies:
• Personal data are no longer necessary for the purpose for which they were collected or processed;
• The holder withdraws the consent on which the processing of the data is based pursuant to article 6, paragraph 1, letter a), or article 9, paragraph 2, letter a) of the RGPD and if not there is another legal basis for said processing;
• The data subject opposes the treatment pursuant to article 21.º, paragraph 1 of the RGPD, and there are no overriding legitimate interests that justify the treatment, or the data subject opposes the treatment pursuant to article 21.º, 2 GDPR;
• Personal data was processed unlawfully;
• Personal data must be erased to comply with a legal obligation arising from EU law or a Member State law to which the controller is subject;
• The personal data were collected in the context of the provision of information society services referred to in article 8, paragraph 1 of the GDPR ((Article 17 GDPR - General Data Protection Regulation).
e) Right of opposition, including direct marketing: you can unsubscribe from our company Newsletter or opt out of our direct marketing communications at any time. (Article 21 GDPR - General Data Protection Regulation).
f) Right to data portability: you have the right to move, copy or transfer data from our database to another (Article 20 GDPR - General Data Protection Regulation).
g) Right to limit processing: you have the right to request restriction of the processing of your data in the following situations: if you dispute the accuracy of the data, if the processing is unlawful and you do not want to erase your data, but only limit them, if the data is no longer necessary for our company, but necessary for the customer or if he has exercised the aforementioned right of opposition, during the period of time in which our company analyzes whether his legitimate interests for the treatment prevail or not over that right . (Article 18 GDPR - General Data Protection Regulation).
h) Right to notification: The data subject has the right to be notified of any rectification, erasure or limitation of treatment that the controller has carried out as a result of a request for rectification, erasure or limitation of treatment (Article 19 of the RGPD ).
i) Right not to be subject to autonomous decisions: The data subject has the right not to be subject to any decision taken exclusively based on automated processing, including profiling, which has effects in its legal sphere or which affects it significantly in a similar way (Article 22 GDPR).
The provisions of the previous paragraph do not apply if the decision:
• It is necessary for the conclusion or performance of a contract between the data subject and a controller;
• Is authorized by Union or Member State law to which the controller is subject, and which also provides for adequate measures to safeguard the rights and freedoms and legitimate interests of the data subject;
• Is based on the explicit consent of the data subject.
j) Right to be notified in case of breach of personal data: When the breach of personal data is likely to imply a high risk for the rights and freedoms of natural persons, and our company will communicate the breach of personal data to the data subject without undue delay (Article 34 GDPR).
SAW. HOW LONG DO WE STORE YOUR DATA?
We only keep Personal Data for as long as necessary to achieve the purpose for which it was collected, to respond to your needs or to comply with our legal obligations.
The retention period of your information will be determined based on the following criteria:
• Reasonable needs of the activity: while we supply goods and services to the user, or manage our relationship with the user, within the scope of managing our operations; and/or
• Legally stipulated reasonable periods: for the period in which someone can bring a claim against us or for the period in which we have to comply with our tax and legal obligations; and/or
• Other retention periods in line with legal and regulatory guidance and requirements.
After the aforementioned conservation periods have expired, personal data will be securely deleted.
VII. GUARANTEES
The data subject guarantees that the Personal Data communicated to our company is certain and accurate and undertakes to notify any alteration or modification thereof and assumes sole responsibility for losses and damages caused by erroneous, inaccurate or incomplete communication of the data. The data subject is expressly warned that when revealing Personal Data in public means of our company - Bukubaki, such as Facebook, Instagram, among other means of communication, this information may be seen and used by third parties.
VIII. COOKIES
A cookie is a set of information stored on the computers of users who visit certain web pages. Through cookies, websites can gather and store information about the activity and equipment of each user on the web and, depending on the type of data they contain and how they are sent to the web browser, they can be used to recognize users individually. You can reset your browser to refuse all cookies or indicate when a cookie is being sent.
WHAT TYPES OF COOKIES ARE USED ON THIS WEBSITE?
• Technical cookies
Technical cookies allow navigation on a website, platform or web application and use of different options and services, for example, control of web traffic and data transfers.
• Personalization cookies
Personalization cookies allow users to access web services with certain predefined elements, established on the user's computer, based on a series of criteria; language preferences, the type of browser used to access the services, the regional configuration of the area where the service is accessed, etc.
• Analytics cookies
Analytical cookies allow tracking and analyzing information about how users visit the different pages of the site. The data collected is used to measure activity on the page, application or web platform, etc.
• Google Analytics
This is a reporting tool for websites that allows you to analyze how users use our website and how they get there. Allows you to store anonymous data about users' browsing, in order to detect the origin of visits to the website and other statistical information. Google Analytics does not store personal information about our visitors.
VIII. COLLECTION OF DATA FOR RESERVATION AND STAY OR REQUEST FOR A SERVICE BY THE CUSTOMER IN THE ACCOMMODATION
The management of the contractual relationship may involve the collection for data processing of the following
types of personal data:
Personal information: name, gender, nationality, date of birth and names of members of the
family and respective dates of birth and nationality, etc;
Information related to preferences: information related to the service you are using.
be reserved;
Contact information: address, telephone number, email address, etc;
Payment information: credit card details, billing address and more
payment and billing information;
Loyalty and referral program: marketing and analytics;
Accommodation information: arrival and departure dates, room location, type of
room and bed orders, etc;
Comments: records of your contact with us, namely by telephone, or if you use the
our online services.
In order to ensure compliance with contractual obligations, we need your explicit consent (this consent must be given by each person staying at our facility).
In the case of minors, consent must be given by whoever has parental authority (father, mother or legal guardian). In this way, by accepting this privacy and personal data policy, you give your consent for your personal data, related to your stay reservation or service status request, to be treated, in absolute confidentiality, for subscription and
execution of the contract. If consent is not given, no action related to the purpose identified above will be carried out, which will prevent the normal performance of the contract and may even make its continuity unfeasible.
X. MARKETING ACTIONS
In order to adapt our offer to your needs and to be able to inform you of promotions and promotional campaigns that we periodically make available to our Customers, through the various existing channels (e-mail, messages, telephone, apps or in person) we need you to
confirm with us whether you wish to continue receiving communications from us. These actions may be carried out by the controller or its subcontractors. For this purpose, you are asked for your consent for your personal data to be treated, in absolute confidentiality, for the indicated purpose. If you do not give your consent, we will not be able to continue sending you our communications.
Privacy and Personal Data Policy - applicable to Users of this Hospitality Business when making a reservation
Data Controller (we): The Hospitality Business which will provide to you, the user, the requested service. Our identification and contact details are available on the website you used to make your reservation / to pose your questions to us. They will also appear on our invoice which we'll send to you.
Data Compliance Officer: Not applicable to Data Controllers' activities.
Usuário: You, who filled-in the reservation form or any other documentation related to it.
Purpose: The purpose of processing the data provided through this form is to manage the reservations made by you, user and/or to answer to the questions / requests you posed.
Legal basis:
- Either the need to perform our contract with you, user / the need to take steps at your request prior to entering into a contract.
- Or the consent of you, the user, by ticking in the box of acceptance of the Terms and Conditions of which this Privacy and Personal Data Policy is an integral part.
Duration: We will store the data provided by you, the user, during the time necessary for the management of the reservation you made, as well as of the accommodation services you requested. Once the management is finished, your data will be kept for six (6) months. If you consent to receive marketing and/or commercial information, your data will be stored until you revoke your consent.
Processor: We engage our partner Guestcentric Group (www.guestcentric.com ) for carrying out the reservations engine of our business. Guestcentric acts under our authority and we have signed a contract with Guestcentric Group for the provision of their services. We have instructed Guestcentric Group in written as per how the processing should be done.
Data subjects different from the users: Where you, user, provide us with personal data pertaining to a different data subject from yourself, you are responsible for such acts as well as for obtaining the respective consent of such data subjects for the provisioning of their data.
Transfer of Data: We shall not transfer personal data to a third country outside the EEA (European Economic Area).
Data Subject Rights: Data Subjects can exercise their rights of access, rectification, cancellation and opposition by sending an email or through the postal service to the contact details on our reservation website and on our invoices.
Supervisory Authority: If a data subject considers their rights affected, they can also appeal to the competent supervisory authority of the Member State concerned. More info at: https://ec.europa.eu/info/law/law-topic/data-protection/data-protection-eu_en
Terms and Conditions
The purpose of the following document is to apply to the relationship between the guest/client of the tourist resort – ECOSURFRESORT, Lda., hereinafter referred to as “Bukubaki”, with NIPC 513148310 regarding the goods and services offered by it.
With regard to the terms and conditions that Bukubaki has not described, the Portuguese legislation in force will apply.
Bukubaki reserves the right to change these Terms and Conditions and other information at any time, simply posting the changes online on the website, with the guest/client being solely responsible for verifying and complying with them when of each use. Use of the website after the changes have been posted constitutes acceptance of the updated wording of the Terms and Conditions. If you do not agree with the changes made or, in general, with the Terms and Conditions, you must immediately stop using the Bukubaki website and services.
It is expressly prohibited to use the website for purposes other than those for which the website is intended, including illegal purposes or any other that may be considered harmful to the image of Bukubaki in the market. The usurpation, counterfeiting, use of usurped or counterfeit content, illegitimate identification and unfair competition are criminally punishable.
The use of services presupposes that the guest/customer accepts and validates the conditions and terms imposed by Bukubaki. (Which are automatically considered and incorporated into the contract between the client and the tourist resort, without the transition
in writing is mandatory.)
The rules relating to the use and operation of the Bukubaki are set out on the Internal Regulations website or in full at the reception. This document aims to present, in addition to the legal and regulatory provisions in force, to establish the rights and obligations of guests, implying in advance to guests / customers that, when enjoying the services of Bukubaki, the Regulation is accepted and complied with.
In order to fulfill our customer service obligations: management of reservations and customer stay at the Bukubaki, payments, catering services according to your requests, monitoring of the use of services (laundry, bar, among others ), video surveillance in response to the contractual relationship between us and the guest/customer, such as booking a stay or requesting a service, you can consult the entire Privacy and Personal Data Policy or upon request at reception.
In order to guarantee compliance with contractual obligations, we emphasize that it is necessary to give your consent to the collection of data for reservation and stay or request for a service by all customers in the accommodation.
In the case of minors, consent must be given by the person with parental authority.
The information regarding the cancellation and reservation policy can be consulted in full in the Cancellation and Reservation Policy or upon request at reception.
NATIONAL TOURISM REGISTRY
Tourist Enterprises | RNET No. 6905
Tourist Animation Agents | RNAAT No. 1005/2017