1.1. COLLECTION AND PROCESSING OF USER DATA

Within the scope of providing the website hosted at www.hoteldamontanha.com (“Site”), entering into any contracts, and providing information and content (collectively, the “Services”) to its users (“User”), Encantos & Emoções, Lda., with registered office at Rua Nossa Srª da Confiança, Nº 1200, 6100-532 Pedrogão Pequeno, registered with the Sertã Commercial Registry Office under the single registration and legal entity number 508 068 819 (hereinafter “Hotel da Montanha”), may request the User to provide personal data, i.e., information provided by the User that enables Hotel da Montanha to identify and/or contact them (“Personal Data”).

As a rule, Personal Data is requested when the User requests to be contacted and/or expresses an interest in working at Hotel da Montanha through unsolicited applications, applications in response to specific job opportunities that are advertised, as well as applications resulting from internship opportunities.

When collecting Personal Data, Hotel da Montanha provides the User with detailed information regarding the nature of the data collected and the purpose and processing that will be carried out in relation to the Personal Data, as well as the information referred to in clause 8.

Hotel da Montanha also collects and processes information about the User’s hardware and software, as well as information about the pages visited by the User within the Site. This information may include: browser type, domain name, access times and the hyperlinks through which the User accessed the Site (“Usability Information”). We use this information solely to improve the quality of your visit to our Site.

Usability Information and Personal Data are referred to in this Privacy Policy as “User Data”.

1.2. PROCESSORS

Within the scope of processing User Data, Hotel da Montanha uses or may use third parties, contracted by it, to process User Data on behalf of Hotel da Montanha and in accordance with the instructions provided by Hotel da Montanha, in strict compliance with the law and this Privacy Policy.

These processors may not transmit User Data to other entities without Hotel da Montanha’s prior written authorisation, and are also prohibited from engaging other entities without Hotel da Montanha’s prior authorisation.

Hotel da Montanha undertakes to engage only entities that provide sufficient guarantees regarding the implementation of appropriate technical and organisational measures in order to safeguard the User’s rights. All entities contracted by Hotel da Montanha are bound to it by a written agreement regulating, in particular, the subject matter and duration of the processing, the nature and purpose of the processing, the type of personal data, the categories of data subjects and the rights and obligations of the parties.

When collecting personal data, Hotel da Montanha provides the User with information regarding the categories of processors that may, in the specific case, process data on behalf of Hotel da Montanha.

1.3. DATA COLLECTION CHANNELS

Hotel da Montanha may collect data directly (i.e., directly from the User) or indirectly (i.e., through partner entities or third parties). Data may be collected through the following channels:

Direct collection: in person, by telephone, by e-mail and through the Site;

Indirect collection: through partners or group companies and official entities.

2. GENERAL PRINCIPLES APPLICABLE TO THE PROCESSING OF USER DATA

With regard to the general principles relating to the processing of personal data, Hotel da Montanha undertakes to ensure that the User Data it processes is:

• Processed lawfully, fairly and transparently in relation to the User;
• Collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes;
• Adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed;
• Accurate and kept up to date whenever necessary, with all appropriate measures being taken to ensure that inaccurate data, having regard to the purposes for which it is processed, is erased or rectified without delay;
• Kept in a form that permits identification of the User only for as long as necessary for the purposes for which the data is processed;
• Processed in a manner that ensures its security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

The processing of data carried out by Hotel da Montanha is lawful when at least one of the following situations applies:

• The User has given explicit consent to the processing of User Data for one or more specific purposes;
• The processing is necessary for the performance of a contract to which the User is a party, or in order to take pre-contractual steps at the User’s request;
• The processing is necessary for compliance with a legal obligation to which Hotel da Montanha is subject;
• The processing is necessary in order to protect the vital interests of the User or another natural person;
• The processing is necessary for the purposes of the legitimate interests pursued by Hotel da Montanha or by third parties (except where such interests are overridden by the interests or fundamental rights and freedoms of the User which require protection of personal data).

Hotel da Montanha undertakes to ensure that User Data is processed only under the conditions listed above and in compliance with the aforementioned principles.

Where the processing of User Data is carried out by Hotel da Montanha on the basis of the User’s consent, the User has the right to withdraw their consent at any time. The withdrawal of consent shall not, however, affect the lawfulness of processing carried out by Hotel da Montanha based on consent given before its withdrawal.

The period for which data is stored and retained varies according to the purpose for which the information is processed.

There are legal requirements that require data to be retained for a minimum period. Therefore, whenever there is no specific legal requirement, data will be stored and retained only for the minimum period necessary for the purposes that led to its collection or subsequent processing, after which it will be deleted.

3. USE AND PURPOSES OF USER DATA PROCESSING

In general terms, Hotel da Montanha uses User Data for the following purposes:

• User contact requests;
• Selection and Recruitment in connection with advertised opportunities, unsolicited applications submitted by Users, as well as advertised internship opportunities.
• Ensuring that the Site meets the User’s needs by developing and publishing content that is as closely tailored as possible to requests and User type, improving the Site’s search capabilities and functionalities, and obtaining aggregated or statistical information regarding the typical User profile (consumer profile analysis);

User Data collected by Hotel da Montanha is not shared with third parties without the User’s consent, except in the situations referred to in the following paragraph. However, where the User contracts services from Hotel da Montanha that are provided by other entities responsible for processing personal data, User Data may be consulted or accessed by those entities to the extent necessary for the provision of those services.

Under applicable law, Hotel da Montanha may transmit or disclose User Data to other entities where such transmission or disclosure is necessary for the performance of the contract entered into between the User and Hotel da Montanha, or in order to take pre-contractual steps at the User’s request, where necessary for compliance with a legal obligation to which Hotel da Montanha is subject, or where necessary for the purposes of pursuing the legitimate interests of Hotel da Montanha or a third party. Where User Data is transmitted to third parties, reasonable efforts will be made to ensure that the recipient uses the transmitted User Data in a manner consistent with this Privacy Policy.

4. TECHNICAL, ORGANISATIONAL AND SECURITY MEASURES IMPLEMENTED

To ensure the security of User Data and maximum confidentiality, Hotel da Montanha processes the information provided to us in a strictly confidential manner, in accordance with its internal security and confidentiality policies and procedures, which are periodically updated according to requirements, as well as in accordance with the legally established terms and conditions.

Taking into account the nature, scope, context and purposes of data processing, as well as the risks arising from processing to the User’s rights and freedoms, Hotel da Montanha undertakes to implement, both when determining the means of processing and at the time of the processing itself, the technical and organisational measures necessary and appropriate for the protection of User Data and compliance with legal requirements.

It also undertakes to ensure that, by default, only data necessary for each specific processing purpose is processed and that such data is not made available, without human intervention, to an indefinite number of persons.

In terms of general measures, Hotel da Montanha adopts the following:

• Regular audits to assess the effectiveness of the technical and organisational measures implemented;
• Awareness-raising and training of personnel involved in data processing operations;
• Pseudonymisation and encryption of personal data;
• Mechanisms capable of ensuring the ongoing confidentiality, availability and resilience of information systems;
• Mechanisms ensuring the timely restoration of information systems and access to personal data in the event of a physical or technical incident;

5. TRANSFER OF DATA OUTSIDE THE EUROPEAN UNION

Personal data collected and used by Hotel da Montanha is not made available to third parties established outside the European Union. If such a transfer occurs in the future for the reasons referred to above, Hotel da Montanha undertakes to ensure that the transfer complies with applicable legal provisions, particularly regarding the determination of the adequacy of the country concerned in terms of data protection and the requirements applicable to such transfers.

6. USE OF COOKIES

Cookie Policy

By browsing our Site, you allow the collection and storage of small text files known as cookies, which contain information and are downloaded to Users’ computers or other devices through a server. These text files enable a more personalised and efficient browsing experience.

On each visit to the Site, your internet browser sends these cookies back to the Site, enabling the recognition and memorisation of Users’ identities, as well as their usage preferences.

• What are Cookies?

“Cookies” are small software files that are stored on your device through your browser, retaining information relating to the status of your browsing session as well as recording the User’s browsing activity. They may also be used to remember information relating to the User that was previously entered on the website.

• What types of Cookies are used?

Necessary Cookies to:

• Enable navigation on the Site;
• Make use of its functionalities, namely accessing secure areas and content exclusively available to registered Users.

Functional Cookies to:

• Store information about our Users’ choices;
• Allow us to customise our Site according to their needs, namely by remembering their preferred language.

Performance Cookies to:

• Monitor how individual Users access our Site and how frequently they do so.

Session Cookies to:

• Be used for the booking process, since these types of cookies are more secure and cannot be manipulated by third parties.

We also use analytics services, directly or indirectly, to assess the effectiveness of our content and Users’ preferences, enabling us to contribute to optimising the operation of this Site.

We also use web beacons or tracking pixels to anonymously count the number of visitors to our Site without identifying any particular User. However, for registered Users who are logged into the Site, we will combine this information with data collected via cookies in order to analyse in greater detail how Users browse this Site.

• Browser controls:

The vast majority of browsers allow Users to view stored cookies as well as delete or block them.

Whenever cookies are deleted, some Site functionalities may be affected.

If you would like to learn more about how Cookies work, you can visit the AboutCookies.org or Cookiecentral.com websites.

• Cookie Security:

Since Cookies may be intercepted or altered, the following security measures are taken:

• Sensitive information such as passwords or personal data such as the customer’s address or telephone number is not stored;
• No unsecured requests (HTTP) are sent in which cookies are transmitted to the browser in plain text and could therefore be intercepted.

7. TOOLS USED BY THE SITE FOR STATISTICAL ANALYSIS AND USER BEHAVIOUR ANALYSIS.

Google Analytics

The Site uses Google Analytics, a web analytics service provided by Google. Cookies will be stored that provide information about the use and navigation of the Site. This data, including the User’s IP address, is transmitted to Google’s servers; however, it is not associated with any other data held by Google.

The User may disable the tool by downloading and installing a browser add-on available from Google: https://tools.google.com/dlpage/gaoptout?hl=en

Facebook and Instagram:

The Site provides interaction with Facebook and Instagram through a connection to the servers of these social networks. This will enable them to identify the website the User is visiting and possibly store other data, such as the IP address.

If the User is logged into Facebook and/or Instagram, the data will be associated with their accounts. To prevent this, the User should log out of Facebook and Instagram before visiting the page.

Information regarding the processing of data carried out by these social networks is available at: https://www.facebook.com/about/privacy/ https://help.instagram.com/519522125107875

Twitter

The Site provides interaction with Twitter through the respective button, establishing a connection to Twitter’s servers, which will identify the Site the User is visiting and may store other data, such as the IP address.

Further information about how Twitter processes data is available at: https://twitter.com/privacy

B. USERS’ RIGHTS (DATA SUBJECTS)

8. RIGHT TO INFORMATION

8.1. Information provided to the User by Hotel da Montanha (when data is collected directly from the User):

• The identity and contact details of Hotel da Montanha, the data controller and, where applicable, its representative;
• The contact details of the Data Protection Officer;
• The purposes for which the personal data is intended to be processed and, where applicable, the legal basis for the processing;
• Where data processing is based on the legitimate interests of Hotel da Montanha or a third party, an indication of those interests;
• Where applicable, the recipients or categories of recipients of the personal data;
• Where applicable, an indication that personal data will be transferred to a third country or international organisation, and the existence or absence of an adequacy decision adopted by the Commission or reference to appropriate or suitable transfer safeguards;
• The retention period for personal data;
• The right to request from Hotel da Montanha access to personal data, as well as its rectification, erasure or restriction, the right to object to processing and the right to data portability;
• Where data processing is based on the User’s consent, the right to withdraw consent at any time, without affecting the lawfulness of processing carried out on the basis of consent previously given;
• The right to lodge a complaint with the CNPD or another supervisory authority;
• An indication as to whether the provision of personal data constitutes a legal or contractual obligation, or a requirement necessary to enter into a contract, as well as whether the data subject is required to provide the personal data and the possible consequences of failing to provide such data;
• Where applicable, the existence of automated decision-making, including profiling, and information concerning the underlying logic, as well as the significance and envisaged consequences of such processing for the data subject.
• Where User Data is not collected directly by Hotel da Montanha from the User, in addition to the information referred to above, the User is also informed about the categories of personal data being processed, as well as the source of the data and, where applicable, whether it originated from publicly accessible sources.
• Where Hotel da Montanha intends to further process User Data for a purpose other than that for which the data was collected, before such processing Hotel da Montanha will provide the User with information about that other purpose and any other relevant information, under the terms referred to above.

8.2. Procedures and measures implemented to comply with the right to information.

The information referred to in 8.1. is provided in writing (including by electronic means) by Hotel da Montanha to the User prior to the processing of the personal data concerned. Under applicable law, Hotel da Montanha is not required to provide the User with the information referred to in 8.1 where and to the extent that the User already has such information.

The information is provided by Hotel da Montanha free of charge.

9. RIGHT OF ACCESS TO PERSONAL DATA

Hotel da Montanha guarantees the means enabling the User to access their Personal Data.

The User has the right to obtain confirmation from Hotel da Montanha as to whether or not personal data concerning them is being processed and, where that is the case, the right to access their personal data and the following information:

• The purposes of the data processing;
• The categories of personal data concerned;
• The recipients or categories of recipients to whom the personal data has been or will be disclosed, particularly recipients established in third countries or belonging to international organisations;
• The retention period for the personal data;
• The right to request from Hotel da Montanha the rectification, erasure or restriction of the processing of personal data, or the right to object to such processing;
• The right to lodge a complaint with the CNPD or another supervisory authority;
• Where the data has not been collected from the User, any available information as to its source;
• The existence of automated decision-making, including profiling, and information concerning the underlying logic, as well as the significance and envisaged consequences of such processing for the data subject;
• The right to be informed about the appropriate safeguards associated with the transfer of data to third countries or international organisations.

Upon request, Hotel da Montanha will provide the User, free of charge, with a copy of the User Data undergoing processing. The provision of additional copies requested by the User may be subject to administrative costs.

10. RIGHT TO RECTIFICATION OF PERSONAL DATA

The User has the right to request, at any time, the rectification of their Personal Data and also has the right to have incomplete personal data completed, including by means of a supplementary statement.

In the event of data rectification, Hotel da Montanha shall communicate the relevant rectification to each recipient to whom the data has been disclosed, unless such communication proves impossible or involves disproportionate effort for Hotel da Montanha.

11. RIGHT TO ERASURE OF PERSONAL DATA (“RIGHT TO BE FORGOTTEN”)

The User has the right to obtain from Hotel da Montanha the erasure of their data where one of the following grounds applies:

• The User Data is no longer necessary in relation to the purposes for which it was collected or processed;
• The User withdraws the consent on which the processing is based and there is no other legal ground for the processing;
• The User objects to the processing pursuant to the right to object and there are no overriding legitimate grounds for the processing;
• The User Data has been unlawfully processed;
• The User Data must be erased for compliance with a legal obligation to which Hotel da Montanha is subject;

Under applicable law, Hotel da Montanha is not required to erase User Data to the extent that processing is necessary for compliance with a legal obligation to which Hotel da Montanha is subject or for the establishment, exercise or defence of a legal claim by Hotel da Montanha in judicial proceedings.

In the event of data erasure, Hotel da Montanha shall communicate the relevant erasure to each recipient/entity to whom the data has been disclosed, unless such communication proves impossible or involves disproportionate effort for Hotel da Montanha.

Where Hotel da Montanha has made User Data public and is obliged to erase it pursuant to the right to erasure, Hotel da Montanha undertakes to take reasonable measures, including technical measures, taking into account available technology and the cost of implementation, to inform the controllers actually processing the personal data that the User has requested the erasure of any links to, or copies or replications of, such personal data.

12. RIGHT TO RESTRICTION OF PROCESSING OF PERSONAL DATA

The User has the right to obtain from Hotel da Montanha restriction of the processing of User Data where one of the following situations applies (restriction consists of marking stored personal data with the aim of limiting its processing in the future):

• If the User contests the accuracy of the personal data, for a period enabling Hotel da Montanha to verify its accuracy;
• If the processing is unlawful and the User opposes the erasure of the data and requests the restriction of its use instead;
• If Hotel da Montanha no longer needs the User Data for processing purposes, but the data is required by the User for the establishment, exercise or defence of a legal claim in judicial proceedings;
• If the User has objected to processing, pending verification as to whether the legitimate grounds of Hotel da Montanha override those of the User.

Where User Data is subject to restriction, such data may, with the exception of storage, only be processed with the User’s consent or for the establishment, exercise or defence of a legal claim in judicial proceedings, for the protection of the rights of another natural or legal person, or for legally established reasons of public interest.

A User who has obtained restriction of the processing of their data in the cases referred to above shall be informed by Hotel da Montanha before the restriction of processing is lifted.

In the event of restriction of data processing, Hotel da Montanha shall communicate the relevant restriction to each recipient to whom the data has been disclosed, unless such communication proves impossible or involves disproportionate effort for Hotel da Montanha.

13. RIGHT TO PERSONAL DATA PORTABILITY

The User has the right to receive the personal data concerning them that they have provided to Hotel da Montanha, in a structured, commonly used and machine-readable format, and has the right to transmit that data to another controller, if:

• The processing is based on consent or on a contract to which the User is a party;

and

• The processing is carried out by automated means.

The right to portability does not include inferred or derived data, i.e., personal data generated by Hotel da Montanha as a consequence or result of analysing the data being processed.

The User has the right to have personal data transmitted directly between controllers, where technically feasible.

14. RIGHT TO OBJECT TO PROCESSING

The User has the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them where such processing is based on the legitimate interests pursued by Hotel da Montanha or where processing is carried out for purposes other than those for which the personal data was collected, including profiling, or where personal data is processed for statistical purposes.

Hotel da Montanha shall cease processing User Data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the User, or for the establishment, exercise or defence of a legal claim by Hotel da Montanha in judicial proceedings.

Where User Data is processed for direct marketing purposes, the User has the right to object at any time to the processing of data concerning them for such marketing purposes, including profiling to the extent that it is related to such direct marketing. Where the User objects to the processing of their data for direct marketing purposes, Hotel da Montanha shall cease processing the data for that purpose.

The User also has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, unless the decision:

• Is necessary for entering into or performing a contract between the User and Hotel da Montanha;
• Is authorised by legislation to which Hotel da Montanha is subject; or
• Is based on the User’s explicit consent.

15. PROCEDURES FOR THE EXERCISE OF USERS’ RIGHTS

The right of access, right to rectification, right to erasure, right to restriction, right to portability and right to object may be exercised by the User by sending an e-mail to [protecaodados@hoteldamontanha.com](mailto:protecaodados@hoteldamontanha.com)

For further questions relating to data protection matters, please contact Hotel da Montanha’s Data Protection Officer by e-mail at [protecaodados@hoteldamontanha.com](mailto:protecaodados@hoteldamontanha.com) or by registered letter to Rua Nossa Srª da Confiança, Nº 1200, 6100-532 Pedrogão Pequeno.

Hotel da Montanha shall respond in writing (including by electronic means) to the User’s request within a maximum period of one month from receipt of the request, except in particularly complex cases, in which case this period may be extended by up to two months.

If requests submitted by the User are manifestly unfounded or excessive, particularly due to their repetitive nature, Hotel da Montanha reserves the right to charge administrative costs or refuse to act on the request.

16. PERSONAL DATA BREACHES

In the event of a data breach and to the extent that such breach is likely to result in a high risk to the User’s rights and freedoms, Hotel da Montanha undertakes to communicate the personal data breach to the User concerned within 72 hours of becoming aware of the incident.

Under applicable law, communication to the User is not required in the following cases:

• Where Hotel da Montanha has implemented appropriate technical and organisational protection measures and those measures have been applied to the personal data affected by the personal data breach, in particular measures that render the personal data unintelligible to any person who is not authorised to access it, such as encryption;
• Where Hotel da Montanha has taken subsequent measures which ensure that the high risk to the User’s rights and freedoms is no longer likely to materialise; or
• Where communication to the User would involve disproportionate effort for Hotel da Montanha. In such a case, Hotel da Montanha shall instead issue a public communication or take a similar measure whereby the User is informed.

C. FINAL PART

17. CHANGES TO THE PRIVACY POLICY

Hotel da Montanha reserves the right to amend this Privacy Policy at any time. In the event of an amendment to the Privacy Policy, the date of the latest amendment, available at the top of this page, will also be updated. If the amendment is substantial, a notice will be posted on the Site.

18. APPLICABLE LAW AND JURISDICTION

The Privacy Policy, as well as the collection, processing or transmission of User Data, is governed by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 and by the legislation and regulations applicable in Portugal.

Any disputes arising from the validity, interpretation or enforcement of the Privacy Policy, or relating to the collection, processing or transmission of User Data, shall be submitted exclusively to the jurisdiction of the judicial courts of the district of Lisbon, without prejudice to any applicable mandatory legal provisions.