I. INTRODUCTION
This Privacy Policy is intended to provide users of the website hosted at
www.alfagar.com, hereinafter in abbreviated form (“Site”).
The purpose of this document is to provide a concise policy statement on the data
protection obligations to be implemented in all companies that make up and are
part of the Alfagar Aparthotels & Resorts Group (hereinafter “Alfagar Group”). This
policy includes the Alfagar Group's obligations regarding personal data processing
operations, in order to guarantee compliance with the requirements of the relevant
legislation, with a view to adapting efforts in relation to a reality in continuous
change, to face the most relevant.
To provide services and related communications, the hotel units use shared services
within the scope of the Alfagar Group, as such, the data collected and subject to
processing operations within the scope of the hotel and communication services
provided will be co-responsible for the processing. the following entities,
constituents of the Alfagar Group:
– ALGAROSA – Sociedade Gestora de Hotéis, S.A.
- Denominação comercial: Alfagar Village
Alfagar Aparthotel
Alfagar Cerro de Malpique
Alfagar Prestige
Balaia Plaza
- SOCIEDADE HOTELEIRA DE ALFAGAR, S.A.
- SILATLANTIS – Empreendimentos Turísticos e Imobiliários, S.A.
As a rule, Personal Data is requested when the user registers or browses the
Website, requests contact and/or sending newsletters, interacts with the chat,
subscribes to a specific product or service, provides or requests information,
adheres to the “A Club” loyalty from the Alfagar Group, purchase a product or
establish a contractual relationship with the Alfagar Group through a reservation for
a stay in one of our hotel establishments.
PRIVACY POLICY
II. RATIONALE
The Alfagar Group complies with the data protection principles established in
current legislation.
This Policy applies to all personal data processing operations, including their
collection, processing and storage by all Alfagar Group companies in relation to their
employees, service providers and customers, in the course of their respective
activity.
III. SCOPE
This Policy covers all personal data, including data relating to special categories of
personal data, processed in relation to data subjects by the Alfagar Group, whether
as a Data Controller or a Data Processor.
This Policy also applies to personal data processed manually, provided that it is
included in a structured file.
All personal data relating to special categories of personal data will be processed
with particular care by the Alfagar Group. Both categories will also be referred to as
“Personal Data” in this Policy, unless otherwise stated.
The Personal Data collected and processed consists essentially of information
relating to name, gender, date of birth, telephone number, mobile number, email
address, postal address, identification and tax document numbers, and credit card
details (collected solely for payment purposes), although other Personal Data may
be collected that may be necessary or convenient for the provision or billing of
services by the Alfagar Group.
Usability Information and Personal Data are referred to in this Privacy Policy as
“user data”
.
The Alfagar Group also collects and processes information about your hardware
device specifications, your IP address and browser/software specifications, as well
as information about the pages you visit on the Website. This information may
include your browser type, domain name, access times and the links through which
you accessed the Website (“Usage Information”). We use this information to improve
the quality of your visit to our Website and, where you consent, to analyse your user
profile and browsing habits on the Website, measure the effectiveness of advertising
on the Website, and send you commercial and marketing information tailored to
your profile.
For the purposes of this Privacy Policy, a contractual relationship is understood to
mean any and all contracts established between the Alfagar Group and the entities
with which it has a relationship, regardless of their subject matter.
IV. WHO PERFORMS PROCESSING OPERATIONS ON THE DATA
In the course of their daily activities, Alfagar Group companies may acquire, process
and store Personal Data.
In accordance with European and Portuguese data protection legislation, this data
must be acquired and managed in a lawful, fair and transparent manner.
The Alfagar Group is committed to ensuring that its team has sufficient knowledge
of data protection legislation and practices in order to be able to anticipate and
identify any data protection issues that may arise.
In these circumstances, the team must ensure that the Data Controller is informed,
ensuring that all appropriate and necessary corrective actions will be taken, in order
to guarantee the rights, freedoms and guarantees of Data Subjects.
The Alfagar Group may share Personal Data of Data Subjects with Subcontractors as
long as necessary for the normal provision of its services.
Subcontractors' access to Personal Data shared by the Alfagar Group is regulated,
within the scope of the Alfagar Group's obligations, by the contract signed with its
Subcontractors.
In this sense, the Alfagar Group contractually ensures and regularly verifies that the
Subcontractors are reliable entities that offer adequate protection guarantees, with
no data being transmitted to them beyond what is necessary to provide the
contracted service.
In the course of its role as Data Controller, the Alfagar Group may also share the
Personal Data of Data Subjects with other Data Controllers, in order to carry out the
processing operations necessary to provide the contracted services.
Within the scope of the aforementioned joint responsibility, the Alfagar Group
enters into an agreement with the other controller, under which the respective
purposes and responsibilities in complying with current data protection legislation
are transparently identified, guaranteeing compliance with the Rights and Freedoms
of Data Subjects through the establishment of adequate communication channels to
respond to Data Subjects' requests.
Regardless of the relationship existing between the Recipients of Personal Data, the
Alfagar Group defines, through a formal and written contract, the delimitation of
obligations in matters of Personal Data, the specific purpose or purposes for which
they are involved and the understanding that they carry out the data processing
operations in accordance with Portuguese Data Protection Legislation.
V. DATA RECIPIENTS
The data collected by the Alfagar Group is not shared with third parties without the
user's consent, with the exception of the situations referred to in the following
paragraph. However, if the user contracts with the Alfagar Group for services that
are provided by other entities responsible for the processing of personal data, the
data may be transmitted and/or accessed by these entities, to the extent that this is
necessary for the provision of the said services.
Under applicable legal terms, the Alfagar Group may transmit or communicate data
to other entities if such transmission or communication is necessary for the
execution of the contract established between the user and the Alfagar Group, or
for pre-contractual measures at the user's request. , if it is necessary to comply with
a legal obligation to which the Alfagar Group is subject or if it is necessary to fulfill
the legitimate interests of the Alfagar Group or third parties. If data is transmitted
to third parties, reasonable efforts will be made to ensure that the transmitter uses
the transmitted data in accordance with this Privacy Policy.
If the user makes a reservation to stay at one of our hotel units, their personal data
will be processed for the purposes of subscribing to and managing the assistance
insurance available to all customers during their stay at the Alfagar Group units.
For these purposes, the Alfagar Group will transmit to the Insurer, which will act as
Data Controller, the following personal data: full name, nationality, date of birth,
Passport or Citizen Card number, country of origin, date of check-in, check-out date.
Your data may be shared with the following Recipients:
Providers of IT, technical and operational support services;
Alfagar Group entities;
Entities related to, or with common management with, the Alfagar Group;
Entities to which Alfagar Group companies provide services;
Judicial bodies, Criminal Police bodies and Administrative Authorities
VI. SUBCONTRACTING ENTITIES
In the context of the processing of personal data, the Alfagar Group or may use
third parties, subcontracted by it, to, on its behalf, and in accordance with its
instructions, process personal data, in accordance with applicable legislation and of
this Privacy Policy.
These subcontracted entities will not be able to transmit the data to other entities
without the Alfagar Group having previously given written authorization to do so.
The Alfagar Group is committed to subcontracting only entities that offer maximum
security in carrying out appropriate technical and organizational measures, in order
to guarantee the defense of the rights of data subjects. All entities subcontracted by
the Alfagar Group are bound to the latter through a written agreement regulating,
in particular, the object and duration of the processing, the nature and purpose of
the processing, the type of personal data, the categories of holders of data and the
rights and obligations of the parties and other requirements set out in article 28 of
the GDPR.
In accordance with the duty of information to which the Alfagar Group is obliged,
the following are the categories of subcontractors to which the personal data of
website users and Alfagar Group customers are communicated:
Categories of subcontracted entities: Purposes of personal data processing:
Licensing, maintenance, support and technical
assistance companies of software and system
Management / maintenance / support for systems
and software that support the Alfagar Group’s
activity;
Companies processing payment services, EDI and
electronic invoicing services, accounting, tax and
administrative management and activity support
software;
Economic and accounting management of customer,
supplier and service provider invoicing
Commercial promoters; Promotion / Sale of Alfagar Group services;
Direct marketing support companies / digital
marketing partners;
Assistance in managing the sending of email
marketing, analysis of performance and user profiles
and the impact and dissemination of advertising;
Customer satisfaction assessment companies; Sending customer evaluation questionnaires;
Security/surveillance companies and preventive and
corrective maintenance companies for security
systems;
Video surveillance and surveillance for the safety of
people and property;
Guests' stays management companies;
Provision of services associated with customer stays
in the various commercial establishments of the
Alfagar Group;
Companies providing support on Customer Service. Customer service and contact services.
Recipient Categories Purposes of personal data processing
Temporary employment companies; Temporary assignment of workers;
Companies to which the operation of commercial
establishments on Alfagar Group facilities is granted:
Supplementary and support services provided to
customers;
Insurance Companies; Customer Assistance Insurance;
Companies providing various services during the
guest's stay at Alfagar Group facilities;
Parking, car rental and garden maintenance services;
Social media; Marketing campaigns;
Travel agencies and tour operators; Reservations of stays and provision of hotel services;
Consultants and Lawyers; Provision of consultancy and legal services;
Companies providing additional services requested
by customers;
Taxi / Transfer services, parking, rent-a-car,
restaurant reservations and other activities at the
customer's request;
VII. THIRD PARTY ENTITIES
The Alfagar Group may also communicate to other third parties not qualified as
subcontractors under article 4, paragraph 8 of the GDPR. These entities are subject
to confidentiality, and they have all assumed the guarantee that they process
personal data in accordance with the provisions of the GDPR.
The Alfagar Group communicates the data to other recipients in detail:
Data collection channels
The Alfagar Group may collect data directly (i.e., directly from the user) or indirectly
(i.e., through partner entities or third parties).
Collection can be made through the following channels:
Direct collection: in person, by telephone, by email and via the Website;
Indirect collection: through partners or group companies and official entities.
VIII. WHAT THE ALFAGAR GROUP DOES WITH THE DATA
As Data Controller, the Alfagar Group guarantees that all Personal Data:
They will be obtained for specific, lawful and clearly defined purposes, with the
Data Holder having the right to question the purpose(s) for which the Alfagar
Group collects and maintains it, and must the Alfagar Group informs clearly and
precisely what its purpose or purposes are;
They will be compatible with the purposes for which they were acquired;
They will be maintained with appropriate security measures - implemented or to
be implemented - to protect against unauthorized access, or against the
alteration, destruction or disclosure of any Personal Data held by the Alfagar
Group as Data Controller;
Will be maintained accurately, completely and updated, when necessary;
They will be collected in a limited way and kept only for the time strictly
necessary, without excessive data being collected and/or processed.
The Alfagar Group has therefore put in place a procedure for responding to
requests from data subjects, in order to handle such requests efficiently and
appropriately, within the timeframes set out in the legislation.
The Alfagar Group has implemented, or is in the process of implementing, the
applicable security and data protection standards, as well as technical and
organisational measures to protect personal data against disclosure, loss, misuse,
alteration, unauthorised processing or access, and against any other form of
unlawful processing.
All Alfagar Group Employees are also subject to confidentiality rules.
Alfagar Group may combine Usability Information with anonymous demographic
information for research purposes, and may use the results of this combination to
provide more relevant content on the Site.
With the user's consent, in certain restricted areas of the Site, the Alfagar Group
may combine Personal Data with Usability Information to provide you with more
personalized content.
IX. PURPOSES AND BASIS OF THE LEGALITY OF PROCESSING OPERATIONS:
Customers
The Alfagar Group carries out processing operations in relation to the Personal
Data of its Customers to guarantee compliance with the service provision contract
agreed with the Data Subjects or with the Joint Data Controllers (in relation to the
data and Data Subjects collected by them, such as counterparties, workers and
others).
The personal data now identified and subject to processing operations are in a
situation of necessity for the execution of a contract or for pre-contractual measures
or for the fulfillment of legal obligations, or in the case of marketing, they may be
under consent.
Special Category data relating to Customers, or obtained through Customers, will be
subject to appropriate processing operations, to the extent necessary for reasons of
important public interest such as the prevention of money laundering and terrorist
financing.
The processing of Personal Data of Customers or obtained through Customers,
related to criminal convictions and infractions or related security measures will
always be subject to adequate guarantees to protect the rights and freedoms of Data
Subjects, with operations relating to such data being limited to strict compliance
with applicable legal obligations.
Employees
The Alfagar Group carries out processing operations regarding the data of its
employees for the execution of the employment contract. The data processed is
necessary for the purposes of executing a contract to which the Data Subject is
party, or for the purposes of pre-contractual measures at the request of the Data
Subject.
The personal data of employees are also collected and processed for the purposes of
complying with legal obligations to which the Data Controller is subject.
Processing operations relating to Special Category data collected from Employees
are necessary for the purposes of complying with legal obligations and exercising
specific rights of the Data Controller or Data Subject in matters of labor, social
security and social protection legislation. and also for the purposes of preventive or
occupational medicine, to assess the employee's work capacity.
The processing of Personal Data of Employees or obtained through Employees,
related to criminal convictions and infractions or related security measures will
always be subject to adequate guarantees to protect the rights and freedoms of Data
Subjects, with operations relating to such data being limited to strict compliance
with applicable legal obligations.
Service providers
The Alfagar Group carries out processing operations in relation to the Personal
Data of its Service Providers to ensure compliance with the service provision
contract agreed with the Data Subjects or with the Joint Data Controllers (in relation
to the data and Data Subjects collected by them , such as counterparties, workers
and others). The Personal Data identified here and subject to processing operations
is necessary for the execution of a contract or for pre-contractual measures or for
the fulfillment of legal obligations.
Special Category data relating to Service Providers or obtained through Service
Providers will be subject to processing operations, to the extent that they are
necessary for the establishment, exercise or defense of a right in legal proceedings,
or the processing is necessary for the purposes of fulfilling obligations and
exercising specific rights of the Data Controller or Data Subject in matters of labor
legislation, social security and social protection or important public interest.
The processing of Personal Data from Service Providers or obtained through Service
Providers, related to criminal convictions and infractions or related security
measures will always be subject to adequate guarantees to protect the rights and
freedoms of data subjects, with the operations relating to to these data limited to
strict compliance with applicable legal obligations.
Treatment Activity Purposes of Treatment Fundamentals of Lawfulness
Contractual Relationship
Management
Reservation and provision of hotel
services and associated services
Pre-contractual due diligence or
execution of the contract
Legitimate interest if the holder
is not a party to the contract
Recording of electronic
communications within the scope of
the contractual relationship, if
applicable
Consent
Call recording within the scope of
the contractual relationship
Call recording to monitor service
quality
Subscription and management of
stay assistance insurance
Contract execution
Satisfaction questionnaire Legitimate Interest
Commercial Activity and Marketing
Sending
Generalized profile analysis Legitimate Interest
Sending commercial
communications
Consent
Legitimate Interest
Participation in campaigns and
contests on social media
Consent
Cumprimento de obrigações legais Billing Legal obligation
Communications Legal obligation
Management of the loyalty
program | ” A Club”
Membership and management of
the loyalty club
Contract execution
Sending of program related
communications
Contract execution
Profile analysis and website
browsing
User profile analysis Consent
User conversion analysis Consent
Execution of improvements and
developments on the webite
Legitimate Interest
Loyalty program: A Club:
The Alfagar Group has a loyalty program that offers exclusive discounts to users registered
on its official website www.alfagar.com. When registering for the “A Club” loyalty program,
the user assumes the contractual relationship with the Alfagar Group, namely in the
collection of personal data, including contact details (telephone and email), with the aim of
providing assistance during your stay and for future promotional communications.
X. TECHNICAL, ORGANIZATIONAL AND SECURITY MEASURES IMPLEMENTED
To guarantee the security of personal data and maximum confidentiality, the Alfagar
Group treats the information you provide to us in an absolutely confidential
manner, in accordance with its internal security and confidentiality policies and
procedures, which are periodically updated according to needs, as well as the legally
stipulated terms and conditions.
Depending on the nature, scope, context and purposes of data processing, as well as
the risks arising from processing for the user's rights and freedoms, the Alfagar
Group undertakes to apply, both when defining the means of processing as at the
time of the processing itself, the necessary and appropriate technical and
organizational measures to protect personal data and comply with legal
requirements.
It is also committed to ensuring that, by default, only the data that is necessary for
each specific processing purpose is processed and that these data are not made
available without human intervention to an indeterminate number of people.
Communication between the user's device and the Alfagar Group Websites is
carried out through secure communication channels that use the HTTPS protocol and
the SSL security standard. Even so, in terms of general measures, Alfagar Group
adopts the following:
Regular audits to identify the competence of the technical and organizational
measures implemented;
Awareness raising and training of personnel involved in data processing
operations;
Pseudonymization and coding of personal data;
Mechanisms capable of ensuring the confidentiality, availability and permanent
resilience of information systems;
Mechanisms that ensure the restoration of information systems and access to
personal data quickly in the event of a physical or technical incident.
XI. USE OF COOKIES
When you visit our website, small text files (Cookies) are created and written to your
computer's disk. These text files will allow for a more personalized and efficient
browsing experience. On each visit to the Site, your internet browser sends these
cookies back to the Site, allowing the recognition and memorization of users'
identity, as well as their usage preferences. These Cookies will only be installed with
your express consent, except in cases where they are necessary consents for the
operation of the Site.
To find out all the information about the cookies we use on the Site, namely their
purposes, categories, duration and who they belong to, you can consult our Cookies
Policy here.
Additionally, you have the possibility to manage your preferences regarding the
collection of cookies at any time in the preferences manager.
XII. THIRD PARTY TOOLS INTEGRATED ON THE WEBSITE
Facebook e Instagram:
There is interactivity on the Site with Facebook and Instagram, through a connection
to the servers of these social networks, this will allow identifying the website that
the user is visiting and possibly storing other data, such as the IP address.
Se o utilizador tiver a sua sessão de Facebook e/ou Instagram iniciada, serão
associados os dados às suas contas. Para que tal não aconteça, o utilizador deverá
terminar as suas sessões no Facebook e Instagram antes de visitar a página.
A informação relativa ao tratamento de dados efetuado por estas redes sociais está
disponível em:
- https://www.facebook.com/about/privacy/
- https://help.instagram.com/519522125107875
Google:
The Site provides interactivity with Google, through the respective button,
establishing a connection to Google's servers, which will identify the Site that the
user is visiting and possibly store other data, such as the IP address.
More information about how Google processes data is available at:
- https://www.policies.google.com/privacy?hl=pt-PT
LinkedIn:
The Site provides interactivity with LinkedIn, through the respective button,
establishing a connection to LinkedIn's servers, which will identify the Site the user
is visiting and possibly store other data, such as the IP address.
More information about how LinkedIn processes data is available at:
- https://www.linkedin.com/legal/privacy-policy
Youtube:
There is interactivity on the Website with Youtube, through a connection to this
website's servers, this will allow us to identify the website the user is visiting and
possibly store other data, such as the IP address.
If the user has logged in to YouTube, the data will be associated with their accounts.
To prevent this from happening, the user must log out of their YouTube session
before visiting the page.
Information regarding data processing carried out by Youtube is available at:
- https://www.youtube.com/intl/pt-BR/yt/about/policies/#community-guidelines
Net Affinity:
The Site provides interactivity with Net Affinity, through the respective button,
establishing a connection to Net Affinity's servers, which will identify the Site the
user is visiting and possibly store other data, such as the IP address.
More information about how Net Affinity processes data is available at:
- https://www.netaffinity.com/privacy.html
Roiback:
The Site provides interactivity with Roiback, establishing a connection to Roiback's
servers which will identify the Site the user is visiting and possibly store other data,
such as the IP address.
More information about how Roiback processes data is available at:
- https://www.roiback.com/legal/politica-de-privacidad
XIII. CRITERIA FOR CALCULATING RETENTION PERIODS
The Alfagar Group retains Personal Data for the period deemed necessary and
sufficient for the purposes that motivated the collection and processing, varying the
period of time for storing data according to the purpose for which the information is
processed and in accordance with the legal standards that require their retention,
after which they will be eliminated, subject to appropriate technical and functional
guarantees, as documented in each of the relevant processes.
XIV. RIGHTS OF DATA SUBJECTS
i. Right of Information
Information provided to the user by Grupo Alfagar (when the data is collected directly from
the user):
The identity and contact details of the person responsible for the treatment and, if
applicable, their representative;
The Data Protection Officer’s contact details;
The purposes of the processing for which the personal data is intended, as well as, if
applicable, the legal reasons for the processing;
If data processing is based on legitimate interests of the Alfagar Group or a third party,
indication of such interests;
If applicable, the recipients or categories of recipients of the personal data;
If applicable, indication that the personal data will be transferred to a third country or an
international organization, and the existence or not of an adequacy decision adopted by
the Commission or the reference to appropriate or adequate transfer guarantees;
Period of retention of personal data;
The right to request permission from the Alfagar Group for personal data, as well as its
correction, deletion or limitation, the right to object to processing and the right to data
accessibility;
If data processing is based on the user's consent, the right to withdraw it at any time,
without compromising the legality of the processing carried out based on previously
given consent;
The right to lodge a complaint with the CNPD or other supervisory authority;
Indication of whether or not the communication of personal data constitutes a legal or
contractual obligation, or a necessary requirement to conclude a contract, as well as
whether the holder is obliged to provide the personal data and the possible
consequences of not providing such data;
If applicable, the existence of automatic decisions, including the definition of profiles, and
information relating to the base concept, as well as the importance and expected
consequences of such processing for the data subject.
If personal data is not collected directly by the Alfagar Group from the user, in
addition to the information referred to above, the user is also informed about the
categories of personal data subject to processing and, as well, about the origin of
the data and, eventually, if they come from sources accessible to the public.
If the Alfagar Group intends to further process personal data for a purpose other
than that for which the data was collected, before such processing the Alfagar
Group will provide the user with information about that purpose and any other
information of interest, under the terms above referred to.
Procedures and measures implemented to fulfill the right to information:
The information referred to above is provided in writing (including by electronic
means) by the Alfagar Group to the user prior to the processing of personal data in
question.
Under applicable law, the Alfagar Group is not obliged to provide the user with the
information mentioned above when and to the extent that the user is already aware
of it.
The information is provided by the Alfagar Group at no cost.
ii. Right of access
The Alfagar Group guarantees the means that allow the user to consult their personal data.
The user has the right to obtain from the Alfagar Group confirmation that personal data
concerning him or her are being processed or not and, if applicable, the right to access his or
her personal data and the following information:
The purposes of data processing;
The categories of personal data in question;
The recipients or categories of recipients to whom the personal data have been or will be
disclosed, namely recipients established in third countries or belonging to international
organizations;
The period of retention of personal data;
Right to request the Alfagar Group to correct, eliminate or limit the processing of
personal data, or the right to prevent such processing;
Right to lodge a complaint with the CNPD or other supervisory authority;
If the data has not been collected from the user, the information available about the
origin of that data;
The existence of automated decisions, including profiling, and information regarding the
underlying logic, as well as the importance and expected consequences of such
processing for the data subject;
Right to be informed about the appropriate guarantees associated with the transfer of
data to third countries or international organizations.
Upon request, the Alfagar Group will provide the user, free of charge, with a copy of
the personal data that is being processed. Providing other copies requested by the
user may involve administrative costs.
iii. Right of rectification
The user has the right to request, at any time, the rectification of their Personal Data and
also the right to have their incomplete personal data completed, including through an
additional statement.
In the event of data rectification, the Alfagar Group communicates the respective
rectification to each recipient to whom the data has been transmitted, unless such
communication is considered impossible or involves a disproportionate effort for the
Alfagar Group.
iv. Right of erasure (“Right to be forgotten”)
The user has the right to obtain, from the Alfagar Group, the deletion of their data when
one of the following reasons applies:
Personal data are no longer necessary for the purpose for which they were collected or
processed;
The user withdraws the consent on which the data processing is based and there is no
other legal basis for said processing;
The user opposes the processing under the right to object and there are no prevailing
legitimate interests that justify the processing;
If personal data is processed illegally;
If personal data must be deleted to comply with a legal obligation to which the Alfagar
Group is subject;
Under applicable legal terms, the Alfagar Group is not obliged to delete personal data to
the extent that the processing proves necessary to comply with a legal obligation to
which the Alfagar Group is subject or for the purposes of declaring, exercising or
defending a a right of the Alfagar Group in legal proceedings.
In the event of data deletion, the Alfagar Group informs each recipient/entity to
whom the data has been transmitted of its deletion, unless such communication
proves impossible or involves a disproportionate effort for the Alfagar Group.
When the Alfagar Group has made personal data public and is obliged to delete them
under the right to erasure, the Alfagar Group undertakes to ensure reasonable
measures, including technical ones, taking into account technology available and the
costs of its application, to inform those responsible for the effective processing of
personal data that the user has requested them to delete links to that personal data,
as well as copies or reproductions thereof.
v. Right to limit the processing of personal data
The user has the right to obtain, from the Alfagar Group, the limitation of the processing of
user data, if one of the following situations applies (the limitation consists of inserting a mark
in the personal data stored with the aim of limiting its processing in the future):
If you contest the accuracy of personal data, for a period that allows the Alfagar Group
to verify its accuracy;
If the processing is unlawful and the user opposes the deletion of the data, requesting, in
return, the limitation of its use;
If the Alfagar Group no longer needs the personal data for processing purposes, but
such data is required by the user for the purposes of declaring, exercising or defending a
right in legal proceedings;
If the user has objected to the processing, until it is verified that the Alfagar Group's
legitimate reasons prevail over those of the user.
When personal data is subject to limitation, with the exception of conservation, it
may only be processed with the user's consent or for the purposes of declaring,
exercising or defending a right in legal proceedings, defending the rights of another
natural or legal person , or for reasons of public interest legally provided for.
The user who has obtained the limitation of the processing of their data in the cases
referred to above will be informed by the Alfagar Group before the limitation of
processing is canceled.
In case of limitation of data processing, the Alfagar Group will communicate to each
recipient to whom the data has been transmitted the respective limitation, unless
this communication proves impossible or involves a disproportionate effort for the
Alfagar Group.
vi. Right to data portability
The user has the right to receive the personal data that concerns him or her and that he or
she has provided to the Alfagar Group, in a structured, commonly used and machinereadable format, and the right to transmit this data to another person responsible for
processing, if:
Processing is based on consent or a contract to which the user is a party; It is
and
The processing is carried out by automated means. The right to portability does not
include inferred data or derived data, i.e., personal data that is generated by the Alfagar
Group as a consequence or result of the analysis of the data subject to processing.
The user has the right to have their personal data transmitted directly between
those responsible for processing, whenever this is technically possible.
vii. Right to object to data processing
The user has the right to object at any time, for reasons related to their particular situation,
to the processing of personal data concerning them that is based on the exercise of
legitimate interests pursued by the Alfagar Group or when the processing is carried out for
purposes that other than those for which personal data was collected, including profiling, or
when personal data is processed for statistical purposes.
The Alfagar Group will terminate the processing of User data, unless it presents urgent and
legitimate reasons for such processing that prevail over the user's interests, rights and
freedoms, or for the purposes of declaring, exercising or defending a right of the Alfagar
Group in a judicial process.
When personal data is processed for the purposes of direct marketing (marketing), the user
has the right to object at any time to the processing of data concerning him or her for the
purposes of said marketing, which includes the definition of profiles to the extent in which it
is related to direct marketing.
If the user objects to the processing of their data for direct marketing purposes, the Alfagar
Group will cease processing the data for this purpose.
The user also has the right not to be subject to any decision taken exclusively based on
automated processing, including the definition of profiles, that produces legal effects or that
significantly affects him in a similar way, unless the decision:
Is necessary for the conclusion or execution of a contract between the User and the
Alfagar Group;
Is authorized by legislation to which the Alfagar Group is subject; or
Is based on the user's explicit consent.
XV. EXERCISE OF DATA SUBJECTS’ RIGHTS
Data Subjects may exercise the rights granted under applicable data protection
legislation, through the following email address: rgpd@alfagar.com
The Alfagar Group has also appointed a Data Protection Officer (DPO), in
accordance with best practices in the area, who can be contacted via the following
email address: rgpd@alfagar.com or by letter addressed to the DPO (DPO) for:
Alfagar Apharthotels & Resorts,
Estrada de Santa Eulália,
8200-609 Albufeira
Portugal
The Alfagar Group will respond in writing (including by electronic means) to the
user's request within a maximum period of one month from receipt of the request,
except in cases of particular complexity, in which this period may be extended up to
two months.
If requests submitted by the user are manifestly unjustified or excessive, particularly
due to their repetitive nature, the Alfagar Group reserves the right to charge
administrative costs or refuse to comply with the request.