Privacy Policy

This policy applies to the processing of personal data that is voluntarily made available by customers and users of the Vermelho website www.vermelhohotel.com and intends to provide information on how the entity responsible for the processing of such data proceeds, and is ruled by the provisions of the legislation applicable to matters of privacy and data protection, in particular, by the Regulation (EU) of the European Parliament and of the Council of 27 April 2016 (“GDPR”),

1. Data Subjects’ Rights

Right to Information
When the data have been collected directly from the Data Subject, the Data Subject has the right to be informed about the:

The identity and contacts of the controller and, if applicable, of his representative;
The contacts of the Data Protection Officer, when there is one;
The purposes of the processing for which the personal data are intended, as well as, if applicable, the legal reasons for the processing;
In the event the Data are not collected directly by Vermelho from their Data Subject, the categories of data processed and the origin of the data and, where appropriate, if they come from sources accessible to the public
Where applicable, of the recipients or categories of recipients to whom the personal data have been or will be disclosed, namely the recipients established in third countries or belonging to international organizations
If the processing of the data is based on the legitimate interests of Vermelho or a third party, the indication of such interests;
Where applicable, indication that personal data will be transferred to a third country or an international organization, and whether or not there is an adequacy decision adopted by the Commission or the reference to appropriate or suitable transfer guarantees;
The retention period of personal data;
The right to request Vermelho access to its own Personal Data, as well as its correction, deletion or limitation, as well as to request Vermelho to limit the processing of Personal Data or the right to prevent such processing;
If the processing of the data is based on the consent of the Data Subject, the right to revoke it at any time, without compromising the legality of the processing previously carried out on the basis of the consent revoked;
The right to lodge a complaint with the CNPD or other supervisory authority;
Indication whether the communication of personal data constitutes a legal or contractual obligation or a requirement necessary to enter into a contract, as well as whether the Data Subject is obliged to provide the personal data and the possible consequences of not providing such data;
Where applicable, the existence of automatic decisions, including profiling, and information relating to the underlying concept and logic, as well as the importance and expected consequences of such processing for the Data Subject;

If Vermelho intends to further process the Data for a purpose other than that for which the data were collected, before that processing it will provide the Data Subject with information about that purpose and any other information of interest.

Right of access
Vermelho guarantees the means that allow the Data Subject to consult his/her Personal Data.
The Data Subject has the right to obtain from Vermelho the confirmation as to whether the Personal Data concerning him/her are or not subject of processing and, being the case, the right to access his/her Personal Data. Upon request, Vermelho will provide the Data Subject, free of charge, with a copy of his/her Data which are in process of being processed.

Right of rectification
The Data Subject has the right to request, at any time, the rectification of his/her Personal Data and, as well, the right to complete his/her incomplete Personal Data, including through an additional statement. In the event of rectification of the data, Vermelho shall communicate to each recipient to whom the data have been transmitted the respective rectification, unless such communication is considered impossible or involves a disproportionate effort for Vermelho.

Right of erasure
The Data Subject has the right to obtain the deletion of his/her Personal Data when one of the following reasons applies:

The Data of the Data Subject is no longer necessary for the purpose that motivated its collection or processing;
The Data Subject withdraws the consent on which the processing of the data is based and there is no other legal basis for such processing;
The Data Subject opposes her/himself to the processing under the right of opposition and there are no prevailing legitimate interests justifying the processing;
In the event, the Data of the Data Subject are treated illegally;
If the Data of the Data Subject must be erased in order to comply with a legal obligation to which Vermelho is subject to;

Vermelho is not under obligation to delete the Data of the Data Subject to the extent that the processing proves necessary for the fulfilment of a legal obligation to which Vermelho subject or for the purposes of declaration, exercise, or defense of a right of Vermelho in a legal action.

In the event of the deletion of the data, Vermelho shall communicate to each recipient/entity to whom the data has been transmitted the respective erasure, unless such communication proves to be impossible or involves a disproportionate effort.

Right to restriction of processing of Personal Data
The Data Subject has the right to obtain the restriction of the processing of his/her Personal Data, that is, to insert a mark in the Personal Data preserved with the aim of limiting their processing in the future, in the following situations:

If she/he contests the accuracy of the personal data, during a period that allows Vermelho to verify its accuracy;
If the processing is unlawful and Vermelho opposes itself to the erasure of the data, requesting, in return, the restriction of their use;
If Vermelho no longer needs the Data Subject data for processing purposes, but said data are required by the Data Subject for the purposes of declaring, exercising or defending a right in a legal action;
If the Data Subject has objected to the processing, until it is verified that the legitimate reasons of Vermelho prevail over those of the Data Subject.

When the Data are subject to limitation, they can only, with the exception of conservation, be processed with the consent of the Data Subject or for the purposes of declaration, exercise or defense of a right in a legal action, of defense of the rights of another natural or legal person, or for legally foreseen reasons of public.

The Data Subject who has obtained the limitation of the processing of her/his data in the cases referred above will be informed by Vermelho before the limitation to the processing is annulled.

Right to Personal Data portability
The Data Subject has the right to receive the Personal Data that concern her/him and that she/he has provided to Vermelho, in a structured, commonly used and machine-readable format, and the right to transmit these data to another person responsible for the processing, if the processing is based on consent or on a contract to which the Data Subject is a party and is carried out by automated means.

The portability right does not include inferred data or derived data, i.e., personal data that are generated by Vermelho as a consequence or result of the analysis of the data subject to processing.

The Data Subject has the right their personal data to be transmitted directly between those responsible for the processing, whenever it is technically possible.

Right to object
The Data Subject has the right, at any time and for reasons related to her/his particular situation, to object to the processing of her/his Data based on the exercise of legitimate interests pursued by Vermelho or when the processing is carried out for purposes other than those for which the personal data have been collected.

Vermelho will terminate the processing of the Data Subject’s Data, unless it presents urgent and legitimate reasons for such processing that prevail over the interests, rights and freedoms of the Data Subject or for the purposes of declaration, exercise or defense of a right of Vermelho in a legal action.

When the Data Subject’s Data are processed for the purposes of direct marketing, the Data Subject has the right to object at any time to the processing of data that concern her/him. If the Data Subject opposes to the processing of her/his data for the purposes of direct marketing, Vermelho ceases the processing of the data for that purpose.

The Data Subject has also the right not to be subject to any decision taken exclusively based on automated processing, including the definition of profiles, which produces effects in its legal sphere or which significantly affects her/him in a similar way, unless the decision:

Is necessary for the celebration or performance of a contract between the Data Subject and Vermelho;
Is authorized by legislation to which Vermelho is subject; or
Is based on the Data Subject’s explicit consent.

Right of complaint
The Data Subject has the right to file a complaint with the supervisory authority. In Portugal, the supervisory authority is the “Comissão Nacional de Proteção de Dados”, located at Av. D. Carlos I, 134 – 1.º 1200-651 Lisbon, with the telephone (+351) 213928400 and e-mail: geral@cnpd.pt.

2. Exercise of the rights by the Data Subject
Data Subjects may exercise their rights of access, rectification, erasure, portability of their personal data and limitation or opposition to the respective processing under the terms of the applicable law, by sending an email to the address WELCOME@VERMELHOMELIDES.COM.
For more information, please contact the processing Controller via email WELCOME@VERMELHOMELIDES.COM Vermelho will respond to the Data Subject’s request within one month of receiving the request, except in cases of special complexity, in which this period may be extended to two months.

If the requests presented by the Data Subject are manifestly unjustified or excessive, namely due to their repetitive nature, Vermelho reserves the right to charge administrative costs or refuse to comply with the request.

3. Dada collection
Personal Data may be requested and collected when a customer or user registers or browses the Vermelho website, requests a contact, provides or requests information through the above-identified website or by e-mail or makes a reservation for a stay or during the own stay.

The Personal Data collected and processed are, generally, the name, date of birth, telephone, e-mail, address, tax number or data related to the means of payment, however, other Data may be requested and collected deemed necessary for the provision or collection of services by Vermelho (“Personal Data”).

In order to improve the quality of visits and use of the Vermelho website, learn about browsing habits on in this website and the profile of users and send commercial and marketing information adapted to this profile, Vermelho may also collect and process information about the visited pages, the type of browser used, access times and links through which the user accessed the website (“Usability Information”).

The set of Personal Data and Usability Information are hereinafter abbreviated as Data.

Vermelho may collect the Data in person, by telephone, e-mail and/or through the website, or indirectly through partners and official entities.

4. General principles applicable to the processing of Data
Vermelho undertakes to ensure that the Data:

Are treated in accordance with the law;
Are collected for specific, objective and legitimate purposes and for what is necessary in relation to the purposes for which they are processed;
Are accurate and up-to-date, arrangements being made so that inaccurate or out-of-date data to be erased or corrected;
Are kept only for the period necessary for the purposes for which they are processed;
Are processed safely, being adopted technical or organizational measures that are appropriate for this purpose;

The processing of Data by Vermelho is permitted and legitimized in the following situations:

The Data Subject has given her/his free, explicit and unequivocal consent to the processing of her/his Data for one or more specific purposes;
The treatment is necessary for the fulfillment of a contract to which the Data Subject is a party or for pre-contractual procedures that have been requested;
The processing is necessary for the fulfillment of a legal obligation or for the exercise and defense of legitimate interests of Vermelho or third parties, provided that over these do not prevail interests, rights and fundamental freedoms of the Data Subject that require the protection of his/her Personal Data.
When the processing of the Data Subject’s Data is carried out based on her/his consent, she/he has the right to revoke it at any time. Such revocation does not call into question the legality of the treatment carried out by Vermelho prior to this revocation based on the revoked consent.

The period during which the Data are stored and conserved varies according to the purpose of the processing. In any case, the Data will only be archived for the time necessary to fulfill such purposes, after which they will be deleted, without prejudice to legal requirements that require the retention of the Data for a certain period of time.

5. Purposes of Data Processing
Vermelho uses the Data of Data Subjects for the following purposes:

Provision of hotel services and associated services (restaurant, bar, spa, vouchers, etc.);
Management of contacts with the Data Subject and response to budget requests;
Invoicing and collection;
Provision of information to the Data Subject, who has requested it, about products and services on the website and/or at the hotel, special offers and campaigns, sharing of up-to-date information on Vermelho’s activity and, in general, for the purposes of Vermelho marketing, through any means of communication;
Participation in the social networks of Vermelho;
Ensuring that the website meets the needs of customers and users, through the development and publication of the most adapted contents possible, the improving the search capabilities and functionalities of the website itself and the obtaining or associated or statistic information regarding the profile type of customers and users;
Subscription and management of assistance insurance available to all customers during their stay at Vermelho;
Sending satisfaction questionnaires;
Recording of telephone calls that may be made within the scope of requesting or providing information on reservations, vouchers and other products or services and their commercial and use conditions and the establishment of any contractual relationship, whether in the contract formation phase, either during its duration.

The lawfulness of the processing according to its purposes is as follows:

Processing Activity	Processing Purposes	Lawfulness fundamentals
Contractual Relationship Management	Reservation and provision of hotel services and associated services	Pre-contractual or contract execution steps
		Legitimate interest if the Data Subject is not a party to the contract
	Recording of electronic communications within the scope of the contractual relationship	Consent
	Call recording within the scope of the contractual relationship
	Call recording for service quality monitoring
	Purchase of Vouchers	Execution of contract
	Subscription and management of stay assistance insurance	Execution of contract
	satisfaction questionnaire	Legitimate Interest
Commercial Activity and Marketing Submission	General profile analysis	Legitimate Interest
	App Download	Consent by unequivocal act
	Sending commercial communications	Consent
		Legitimate Interest
	Participation in campaigns and contests on social networks	Consent
Compliance with legal obligations	Invoicing	Legal obligation
	Communications	Legal obligation
Loyalty program management	Membership and management of the loyalty program	Execution of contract
	Sending Program Communications	Execution of contract
Profile analysis and website navigation	User profile analysis	Consent
	User conversion analysis	Consent
	Implementation of improvements and development on the Website	Legitimate Interest

6. Data Transmission
With the exception of the situations listed below, the Data collected by Vermelho will not be shared with third parties without the consent of the respective Data Subject.

a) Contractual relationship with Vermelho
Vermelho may transmit or communicate the Data to other entities in the event that such transmission or communication is necessary for the execution of the contractual relationship eventually established between the Data Subject and Vermelho or for taking the measures requested by the Data Subject that precede this contractual relationship contract, for the fulfillment of a legal obligation to which Vermelho is subject or for the fulfillment of legitimate interests. In the event of a transmission of Data to third parties, all reasonable efforts will be made so that the transferee uses the Data in accordance with this Policy.

In the event that the Data Subject makes a reservation for a stay at Vermelho, her/his personal data will also be transmitted and processed for the purposes of joining and managing the assistance insurance available to all customers during their stay, in which case the Responsible for the processing will transmit to the insurer the following Personal Data: name, place of birth, nationality, date of birth, civil identification document number, residence and check-in and check-out dates.

b) Processor Entities
Within the scope of Data processing, Vermelho may resort to third parties, subcontracted by itself, to, by itself and on its behalf and in accordance with the applicable legislation and this Privacy Policy, process the Data, being that these entities will not be able to transmit the Data to other entities.
Vermelho is committed to subcontracting only the entities that offer maximum security in the execution of appropriate technical and organizational measures.

The categories of Processor Entities to which Data from customers and from the Vermelho website may be communicated are as follows:

Categories of Processor Entities	Purposes of the processing
Licensing, maintenance, support and technical assistance companies for software and systems	Management / maintenance / support for systems and software that support Vermelho’s activity
Payment service processing companies, EDI and electronic invoicing services, accounting, tax and administrative management and activity support software	Economic and accounting management of customer, supplier and service provider invoicing
Commercial promoters	Promotion / Sale of services of Vermelho
Marketing support companies, including digital	Assistance in managing the sending of marketing emails, performance and user profile analysis and publicity dissemination
Security and surveillance companies and preventive and corrective maintenance companies for security systems	Video surveillance and surveillance for the safety of people and property
Management companies	Provision of services associated with the management and consultancy of Vermelho

c) Third Entities
Vermelho may also have to communicate Data to other third parties not qualified as Processor Entities as defined in article 4, n. º 8 of the GDPR. These entities will be subject to the confidentiality of the Data and the guarantee that they will process them in compliance with the provisions of the GDPR.

The categories of Third Entities to which Data from customers and from the Vermelho website may be communicated are as follows:

Third party categories	Purposes of Data Processing
Insurance Companies	Customer Assistance Insurance
Companies providing services during the stay of customers requested by them	Diverse services, such as, for example, car rental services, transport services or restaurant reservations.
Social networks	Promotional and marketing campaigns
Travel agencies and tour operators	Reservation of stays and provision of hotel services
Consultants and Lawyers	Provision of consultancy and legal services

7. Implemented measures
To guarantee Data security and maximum confidentiality, Vermelho treats the information provided in an absolutely confidential manner, in accordance with its internal security and confidentiality policies and procedures, which are periodically updated according to the needs and the terms and conditions. legally foreseen.

Depending on the nature, scope, context and purposes of data processing, as well as the risks arising from the processing for the rights and freedoms of the Data Subject, Vermelho undertakes to apply the necessary and adequate measures to protect the Data and to comply with legal requirements and to ensure that only the data that are necessary for each specific purpose are processed and that these Data are not made available to an indeterminate number of people or processor or third entities.

8. Data controller
The controller entity responsible for the data processing collected by Vermelho is the company Vermelho Mio, Unipessoal, Lda., with NIPC 516589369 and headquarters at Rua da Emenda, n.º 69, 1.º, 1200-169 Lisbon. Vermelho Mio, Unipessoal, Lda., as controller entity, ensures the privacy and protection of the data subject to processing, acting in accordance with the legislation applicable to the protection of personal data.

9. Use of Cookies and similar technologies
The website of Vermelho uses functional and analytical cookies in order to collect information about its users to improve navigation, as well as track the use and effectiveness of the website itself. Their activation is subject to the express acceptance of the Data Holders.

Certain cookies allow the interconnection and flow of data with social networks, directing users to the web pages of these networks. Social network operators use their own cookies and may use tools to collect and receive information from the website and use that information. Vermelho has no control, nor does it exert any influence over the operators of social networks, nor over their privacy and security policies, and users must inform themselves about them.

The website of Vermelho also makes available content that is hosted on external websites, and the entities responsible for making such content available may also use cookies. Interaction with such content may lead to the placement of “Third Party Cookies” on the device of the user of Vermelho’s website, as Vermelho has no control over how such cookies are used, so users are suggested to confirm how the same are used.

10. Third-party tools integrated into Vermelho’s website

Facebook and Instagram:
The website has interactivity with Facebook and Instagram, through a connection to the servers of these social networks, which may allow identifying the website that the user is visiting and possibly storing other data, such as the IP address.
If the user is logged in to Facebook and/or Instagram, the Data will be associated with their accounts. To prevent this from happening, the user must log out of Facebook and Instagram before visiting the page.
Information regarding data processing carried out by these social networks is available at:
https://www.facebook.com/about/privacy/
https://help.instagram.com/519522125107875

Twitter:
The website provides interactivity with Twitter, through the respective button, establishing a connection to the Twitter servers, which will identify the website that the user is visiting and possibly store other data, such as the IP address.
More information about how Twitter processes data is available at
https://twitter.com/privacy

Youtube:
There is interactivity with Youtube on the website, which will allow, through a connection to the servers of this website, to identify the website that the user is visiting and to store other data, such as the IP address.
If the user has their Youtube session started, the data will be associated with their accounts. To prevent this from happening, the user must log out of YouTube before visiting the page.
Information regarding data processing carried out by Youtube is available at:
https://www.youtube.com/intl/pt-BR/yt/about/policies/#community-guidelines.

11. Breach of Personal Data
In case of breach of Personal Data and to the extent that such breach is likely to imply a high risk for the rights and freedoms of the Data Subject, Vermelho undertakes to communicate the breach of Personal Data.

Violation communication is not required in the following cases:

If Vermelho has applied adequate protection measures, both technical and organizational, to the personal data affected by the breach;
If Vermelho has taken measures that ensure that the high risk to the user’s rights and freedoms is no longer likely to materialize itself; or
If communicating with the user implies a disproportionate effort for Vermelho.

12. Changes to the Privacy Policy
Vermelho reserves the right to change this Privacy Policy at any time.

13. Disclaimer
Vermelho and the Controller cannot be held responsible for any losses or damages in terms of civil liability that result from the use, correct or incorrect, of its services, websites and respective contents by the user, including improper access to the computer and user’s computer system by third parties.
The websites may contain links to sites operated by third parties over which Vermelho and the Controller have no control and for which they do not assume any responsibility.

Viewing legal provisions on this site does not exempt from consulting the legal rules in force, officially approved, published in original editions and supports (namely the “Diário da República” or the Official Journal of the European Union).

14. Legislation and competent jurisdiction
This Privacy Policy is governed by Portuguese law.
The Court of the “Comarca of Setúbal” is competent to resolve any conflict related to the same and Vermelho, Vermelho Mio and customers and users expressly recognize and accept as being the competent, assigning to it, in case of doubt, such competence, thus excluding the possible competence of any other.

PRIVACY
POLICY