PRIVACY AND PERSONAL DATA PROCESSING

Conditions of Use and Privacy Policy

Pinto Lopes Viagens has always been committed to protecting the privacy of its website users and, as such, only collects personal information from those who voluntarily provide it, and also only uses it for the purposes for which it was provided.

This Privacy and Personal Data Processing Statement helps you understand how we collect, use and protect your personal data when you visit our website.

The personal data collected by Pinto Lopes Viagens on this website are processed automatically and are intended for managing the contacts of the user of this website, in the form of “Booking Requests” and “Contact Requests” through this website and will be used only and exclusively for the processing of that contact.

By providing their personal data to Pinto Lopes Viagens, the user of this website acknowledges and consents to their processing in accordance with this Privacy and Personal Data Processing Statement and with the rules and principles contained in the respective General Terms and Conditions of the contracted services.

To this extent and with regard to the processing of personal data, the user of this website should read this Privacy Statement in conjunction with the General Terms and Conditions governing the sale of travel contained on this website and in our annual brochure.

If we intend to make any changes to this Statement, we will post those changes on this page so that you can see the type of information we collect and how we use it.

(Please click to see details)

WHAT ARE PERSONAL DATA?
Personal data constitute information relating to a living, identified or identifiable person. Personal data also constitute the set of distinct pieces of information that can lead to the identification of a specific person.

  • Personal data that have been de-identified, encoded or pseudonymised, but that can be used to re-identify a person, remain personal data and fall within the scope of the GDPR.
  • Personal data that have been anonymised so that the person is not or is no longer identifiable are no longer considered personal data. For data to be truly anonymised, anonymisation must be irreversible.

Examples of personal data:

  • Name and surname;
  • A residence address;
  • An email address such as nome.apelido@empresa.com;
  • An IP (internet protocol) address;
  • Cookies.

Examples of data not considered personal:

  • the company registration number;
  • an email address such as info@empresa.com;
  • anonymised data.

COLLECTION OF PERSONAL DATA ON THE WEBSITE
We collect personal data with your consent when you voluntarily and freely choose to send us a message through the website or make a reservation request.

The data collected are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed and are not subsequently processed for a purpose other than that which led to the contact from the data subject.

Their processing for statistical purposes is not, in accordance with Article 89, paragraph 1 of the General Data Protection Regulation, considered incompatible with the initial purposes.

UNPROCESSED DATA
Pinto Lopes Viagens does not carry out personal data processing that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, nor the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

However, it is important to note the exception provided for in paragraph 2 of article 9 of the General Data Protection Regulation, which includes the religious conviction required in the processing of visas for the visit to some countries.

ON WHAT BASIS CAN WE PROCESS YOUR PERSONAL DATA?

Consent
When we have your express and prior consent – in writing or through the validation of an option – and if that consent is free, informed, specific and unequivocal.
or

Contract performance and pre-contractual measures
When the processing of personal data is necessary for the conclusion, performance and management of the contract entered into with Pinto Lopes Viagens, such as the purchase of a trip or the processing of a reservation.

or

Compliance with legal obligations
When the processing of personal data is necessary to comply with a legal obligation to which Pinto Lopes Viagens is subject, such as the communication of identification data to police, judicial, tax or regulatory entities.

or

Legitimate interest
When the processing of personal data corresponds to a legitimate interest of Pinto Lopes Viagens or third parties.

Minors under the age of 16 must obtain authorisation from their parents or guardians before accessing or providing personal data on the website.

WHO IS RESPONSIBLE FOR PROCESSING YOUR PERSONAL DATA?
The data controller responsible for collecting and processing your personal data will be Pinto Lopes Viagens S.A., for which its Board of Directors is responsible and which within this scope decides which data are collected, the means of processing and the purposes for which the data are used.

YOUR RIGHTS
In accordance with applicable data protection law, the user may exercise their rights of access, rectification or erasure of their personal data, restriction of processing, right to object to processing and right to portability of their data, by means of a written request to Pinto Lopes Viagens, whose contact details are indicated below.

RIGHT OF ACCESS:
Right to obtain confirmation of which personal data are being processed and information about them, such as, inter alia, the purposes of the processing and retention periods.

RIGHT OF RECTIFICATION:
Right to request the rectification of your personal data which are inaccurate or request that incomplete personal data be completed, such as address, Tax ID (NIF), email, telephone contacts, or other data.

RIGHT TO ERASURE OR “RIGHT TO BE FORGOTTEN”:
Right to obtain the erasure of your personal data, provided that there are no valid grounds valid grounds for their retention, such as cases in which Pinto Lopes Viagens has to retain the data to comply with a legal obligation to retain such data.

RIGHT TO DATA PORTABILITY:
Right to receive the data you provided in a commonly used and machine-readable digital format or to request the direct transmission of your data to another entity.

RIGHT TO WITHDRAW CONSENT OR RIGHT TO OBJECT:
Right to object or withdraw your consent at any time to data processing, such as in the case of data processing for marketing purposes, as long as there are no legitimate interests that prevail over your interests, rights and freedoms, such as defence of a right in legal proceedings.

RIGHT OF RESTRICTION
Right to request the restriction of the processing of your personal data, in the form of:
– Suspension of processing
– Limitation of the scope of processing to certain categories of data or processing purposes.

PROFILING AND AUTOMATED DECISIONS
Pinto Lopes Viagens does not make any commercial decision based on automated decisions, nor will it take any action leading to the definition of categories or profiles of the users of this website.

HOW YOU CAN EXERCISE YOUR RIGHTS
Any communication regarding the processing of personal data must be addressed in writing to Pinto Lopes Viagens at the following address:

PINTO LOPES VIAGENS
Rua Pinto Bessa, 466
4300-428 Porto

Or by email: dadospessoais@pintolopesviagens.com

The exercise of rights is free of charge, except in the case of a manifestly unfounded or unreasonable request, in which case a reasonable fee may be charged by taking into account the costs required to fulfil said request.

TRANSMISSION
In addition to the obligations referred to in the law applicable to data protection or the safeguarding and protection of its own interests, Pinto Lopes Viagens will not share any personal data with third parties, except in cases where there is a legal obligation or legitimate interest, in which case the user of this website will be duly informed.

TECHNICAL AND ORGANISATIONAL MEASURES
Although no data are stored on the website, Pinto Lopes Viagens has appropriate technical and organisational measures to protect the data processed, namely against unauthorised access or any other form of illegal or unlawful processing.

Pinto Lopes Viagens has implemented security and internal protection measures at its facilities, which allow it to limit access to personal data to its employees only, for the sole and exclusive fulfilment of the processing purposes.

Pinto Lopes Viagens has implemented:

  • Logical security requirements and measures, such as the use of firewalls and intrusion detection systems in its systems, the existence of a strict policy on access to systems and information and the recording of actions carried out by Pinto Lopes Viagens employees on personal data of users of this website (logging);
  • Physical security measures, including strict control of access to Pinto Lopes Viagens’ physical facilities by employees, partners and visitors.
    Means of protecting data from conception (“privacy by design”) using technical means such as masking, encryption, pseudonymisation and anonymisation of personal data, as well as a set of privacy-friendly preventive measures (“privacy by default”);
  • Scrutiny, auditing and control mechanisms to ensure compliance with security and privacy policies;
  • All employees of the entity responsible for processing personal data are bound by a duty of secrecy and confidentiality in relation to the data to which they have access within the scope of operations involving data entry into the respective database, and they are duly made aware of the importance of fulfilling this legal duty of secrecy and required to exercise the corresponding responsibility.

DURATION OF DATA RETENTION
Pinto Lopes Viagens will retain the data only for the period necessary to fulfil the purpose for which they were collected or for the minimum retention period required by legal regulations, such as compliance with the VAT and Corporate Income Tax (IRC) codes, when applicable.

APPLICABILITY
Pinto Lopes Viagens’ privacy and personal data protection policies apply to the processing of personal data carried out within the scope of its commercial activities and provision of services, in accordance with the principles of lawfulness, loyalty and transparency.

COOKIES
Pinto Lopes Viagens uses cookies on its website to provide a better digital experience for users, optimise its features, collect statistical data and target advertisements. If you do not allow the use of cookies, some of the features may not correspond to the expected level of service. If you wish to remove cookies, please consult the “Help” section of your internet browser. To find out more about the cookies used on this website, click here: xxx

AUTOMATED DECISIONS
Pinto Lopes Viagens will not make any commercial decision based on automated decisions, nor will it take any action leading to the definition of categories or profiles.

SUPERVISORY AUTHORITY
The supervisory authority is the National Data Protection Commission (CNPD), with headquarters at Rua de São Bento n.º 148-3º 1200-821 Lisbon;

NOTIFICATION OF A PERSONAL DATA BREACH TO THE SUPERVISORY AUTHORITY
In the event of a personal data breach, Pinto Lopes Viagens will notify the competent supervisory authority of this fact, without undue delay and, whenever possible, up to 72 hours after becoming aware of it, unless the personal data breach is not likely to result in a risk to the rights and freedoms of natural persons.