PRIVACY POLICY

Introduction

The Privacy Policy was developed to support Indhotel – Investimentos Turísticos, Lda, a company with tax number 501079513, headquartered at Rua Armando de Sousa, Lote 17, Loja Z 3030-403 Coimbra – hereinafter Dom Vinho, owner of the website www. domvinho.com, in adapting its activity to the General Data Protection Regulation, approved by Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (“GDPR”).

This policy is complemented by others on security/security, which are relevant to the company's business, together describing Dom Vinho 's approach to information security and privacy.

This policy applies to all Dom Vinho Professionals and Partners and, when identified, to third parties who access the company's assets.

The terms 'Privacy', 'Data Privacy' and 'Data Protection' can be used interchangeably as they are associated with a complex set of legal requirements that apply to Personal Data, which goes beyond data security and confidentiality. For example, it includes requirements on transparency of data use and retention.

Compliance with this policy is mandatory and, therefore, all Professionals and Partners have the individual responsibility to ensure their compliance with it and, if necessary, must request clarification from the leaders of their respective teams.

It is Dom Vinho 's responsibility to define the appropriate mechanisms to achieve compliance with this policy, being responsible for the operational implementation of the teams, with the support of the Privacy Officer.

Compliance with this policy can be monitored through inspections, audits and/or requests for written confirmations of compliance, with all areas responsible for regularly assessing their compliance with it within their area of ​​responsibility.

Accordingly, any employee who has violated this policy is subject to disciplinary action.

This policy is based on the principles set out in the GDPR. However, there are national differences in the applicability of Dom Vinho 's data protection and privacy, when processing personal data outside the EU, when receiving personal data from outside the EU or when processing personal data of non-EU citizens .

In case of doubt, contact Dom Vinho through the contacts provided.

Data Protection Principles

Within the scope of our activity, we process Personal Data: either when we receive personal data in the course of our business opportunities, our engagements with customers, marketing activities or a series of other related and support activities. Data may be received directly from a Data Subject (for example, in person, via post, email, telephone or from other sources), namely from our customers, partners, subcontractors, joint controllers, support service providers and credit reference agencies.

All professionals and partners should only request personal data from a Data Subject that are relevant and necessary to fulfill a certain business purpose and task.

Dom Vinho undertakes to comply with the personal data protection principles defined by the GDPR, namely:

• Lawfulness, loyalty and transparency: means that we must have a legitimate reason by virtue of which we process Personal Data, for example, consent of the Data Subject, compliance with a legal obligation to which we are subject. It also means that we must clearly inform the Data Subject about the treatment;
• Limitation of Purposes: we must only request Personal Data for specific, explicit and legitimate purposes and not treat them beyond the purpose for which they were requested;
• Minimization of data: the Personal Data subject to processing must be adequate, relevant and limited to what is necessary;
• Accuracy: we have an obligation to ensure that Personal Data is accurate and to update it whenever necessary;
• Limitation of conservation: we must not retain Personal Data for a period longer than necessary for the purposes for which they are processed, although we may retain some for historical and statistical purposes;
• Integrity and Confidentiality: we must have adequate security controls in place to protect data against unauthorized and unlawful processing, loss, destruction or damage, including technical and organizational measures such as defined processes, training and awareness;
• Lawful transfer outside the European Economic Area: we only transfer Personal Data outside the EEA provided there are adequate safeguards in place, such as a contractual basis;
• Data Subject Rights: Data Subjects have several rights that we must respect (for example, the right to access a copy of the data we archive and the right to withdraw consent given for direct marketing purposes).

Legality and loyalty in the treatment

Whenever Personal Data is collected, it is necessary to have a legal basis for the inherent processing. In accordance with the GDPR, we must identify at least one of the following reasons for processing Personal Data:

• Consent: The Data Subject has given consent for them to be processed for one or more specific purposes;
• Contractual: Processing is necessary for the performance of a contract to which the Data Subject is a party or for pre-contractual measures;
• Legal: The processing is necessary to comply with a legal obligation, to which the Controller is subject;
• Vital interests: The processing is necessary to protect the vital interests of the Data Subject;
• Public interest: Processing is necessary for the performance of a task carried out in the public interest;
• Legitimate interests: The treatment is necessary for the legitimate interests of the Data Controller, except when interests or fundamental rights and freedoms of the Data Subject prevail.

When acting as Controller, we must ensure that we have a legitimate basis for collecting and processing Personal Data.

In some situations, we may act as a Processor on behalf of our client, in which case it is their responsibility to ensure that they have a correct reason for processing the Personal Data, which they must share with us. However, we must take steps to ensure that our contract is clear about our responsibilities in this regard and that, if we collect Personal Data directly from Data Subjects on behalf of the customer, we have the bases to do so legitimately.

When a Special Category of Data is handled there is an additional set of conditions that must be fulfilled. Please contact Dom Vinho for further guidance.

The RGPD requires that Data Subjects be provided with information about the treatment in order to guarantee fair and transparent treatment. Whenever we collect Personal Data, we must ensure that we properly explain why we need the information and how we will handle it. When information is gathered through our website this information is provided via a 'Privacy Notice'.

Any other information to be provided when collecting personal data must also be provided on the internet. See our Privacy Policy and Cookie Policy for more information.

Processing for specific purposes only

Whenever we collect and process Personal Data, we must ensure that we only use them for the specific purposes that were communicated to the respective holder.

Dom Vinho should never process Personal Data for additional purposes that have not been communicated to the Data Subject. Only then will we be clear about the purpose of the treatment and we must understand the purposes for which our customers may have collected Personal Data or contact the Privacy Officer.

Appropriate, relevant and limited treatment

When we collect and process Personal Data, we must follow the principle of data minimization. This means that we must only collect the minimum Personal Data necessary to carry out a specific task.

Additionally, we must ensure that we have an adequate amount of personal data to properly perform a specific task. For example, collecting the data needed only to identify an individual.

This also applies to any sharing and other processing activities. It is important to minimize the data kept and processed; we must ensure that if we share data internally or externally or if we use it in activities such as testing, we only use/share the minimum amount in each case.

Accuracy of personal data

We have an obligation to ensure that Personal Data is kept accurate and up to date. We must ensure that there are adequate processes in place to maintain accurate data whenever necessary (for example, of professionals or of current and potential clients maintained by the relevant areas).

When acting as Data Controller in relation to a customer, we will not be obliged to implement mechanisms to keep this data up to date; this will be the responsibility of the Controller, that is, our client.

Conservation of Personal Data

Personal Data must not be kept for longer than necessary. This means that we must define and apply maximum retention periods for the Personal Data that we process and implement processes to erase them when they expire. Therefore, the following retention periods may apply:

(i) for as long as necessary for the relevant activity or services;

(ii) any period of retention required by law;

(iii) the end of the period in which disputes or investigations may arise in relation to the services; or

(iv) for the minimum period provided for in the contract.

Rights of Data Subjects

The GDPR requires us to inform people about the Personal Data we collect, the purposes and means for which it is processed. Such information is given in the form of a 'Privacy Notice'.

a) Right of Access

• The Data Subject has the right to request to see the Personal Data we have about him, the purpose of the treatment and the categories of data in question.
• We must notify the Data Subject of the recipients with whom we are going to share their data, especially if the recipient is in another country or if they belong to an international organization.
• Whenever possible, we will define the retention period of data to meet business objectives.
• We must communicate to the Data Holder the existence of the right to object to the treatment and his right to rectification and erasure.
• We must communicate to the Data Subject the existence of his right to complain to a supervisory authority.
• When data is collected from someone other than the Data Holder, we must communicate the source of that data to the data subject.
• We must ensure that we have processes in place to identify and respond to Data Subject access issues, without undue delay, and within a maximum period of one month.

b) Right of rectification

• Data Holders have the right to rectify inaccurate data, and Dom Vinho is responsible for making every effort to do so immediately.

c) Right to erasure

• The Data Subject has the right to obtain from the Controller the deletion of his data ('right to be forgotten'). It is up to Dom Vinho to do everything possible to immediately delete the data kept, except when there is a legal requirement for its conservation. If you receive a request from a Data Subject, first contact the Privacy Officer before deleting any data.

d) Children's rights

• All individuals, including children, are protected by the GDPR. For children under the age of 13, we should not process their Personal Data based on their consent, unless authorized by the respective holders of parental responsibilities.

e) Marketing

• We may sometimes send our customers and partners marketing material to inform them of services, upcoming events or other activities of interest to them, in which case we must indicate the right to withdraw consent at any time if they wish not to be contacted again in these terms.
• We must also ensure that we have processes in place to ensure that all participation preferences are recorded and respected.

Security of Retained Data

Dom Vinho will maintain data security by protecting the Confidentiality, Integrity and Availability of Personal Data, as follows:

• Confidentiality means that only authorized persons can access the data;
• Integrity means that Personal Data must be accurate and adequate for the purposes inherent to the treatment;
• Availability means that authorized users must be able to access the data if they need it for the authorized purposes.

Disclosure of Data

All professionals and partners must avoid any inappropriate disclosure of Personal Data and comply with our general duties regarding Confidentiality.

It's allowed:

a) Disclose Personal Data to third parties only on instruction or when we have a legitimate basis to do so and no restrictions are in place.

b) Disclose Personal Data to third parties in the event that we sell or buy any business or assets, or where we are a joint controller as part of a joint venture.

c) Sharing Personal Data with a third party that is processing data on our behalf, which may include transferring data to a third country.

Generally, Personal Data may be disclosed:

a) Professionals or agents so that they can carry out their functions as such.

b) Where non-disclosure may prejudice the prevention or detection of crimes, the bringing of charges against offenders, or the assessment or collection of any tax or fee. Dom Vinho must have adequate grounds for disclosing data under this category in order to avoid criminal prosecution. All disclosures must be justified and documented.

For legal purposes data may be disclosed if:

a) Required by law, statute or court order.

b) For the purpose of obtaining legal advice;

c) Within the scope or for the purposes of legal proceedings or when necessary to defend a legal right.

d) To safeguard national security.

International transfer of Personal Data

Dom Vinho may transfer any Personal Data to a third country or international organization. The Personal Data we hold may also be processed by employees operating in a third country or for one of our suppliers.

We must ensure that at least one of the following conditions applies:

a) The country to which the Personal Data is transferred guarantees an adequate level of protection for the rights and freedoms of the Data Subjects, by decision of the EU Commission.

b) Appropriate safeguards are provided (eg standard data protection clauses).

c) The Data Subject has given explicit consent to the transfer after having been informed of the possible risks.

d) The transfer is necessary for one of the reasons established in the RGPD, including the performance of a contract between Dom Vinho and the Data Subject, or protection of the Data Subject's vital interests.

e) The transfer is legally required for important reasons of public interest or for the filing of legal actions or defense within the scope thereof.

Log information, cookies and web beacons

The Dom Vinho website uses cookies to distinguish its users. Dom Vinho collects standard Internet registration information, including the user's IP address, browser type and language, access times and addresses of reference sites.

To ensure that our website is well managed and to facilitate navigation, Dom Vinho or its service providers may also use cookies (small text files stored in the user's browser) or web beacons (electronic images that allow our website to count visitors accessing a website and certain cookies) to collect aggregated data.

Professional Information

Collection and Conservation

• Dom Vinho , as an employer, collects, processes and retains personal data of employees, contractors, consultants and candidates. The Human Resources Department and other departments that process Personal Data of professionals must verify and document the legal basis inherent to the treatment they carry out. The Personal Data of professionals should only be processed when there is a valid and legitimate purpose for this purpose.
• The collection of personal data related to our employees takes place through different channels and formats, such as: registration forms; electronic web forms, (for example, during the recruitment process); data records; CCTV footage; Team photographs including identification cards; data from other sources (eg previous employers); credit checks and security checks; etc.
• The creation and storage of personal data related to our professionals occurs through various channels and formats, such as: payment receipts; evaluation records; Employment contracts; emails; illness records; etc.

Training and Awareness

• We are committed to providing adequate training on personal data protection to all professionals. If necessary, we will provide personalized training and awareness for people based on their role.

Process design and alteration

• For all proposed new systems and business procedures involving Personal Data, consideration should be given to whether a privacy and information security impact assessment is required to identify risks and controls.

Updated May 12, 2023