Privacy Policy

At VMPS - Águas & Turismo, S.A. (here in after "VMPS") entity that manages and operates the "Vidago Palace" (including hotel, spa and golf), "Pedras Salgadas Spa & Nature Park" (including hotel and spa) and "Termas da Ladeira de Envendos" (thermal spa), we recognize the importance of processing your personal data, so we have adopted the appropriate technical and organizational measures to ensure a high level of security in the data processing operations. We hereby inform you of our Privacy Policy, informing you of your rights and how we collect and use your personal data.

We assume the responsibility of treating your personal data in a complete and confidential way, considering only clear and precise purposes.

1. Who is responsible for the processing of personal data?

VMPS - Águas & Turismo, S.A., with headquarters in Pedras Salgadas, 5450-136, Bornes de Aguiar - Vila Pouca de Aguiar - Portugal is the controller, i.e., the responsible for the processing of personal data for the purposes listed below.

By personal data we mean any information relating to an identified or identifiable person.

2. Who are the holders of the personal data?

The client, or potential client, to whom the data relates and who uses, or intends to use/acquire, the products, services and/or campaigns, VMPS has to offer.

And the representatives of a company, within the scope of a contract, or a precontract, between such entities and VMPS.

2.1. What categories of personal data are collected by VMPS?

i) Contact information: eg. name, e-mail, telephone, address;

ii) Personal information: eg. date of birth, age, ID number;

iii) Information needed to provide hotel services: eg.: credit card number, arrival and departure days, preferences and interests.

iv) Curricular information: such as academic qualifications, spoken and written languages, computer skills, assessment data and other information in the curriculum vitae.

v) Details about your health, when providing the thermal treatments performed in our spas.

vi) Applications, web pages and social networks data: eg.: profiles, location and behaviors.

In the case of representatives companies, we only collect the data necessary for the proper execution of the contract, such as name, email and telephone.

2.2. How, when and for what purposes are your personal data collected?

Your personal data may be collected in the following circumstances and for the following purposes:

1.In VMPS websites when you make (i) a reservation at one of the hotels, in our spas, and in our golf (ii) or subscribe our newsletter (iii) when applying for an open job opportunity or submitting an application spontaneously or in a subsequent recruitment process.

2.With the purpose of drawing a contract, for instance while purchasing hotel services; products or services at the spa; golf and among others.

3.With your express consent we will also collect health information for thermal treatments performed in our Spas. It is the responsibility of the clinical director to ensure the quality of the thermal treatments and clinical care provided, as well as the clinical staff’s compliance with the ethical-deontological standards. Our thermal units are licensed under thermal activity legal regime, Decree-Law no. 142/2004 of June 11.

4.During marketing campaigns, while communicating information and products; programs and packages; when you take part of a contest or event organized by VMPS, and with express consent give us your personal information.

5.For registration of minors in activities, at the hotel, spa or golf: eg. name and age.

3. What are the grounds and duration of personal data processing?

The grounds justifying the processing of your personal data by VMPS, for the purposes described in section 2.2 of this policy, are as follows:

Consent: your personal data may be processed by means of the free, specific, informed and explicit expression of will, according to which you accept, through a statement or unequivocal accepting action, that your personal data is processed. For example, we treat our customers and potential customers personal data, with their consent, for commercial and marketing purposes, namely marketing campaigns, events, discounts, new product information, packages and programs, services provided or product satisfaction surveys. Under this basis, we also process data relating to preferences and interests, as well as data relating to your health in treatments performed at the spa.

Pre-contractual procedures and / or performance of a contract: your personal data may be necessary for clarifying doubts, booking, signing, executing and managing the contract with VMPS. For example, we process personal data to manage your booking ando manage your entire stay.

Compliance with a legal obligation: your data may be needed to comply with VMPS’slegal obligations: eg. tax obligations; compliance with legal proceedings regarding foreign guests.

Legitimate interests: Your data may be needed to perform certain tasks related to VMPS business activity, exception to cases where your privacy and data protection rights prevail. Examples: We process personal data based on legitimate interests, namely to improve our services, manage our relationship with the customer, before and during the hotel service provided; when customer contact is made via website and/ or social networks; when we need to contact the representative of a company regarding a contract.

VMPS will process your personal data, according to the following:

3.1. How long do we keep your personal information?

VMPS retains the holder's personal data only for the period strictly necessary for the purpose for which it was collected.

Sometimes, the law requires the storage of data for a specific period, specially in the case of data necessary for informing Tax Authorities, which will be kept for 10 years, according to present legislation.

We will also keep your data for as long as you maintain a contract with VMPS. However, we may maintain your personal data for a longer period than the duration of the agreement, under your consent, to ensure rights and duties related to the contract or in situations where there is a legitimate interest of VMPS, always respecting the period necessary for the pursuit of the purpose for which they were collected.

In the absence of a specific legal obligation, your data will only be processed for the period necessary to comply with the purposes for which it was collected, and for as long as there are legitimate grounds for VMPS to keep it.

As a rule, your personal data, when processed for marketing campaigns, will be kept for a maximum period of 5 years from the time of collection of your consent or the last contact made (whichever is the later) and if within that period, consent was not withdrawn.

As for the personal data processed in the Spa, clinical processes of thermal baths, registration of thermal treatments and complementary techniques performed, among others, they will be kept during the period established in Decree-Law no. 142/2004 of June 11, for a period of at least 10 years, without prejudice to a legal obligation fixing an higher time frame.

Your personal data, when processed for the purposes of spontaneous applications and selection and recruitment processes, will obey the following:

Once the maximum storage period has been reached, the personal data will be irrevocably anonymous or destroyed in a secure way.

4. To whom do we transmit your personal data?

VMPS transmits your personal data only when necessary for the purposes described above.

The suppliers and/or service providers of VMPS are subject to the same terms and conditions of treatment of personal data that this privacy policy establishes, being prohibited from using, transferring, divulging or registering the personal data of the holder for any purpose other than that for which they were specifically engaged.

VMPS can transmit your personal data, depending on the purpose for which it was collected, to different recipients, such as reservation management platforms, tour operators, external physicians (in the case of the spa), communication agencies, event promoters, carriers, and other commercial partners, and only the necessary data will be transmitted to the development of the activity pursued by these entities within the scope of the purposes identified in this privacy policy.

Your personal data may also be transmitted to entities to whom the data must be communicated by law, such as the tax authority or the Immigration and Borders Services.

5. What are the rights of the holders of personal data?

VMPS guarantees the applicability and compliance of all the holder’s rights regarding the personal data as expressed in the General Data Protection Regulation and national legislation in force.

• Right of Access

You have the right to obtain from VMPS the confirmation that the personal data concerning you is being processed and, if it is the case, the right to access your personal data and information regarding the process, for example, you may request a copy of your personal data and request additional information about the processing we perform.

• Right to Rectification

You also have the right to obtain, without undue delay, from VMPS, rectification of inaccurate personal data concerning you, including the right to correct or complete your personal data.

• Right to erasure ("right to be forgotten")

You may request that your personal data to be erased by VMPS provided that: the data is no longer necessary for the purposes for which they were collected; when you withdraw your consent and there are no other grounds valid for its retention; when you oppose the data processing and there are no legitimate interests prevailing on VMPS part, as well as in other legally foreseen situations.

• Right to Data Portability

You have the right to obtain your personal data provided to VMPS in a structured, commonly used and machine-readable format, as well as the right to transmit that data to another controller (if technically possible) without VMPS being able to prevent it, and if processing is based on consent or a contract, and if the processing is carried out by automated means.

• Right to Withdraw Consent

You may at any time alter your consent, restrict it to certain types of processing or withdraw it, however, withdrawal of consent does not compromise the lawfulness of the processing made based on the consent previously given.

• Right to Object

At any time, you may also object to your personal data processing, where there are no overriding and legitimate reasons for that processing which prevail over your interests, rights and freedom, or for the purposes of establishment, performance or defense of legal claims.

• Right to Restriction of Processing

In certain situations you have the right to limitVMPS’s processing of your data, in particular if you dispute the accuracy of personal data during a period that allows VMPS to verify its accuracy, in cases where data is no longer required for the purposes of the treatment but are required by the data subject for the purposes of establishment, exercising or defending a right in a judicial proceeding, as well as in other cases legally foreseen.

• Right not to be subject to any automated decision

You may also have the right not to be subject to any decision taken solely based on automated processing, including profiling that produces legal effects or similarly significantly affects you.

5.1. How to claim your rights?

You may claim your rights free of charge, except in the case of a manifestly unfounded or excessive request, in which case a reasonable fee may be charged.

We will respond to your requests within 30 days, maximum, except in cases of more complex requests.

You may claim your rights through the following e-mail address: privacy@superbockgroup.com

Nevertheless, and if you are not satisfied with our response after claiming any of these rights, you have the right to file a complaint with the CNPD (Portuguese Data Protection Authority), Rua de São Bento, No. 148, 3rd, 1200 -821 Lisbon, Tel: 351 213928400, Fax: +351 213976832, e-mail: geral@cnpd.pt).

6. Processing Measures and Security Techniques

VMPS makes use of appropriate physical, technological, organizational and security measures to protect personal data. We aim at protecting personal data made available to us against dissemination, loss, misuse, alteration, processing or unauthorized access.

7. Data Protection Officer

VMPS has a Data Protection Officer (DPO), which (i) supervises and advises the controller of the obligations under the rules of privacy and protection of personal data, (ii) cooperates with the CNPD (iii) and is the person in contact with the customer, or potential customer, to clarify possible questions about the processing of data made by VMPS.

If you wish to clarify any doubts or make a complaint, you may do so to the following e-mail address:privacy@superbockgroup.com

8. Privacy Policy Update

VMPS reserves the rightn to update, at any time, this Privacy Policy. Therefore, it is recommended to periodically consult this policy on our website to stay informed about the processing of your personal data.

Without prejudice to the consultation of this policy on our website, VMPS will inform you of the changes made through the various communication channels used.