Privacy Policy

1. ABOUT US

DATA CONTROLLER HEAD OFFICE TAX ID EPD/DPO

ASSOCIAÇÃO DE TURISMO DO PORTO, also known as ASSOCIAÇÃO DE TURISMO DO PORTO E NORTE DE PORTUGAL - ATPN, (hereinafter, ATPN) Rua Miguel Bombarda, 211, 4050-381 Porto (PORTUGAL) 503.393.517 ATPN has appointed a Data Protection Officer who can be contacted by email at jsampaio@portocvb.com.

ABOUT US

Associação de Turismo do Porto e Norte, A.R. - Porto Convention & Visitors Bureau is a non-profit organisation founded in 1995 with the aim of developing and promoting Porto and the North of Portugal as a tourist destination, making a decisive contribution as a catalyst for a prestigious image and reputation in various international markets. It owns the domain https://booking.visitportoandnorth.travel where this platform and the services available through the ATPN Marketplace (hereinafter, MARKETPLACE) are hosted.

2. WHAT IS THIS POLICY ABOUT?

2.1. This Privacy Policy explains how we collect and process the personal data necessary for providing MARKETPLACE and the services available through MARKETPLACE.

2.2. Examples of these services include, namely:

a. Promoting products, goods, and services from Partners;

b. Registering on MARKETPLACE;

c. Providing benefits to Users;

d. Subscribing to regular communications for information about general and personalised benefits and/or offers;

e. Purchasing products, goods and/or services from Selling Partners.

2.3. The aim is to provide MARKETPLACE and the aforementioned services in an expedient and hassle-free manner and in accordance with applicable legal standards, describing the practices adopted for this purpose.

3. WHAT IS PERSONAL DATA?

3.1. All information (regardless of its nature or medium) relating to a person and identifying that person.

3.2. It is also information that makes a person identifiable.

3.3. Identifiable means a person who can be identified, directly or indirectly, in particular by reference to an identification number or other specific elements of their physical, physiological, mental, economic, cultural, or social identity.

3.4. Examples of personal data we collect are 'name', 'email', 'VAT number', or 'address'.

4. JOINT PROCESSING WITH SELLERS.

4.1. FRAMEWORK:

ATPN will process personal data jointly with the PARTNER(S) you select, under the terms described below.

4.2. PURPOSES:

ATPN and the PARTNER(S) act as joint controllers solely and exclusively for the processing of personal data of Users/Consumers who use MARKETPLACE Turismo do Porto e Norte Portugal to purchase products, goods and/or services from those SELLER(S).

4.3. OTHER PURPOSES:

Should ATPN and/or the PARTNER(S) use the data for purposes other than those indicated, each will be considered for all intents and purposes as a data controller, autonomously and independently, and must comply with their obligations regarding privacy and data protection legislation.

4.4. LEGAL GROUNDS FOR PROCESSING:

Purchasing products, goods and/or services from SELLER(S):

Executing a contract to which the Data Subject is a party;
Legal obligation to which ATPN and the PARTNER(S) are subject.

4.5. TRANSPARENCY.

ATPN shall provide information on the processing of personal data carried out in connection with the purchase of products, goods and/or services from the PARTNER(S).

4.6. COMMUNICATIONS:

ATPN and the PARTNER(S) may communicate personal data to third parties, in compliance with the legal obligations of ATPN and/or the SELLER(S), or to subcontractors.

4.7. INTERNATIONAL TRANSFERS:

ATPN and the PARTNER(S) will not, by default, make any transfers to third countries outside the European Union. If such communication is necessary, measures will be taken to ensure that the level of protection guaranteed by European legislation is not compromised, in particular through appropriate guarantees.

4.8. SUBCONTRACTORS:

ATPN and the PARTNER(S) may subcontract activities to service providers bound by an agreement for the processing of personal data, in accordance with the legal requirements of the GDPR, other legislation, and best practices.

4.9. EXERCISING RIGHTS:

Rights may be exercised in accordance with Section 12 of this Policy. The response to the request to exercise rights with regard to the processing operations covered by this agreement is the responsibility of the SELLER(S), who undertake to inform ATPN. ATPN will fulfil its obligation to assist and collaborate with the SELLER(S) in responding to requests to exercise said rights.

4.10. PERSONAL DATA BREACH:

In the event of a personal data breach, ATPN and the PARTNER(S) undertake to provide assistance and collaborate. Notwithstanding the above, any personal data breach that occurs due to the operation of MARKETPLACE will be notified and reported by ATPN.

4.11. MORE INFORMATION:

More detailed information regarding how ATPN and the PARTNER(S) process personal data can be found in Annex 1 to the General Conditions of Sale.

5. HOW WILL WE USE YOUR PERSONAL DATA?

5.1. ATPN will use the personal data you provide for the following purposes:

PURPOSE

Registering on MARKETPLACE

DESCRIPTION

In order to be able to use MARKETPLACE and benefit from its advantages, particularly with regard to the purchase of products, goods and/or services from Selling Partner, it will be necessary to process the personal data strictly necessary for that registration.
The communication of personal data constitutes a contractual obligation, being a necessary requirement for concluding the distance purchase and sale contract (General Conditions of Sale), and the data subject is therefore required to provide personal data, without which ATPN will not proceed with the approval of the MARKETPLACE registration request.

PURPOSE

Purchasing products, goods and/or services from Selling Partners

DESCRIPTION

MARKETPLACE allows you to purchase products, goods and/or services from Selling Partners.
The communication of personal data constitutes a legal and contractual obligation, being a necessary requirement for purchasing products, goods and/or services from the Selling Partners, in accordance with the General Conditions of Sale, and the data subject is therefore required to provide personal data, without which ATPN and the SELLER will not proceed with the placement of the order and the sale of the products, goods and/or services.

PURPOSE

Analysing, answering, and managing your messages, customer support, and requests for information

DESCRIPTION

In order to be able to respond more adequately to your messages, particularly in the context of customer support and requests for information, ATPN requires a minimum set of personal data.
For users registered on MARKETPLACE, the communication of personal data for this purpose constitutes a contractual obligation, being a necessary requirement for ATPN to follow up on and provide proof of the analysis, response, and management of your messages, customer support, and requests for information.
For users not registered on MARKETPLACE, the communication of personal data for this purpose is a legal obligation, being a necessary requirement for ATPN to follow up on and provide proof of the analysis, response, and management of your messages, customer support, and requests for information.

PURPOSE

Enquiring about orders and status

DESCRIPTION

MARKETPLACE has a feature that allows you to keep track of your purchases and their status, making them easier to manage and providing greater transparency.
The communication of personal data constitutes a contractual obligation, since the personal data is necessary for placing the order and selling the products, goods, and/or services, and without this data ATPN will not follow up on your request with the SELLER.

PURPOSE	Sending newsletters or other publications that you requested and/or that may be of interest to you
DESCRIPTION	If you authorise it, you can subscribe to communications about benefits and/or general offers associated with MARKETPLACE. The communication of personal data for this purpose does not constitute a legal or contractual obligation, nor is it a necessary requirement for using MARKETPLACE and will always depend on your prior and express consent.

PURPOSE

Optimising your journey

DESCRIPTION

ATPN will monitor the use made by Users of MARKETPLACE in order to improve the User experience, particularly in the process of placing orders and making purchases, and this monitoring will be carried out using cookies.
The communication of personal data for this purpose does not constitute a legal or contractual obligation, nor is it a necessary requirement for using MARKETPLACE and will always depend on your prior and express consent.

PURPOSE

Information systems security

DESCRIPTION

ATPN has a legal obligation, namely under the General Data Protection Regulation and the Legal Framework for Cybersecurity, to ensure that MARKETPLACE operates securely and is not subject to malicious attacks. In the event of such attacks, ATPN must ensure that the impact on both MARKETPLACE and the Users and their personal data, which are processed by ATPN, is minimised.
The communication of personal data for this purpose is a legal obligation, being a necessary requirement for using the PLATFORM.

PURPOSE

Analysing data to detect fraud or improper use of MARKETPLACE

DESCRIPTION

ATPN is interested in ensuring that Users do not misuse MARKETPLACE, seeking to prevent fraudulent and prohibited activities, as outlined in the Terms of Use, which should be detected when they occur.
The communication of personal data for this purpose does not constitute a contractual obligation, being a necessary requirement for using MARKETPLACE, and the data subject has the right to exercise their right to oppose this processing at any time, under the terms and within the limits of the law.

5.2. These personal data processing operations are a necessary tool for your experience and satisfaction as a user and customer, but also for the operation of MARKETPLACE and the services associated with it, and are carried out in accordance with the applicable legislation and best practices.

5.3. Your personal data will not be reused for purposes other than those previously identified or unrelated to the purposes for which they were initially collected.

6. WHAT ARE THE GROUNDS FOR PROCESSING THE PERSONAL DATA WE COLLECT?

6.1 The personal data processed by ATPN have specific legal grounds depending on the purposes for which it is intended.

6.2. The following table shows the legal grounds according to the identified purposes:

PURPOSE	Registering on MARKETPLACE
GROUNDS	Pre-contractual enquiries at the request of the data subject; Execution of a contract (the General Conditions of Sale accepted upon registration) to which the data subject is a party.

PURPOSE	Purchasing products, goods and/or services from Selling Partners
GROUNDS	Pre-contractual enquiries at the request of the data subject; Legal obligation to which ATPN is subject.

PURPOSE	Analysing, answering, and managing your messages, customer support, and requests for information
GROUNDS	Legitimate interests (unregistered Users); Legal obligation (registered Users); Execution of the contract to which the data subject is a party (General Conditions of Sale) for registered Users.
DESCRIPTION OF THE LEGITIMATE INTERESTS	For users not registered on MARKETPLACE, the communication of personal data for this purpose is a legal obligation, being a necessary requirement for ATPN to follow up on and provide proof of the analysis, response, and management of your messages, customer support, and requests for information.

PURPOSE	Enquiring about orders and status
GROUNDS	Execution of a contract to which the data subject is a party (General Conditions of Sale).

PURPOSE	Sending newsletters or other publications that you requested and/or that may be of interest to you
GROUNDS	Consent.

PURPOSE	Optimising your journey
GROUNDS	Consent (cookies); ATPN's legitimate interests.
DESCRIPTION OF THE LEGITIMATE INTERESTS	ATPN is interested in monitoring the use made by Users of MARKETPLACE in order to improve the User experience, particularly in the process of placing orders and making purchases.

PURPOSE	Information systems security
GROUNDS	Legal obligation, namely under the General Data Protection Regulation and the Legal Framework for Cybersecurity.

PURPOSE	Analysing data to detect fraud or improper use of MARKETPLACE
GROUNDS	ATPN's legitimate interests.
DESCRIPTION OF THE LEGITIMATE INTERESTS	ATPN is interested in ensuring that Users do not misuse MARKETPLACE, seeking to prevent fraudulent and prohibited activities, as outlined in the Terms of Use, which should be detected when they occur.

7. WHAT PERSONAL DATA DO WE COLLECT?

7.1. ATPN will collect and process the following personal data, considered as minimum, necessary, and adequate for the respective purposes:

PURPOSE	DATA
Registering on MARKETPLACE	Name, Email, Address, Telephone, and VAT Number
Purchasing products, goods and/or services from Selling Partners	Name, Email, Address, Telephone, and VAT Number
Analysing, answering, and managing your messages, customer support, and requests for information	At the moment, the website does not yet allow submitting these messages.
Enquiring about orders and status	The same data collected when registering on MARKETPLACE
Sending newsletters or other publications that you requested and/or that may be of interest to you	At the moment, the website does not have this feature
Optimising your journey	IP
Information systems security	IP
Analysing data to detect fraud or improper use of MARKETPLACE	Name, Email, Address, Telephone, and VAT Number, IP

8. HOW DO WE COLLECT YOUR PERSONAL DATA?

8.1. We will collect your personal data through the forms on available on MARKETPLACE, but also through MARKETPLACE itself and the communication and interaction it has with your device, and also through the messages you send us.

8.2. Your personal data is collected through your device as follows:

a. Through your user and customer data;

b. Through your order placement and purchasing activities;

c. Through your messages in the context of user support and requests for information, and the respective contact details;

d. Through your subscription to the newsletter;

e. Through your browser;

f. Through cookies, pixel tags, and other similar technologies;

g. IP address.

8.3. ATPN undertakes to process your data in accordance with the law and in a legitimate manner.

8.4. ATPN will not sell, rent, or share your personal data with third parties. However, in the cases clearly identified in this Privacy Policy, ATPN may disclose your personal data to third parties. See Point 14 for more information.

8.5. The use of MARKETPLACE and the services provided by ATPN are not directed at minors, and no personal data of minors will be processed intentionally.

9. WHAT ARE COOKIES, TRACKING PIXELS AND OTHER SIMILAR TECHNOLOGIES?

9.1. Cookies are means of collecting information generated by a website and stored by your browser on the hard drive of your device.

9.2. Cookies may be strictly necessary for the operation of the website, for example to:

a. Identify and authenticate the user; or

b. Memorise the user's usual preferences; or

c. Allow the user to complete tasks without having to re-enter information (e.g. when changing pages or returning, as in the case of form data, shopping cart, etc.); or

d. Make, enable, facilitate, or support communications from/through the website; or

e. Provide some features requested by the user; or

f. Information systems security and/or fraud prevention.

9.3 These cookies necessary for the website to function will be stored on your device and do not require your consent.

9.4. Cookies can also be used to collect information for the following purposes:

a. Measuring and obtaining website usage statistics, e.g. number of unique visitors, detecting search engine keywords, detecting navigation aspects such as visit duration, most visited pages, or most accessed content (analytics cookies); or

b. Adapting advertising and marketing based on your behaviour and profile, customising the ads to be shown (tracking, advertising, analytics cookies); or

c. Third parties, other than ATPN, collecting your browsing information across different websites in order to create profiles (third-party cookies).

9.5. The storage of these tracking, advertising, analytics, and third-party cookies will always depend on your acceptance and prior consent, which can be withdrawn at any time using specific tools and/or your browser.

9.6. Similarly to cookies, tracking pixels, web beacons, and other similar tools are images and/or pieces of code that are loaded when the user visits a website, a page, or content, but also when they open an email.

9.7. These tools contain an external link to a server and allow tracking user behaviour to obtain data for purposes such as online marketing, analytics, but also retargeting marketing.

9.8. This is done as follows: when the user visits the destination website, this operation is recorded and noted in the server log files of the tool, and may include various pieces of information about the user, such as their operating system, duration visit, or IP address.

9.9. The storage of these tools will always depend on your acceptance and prior consent, which can be withdrawn at any time using specific tools and/or your browser.

9.10. To learn more about the cookies we use, you should consult the Cookie Notice, which you can access via the Cookie Management Tool located in the bottom left-hand corner of the screen.

9.11. To learn how to withdraw consent at any time, please refer to Section 13 of this Policy or open the Cookie Management Tool.

10. HOW DO WE PROTECT YOUR PERSONAL DATA?

10.1. Your personal data is kept secure through the adoption of various technical and organisational security measures aimed at ensuring the confidentiality, integrity, and availability of processing operations, for example by ensuring access is restricted to authorised persons only.

10.2. To protect your personal data, we only resort to data centre providers that offer us adequate and documented security measures, namely guarantees that your personal data is stored on servers maintained in controlled environments with limited access and resilience guarantees.

10.3. Personal data is stored on servers that provide us with adequate security guarantees to protect personal data against unauthorised disclosure, loss, misuse, alteration, processing or access, as well as against any other form of unlawful processing.

10.4. Similarly, when you browse MARKETPLACE, we protect your data with encryption, such as Transport Layer Security (TLS, a security protocol that protects internet telecommunications).

10.5. Although we take the care and precautions we deem appropriate to protect the personal data you provide and we collect, it's important to be aware that no security system is completely impervious.

10.6. We remind you to take certain precautions when browsing and using MARKETPLACE, especially when using public or shared networks, and we recommend that you keep your password secret and do not share it with other people (if you believe your password has been used improperly, please notify us immediately). You should also be careful to log in and log out whenever you close the browser.

11. HOW LONG DO WE KEEP YOUR PERSONAL DATA?

11.1. Your personal data will be kept for as long as necessary for the purposes for which it is intended, as outlined in this Privacy Policy. Therefore:

PURPOSE	Registering on MARKETPLACE
MAXIMUM TIME	Throughout the term of the Contract; Upon its termination, until the expiration of the limitation period for the corresponding rights.

PURPOSE	Purchasing products, goods and/or services from Selling Partners
MAXIMUM TIME	Throughout the duration of the period to which ATPN is obligated under the terms of the law.

PURPOSE	Analysing, answering, and managing your messages, customer support, and requests for information
MAXIMUM TIME	Throughout the term of the Contract; or Until the right to opposition is exercised.

PURPOSE	Enquiring about orders and status
MAXIMUM TIME	Throughout the term of the contract; Upon its termination, until the expiration of the limitation period for the corresponding rights.

PURPOSE	Sending newsletters or other publications that you requested and/or that may be of interest to you
MAXIMUM TIME	Throughout the term of the Contract, after consent has been obtained; or, Until consent is withdrawn.

PURPOSE	Optimising your journey
MAXIMUM TIME	Duration of the Cookies used, after consent has been obtained; or, Until consent is withdrawn.

PURPOSE	Information systems security
MAXIMUM TIME	5 years (Article 118(1)(c), Penal Code)

PURPOSE	Analysing data to detect fraud or improper use of MARKETPLACE
MAXIMUM TIME	Throughout the term of the Contract; or Upon its termination, until the expiration of the limitation period for the corresponding rights.

11.2. If the law provides for a specific or mandatory period, that data retention period shall apply.

11.3. Notwithstanding the above, the periods indicated do not affect the retention of personal data beyond those periods in the following situations:

a. until the limitation period for any rights related to that purpose has expired;

b. for the purposes of declaring, exercising, or defending ATPN's rights in legal proceedings;

c. pending the final judgement of a judicial decision in the event of litigation related to that purpose;

d. for the fulfilment of new legal obligations to which ATPN becomes subject;

e. for the fulfilment of orders from judicial authorities and/or criminal police bodies in the context of duly identified legal proceedings, in compliance with a reasoned order from the competent judicial authority;

f. for the fulfilment of acts issued by administrative authorities and competent regulatory bodies within the scope of their powers and competences, namely duly identified and reasoned administrative proceedings.

11.4. In all other cases, personal data will be retained for a maximum of the periods indicated above, periods that ATPN considers sufficient to fulfil the purposes indicated above.

11.5. At the end of the retention period, all personal data collected will be deleted or anonymised.

12. HOW YOU CAN EXERCISE YOUR RIGHTS:

12.1. Before we explain how you can exercise your rights, you should know what these rights are.

12.2. The legislation grants you the right to request the exercise of the following rights, which are exercised in accordance with and within the limits defined by law:

ACCESS	Confirmation of whether personal data concerning you is being processed and, if so, the right to access your personal data.
RECTIFICATION	Rectification of inaccurate personal data concerning you and the completion of your incomplete personal data.
DELETION	Deletion of your personal data when one of the reasons listed in the legislation applies.
LIMITATION	Limitation of processing if one of the situations listed in the legislation applies.
OPPOSITION	Oppose, at any time, to the processing of personal data concerning you or to be subject to decisions based solely on automated processing, including profiling.
PORTABILITY	Receive the personal data concerning you and that you have provided to us in a structured, commonly used, and machine-readable format.
WITHDRAWING CONSENT	Withdraw consent previously given for some processing activities.

12.3. You also have the right to lodge a complaint with the competent supervisory authority (in Portugal, the National Data Protection Commission at www.cnpd.pt).

12.4. In order to exercise the above rights, please contact ATPN by email at marketplace@portocvb.com.

12.5. You can also contact the Data Protection Officer at jsampaio@portocvb.com.

12.6. If you ask us to delete some or all of your personal data, we may not be able to provide you some of the services you have requested and ATPN may only retain the personal data necessary to fulfil its legal obligations.

13. HOW TO WITHDRAW CONSENT:

13.1. You have the right to withdraw your consent at any time and without any justification.

13.2. We remind you that withdrawing consent does not affect the lawfulness of processing carried out based on consent that had been previously given, and ATPN will keep a record of this consent in order to fulfil its legal obligations (to demonstrate the lawfulness of processing until the withdrawal of consent).

13.3. To withdraw consent:

PURPOSE	WHAT YOU CAN DO
Sending newsletters or other communications that you requested and/or that may be of interest to you	You will find the option to remove/unsubscribe at the bottom of the messages.
Optimising your journey	By opening the cookie management tool, which you can access via the tool in the bottom left-hand corner of the screen, you can adjust and set your preferences or delete these cookies in your browser settings; or By disabling cookies and other tools using your browser settings; or By using a blocking tool that can be installed as an extension to your browser.

14. WHEN DO WE COMMUNICATE DATA TO THIRD PARTIES?

14.1. ATPN may resort to third parties (subcontractors) to provide certain services, for example, data centre management, maintenance and technical support, marketing or payment management, communications and marketing, and they may have access to some of the personal data, namely the data necessary for the contracted purposes.

14.2. ATPN ensures that the entities that have access to the data are reliable and offer high guarantees of protection, never transmitting data to them beyond what is necessary for the provision of the contracted service(s). However, ATPN remains responsible for the personal data provided.

14.3. ATPN may also disclose your data to the following entities:

1. To Selling Partners who have shops on MARKETPLACE;

2. Other partners outside its corporate group (with your prior authorisation);

3. Tax Authority, for the purposes of complying with tax obligations;

4. Legal representatives and courts, for the purpose of representing, declaring, exercising, or defending ATPN's rights in legal proceedings;

5. Judicial authorities or competent criminal police bodies in the context of duly identified legal proceedings, in compliance with a reasoned order from the competent judicial authority.

15. THIRD-PARTY WEBSITES.

15.1. MARKETPLACE may contain links to other websites which may collect and process your personal data for the purposes of those websites, and such processing is the sole responsibility of the owners of those websites. ATPN bears no responsibility for their policies and/or practices.

15.2. Examples of such third parties include Facebook through the buttons on the PLATFORM, or Google through the videos (YouTube) on MARKETPLACE.

16. DATA TRANSFERS OUTSIDE THE EUROPEAN UNION.

16.1. By default, no data transfers will occur outside the European Union, and ATPN will make every effort to ensure that no such data transfers occur.

16.2. If data transfers to third countries outside the European Union are necessary, such as for the provision of services to ATPN, they will comply with legal requirements. This includes assessing the adequacy of the destination country's data protection regulations and ensuring that appropriate safeguards are in place for such transfers. No personal data will be transferred to jurisdictions that do not provide adequate security and protection guarantees.

17. MINORS.

17.1. MARKETPLACE's services are not aimed intended for individuals under the age of eighteen (18), in accordance with the Terms of Use and General Conditions of Sale, and we therefore ask that minors do not provide us with personal data through MARKETPLACE.

18. SPECIAL CATEGORIES OF PERSONAL DATA.

18.1. The ATPN would appreciate it if you did not send us or disclose any information relating to:

Physical or mental health, including information about the provision of health services or information revealing information about your health status;
Racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, or data relating to sex life or sexual orientation.

18.2. If you still send us or disclose these categories of personal data, they will be immediately deleted.

19. CHANGES TO THE PRIVACY POLICY.

19.1. ATPN reserves the right to adjust or change this Privacy Policy at any time, and such changes will be publicised.

20. OUR CONTACT DETAILS.

20.1. If you have any doubts or questions regarding this Privacy Policy, please contact us in writing at marketplace@portocvb.com.

21. LATEST VERSION.

PORTO (Portugal), 01.01.2024.