Privacy Policy
1. ABOUT US
| DATA CONTROLLER HEAD OFFICE TAX ID EPD/DPO | ASSOCIAÇÃO DE TURISMO DO PORTO, also known as ASSOCIAÇÃO DE TURISMO DO PORTO E NORTE DE PORTUGAL - ATPN, (hereinafter, ATPN) Rua Miguel Bombarda, 211, 4050-381 Porto (PORTUGAL) 503.393.517 ATPN has appointed a Data Protection Officer who can be contacted by email at jsampaio@portocvb.com. |
| ABOUT US | Associação de Turismo do Porto e Norte, A.R. - Porto Convention & Visitors Bureau is a non-profit organisation founded in 1995 with the aim of developing and promoting Porto and the North of Portugal as a tourist destination, making a decisive contribution as a catalyst for a prestigious image and reputation in various international markets. It owns the domain https://booking.visitportoandnorth.travel where this platform and the services available through the ATPN Marketplace (hereinafter, MARKETPLACE) are hosted. |
2. WHAT IS THIS POLICY ABOUT?
2.1. This Privacy Policy explains how we collect and process the personal data necessary for providing MARKETPLACE and the services available through MARKETPLACE.2.2. Examples of these services include, namely:
a. Promoting products, goods, and services from Partners;
b. Registering on MARKETPLACE;
c. Providing benefits to Users;
d. Subscribing to regular communications for information about general and personalised benefits and/or offers;
e. Purchasing products, goods and/or services from Selling Partners.
3. WHAT IS PERSONAL DATA?
3.1. All information (regardless of its nature or medium) relating to a person and identifying that person.
3.2. It is also information that makes a person identifiable.
3.3. Identifiable means a person who can be identified, directly or indirectly, in particular by reference to an identification number or other specific elements of their physical, physiological, mental, economic, cultural, or social identity.
3.4. Examples of personal data we collect are 'name', 'email', 'VAT number', or 'address'.
4. JOINT PROCESSING WITH SELLERS.
4.1. FRAMEWORK:- ATPN will process personal data jointly with the PARTNER(S) you select, under the terms described below.
4.2. PURPOSES:
ATPN and the PARTNER(S) act as joint controllers solely and exclusively for the processing of personal data of Users/Consumers who use MARKETPLACE Turismo do Porto e Norte Portugal to purchase products, goods and/or services from those SELLER(S).
4.3. OTHER PURPOSES:
Should ATPN and/or the PARTNER(S) use the data for purposes other than those indicated, each will be considered for all intents and purposes as a data controller, autonomously and independently, and must comply with their obligations regarding privacy and data protection legislation.
4.4. LEGAL GROUNDS FOR PROCESSING:
- Purchasing products, goods and/or services from SELLER(S):
- Executing a contract to which the Data Subject is a party;
- Legal obligation to which ATPN and the PARTNER(S) are subject.
4.5. TRANSPARENCY.
- ATPN shall provide information on the processing of personal data carried out in connection with the purchase of products, goods and/or services from the PARTNER(S).
4.6. COMMUNICATIONS:
- ATPN and the PARTNER(S) may communicate personal data to third parties, in compliance with the legal obligations of ATPN and/or the SELLER(S), or to subcontractors.
4.7. INTERNATIONAL TRANSFERS:
- ATPN and the PARTNER(S) will not, by default, make any transfers to third countries outside the European Union. If such communication is necessary, measures will be taken to ensure that the level of protection guaranteed by European legislation is not compromised, in particular through appropriate guarantees.
4.8. SUBCONTRACTORS:
- ATPN and the PARTNER(S) may subcontract activities to service providers bound by an agreement for the processing of personal data, in accordance with the legal requirements of the GDPR, other legislation, and best practices.
4.9. EXERCISING RIGHTS:
- Rights may be exercised in accordance with Section 12 of this Policy. The response to the request to exercise rights with regard to the processing operations covered by this agreement is the responsibility of the SELLER(S), who undertake to inform ATPN. ATPN will fulfil its obligation to assist and collaborate with the SELLER(S) in responding to requests to exercise said rights.
4.10. PERSONAL DATA BREACH:
- In the event of a personal data breach, ATPN and the PARTNER(S) undertake to provide assistance and collaborate. Notwithstanding the above, any personal data breach that occurs due to the operation of MARKETPLACE will be notified and reported by ATPN.
4.11. MORE INFORMATION:
- More detailed information regarding how ATPN and the PARTNER(S) process personal data can be found in Annex 1 to the General Conditions of Sale.
5. HOW WILL WE USE YOUR PERSONAL DATA?
5.1. ATPN will use the personal data you provide for the following purposes:| PURPOSE | Registering on MARKETPLACE |
| DESCRIPTION |
|
| PURPOSE | Purchasing products, goods and/or services from Selling Partners |
| DESCRIPTION |
|
| PURPOSE | Analysing, answering, and managing your messages, customer support, and requests for information |
| DESCRIPTION |
|
| PURPOSE | Enquiring about orders and status |
| DESCRIPTION |
|
| PURPOSE | Sending newsletters or other publications that you requested and/or that may be of interest to you |
| DESCRIPTION |
|
| PURPOSE | Optimising your journey |
| DESCRIPTION |
|
| PURPOSE | Information systems security |
| DESCRIPTION |
|
| PURPOSE | Analysing data to detect fraud or improper use of MARKETPLACE |
| DESCRIPTION |
|
5.2. These personal data processing operations are a necessary tool for your experience and satisfaction as a user and customer, but also for the operation of MARKETPLACE and the services associated with it, and are carried out in accordance with the applicable legislation and best practices.
5.3. Your personal data will not be reused for purposes other than those previously identified or unrelated to the purposes for which they were initially collected.
6. WHAT ARE THE GROUNDS FOR PROCESSING THE PERSONAL DATA WE COLLECT?
6.1 The personal data processed by ATPN have specific legal grounds depending on the purposes for which it is intended.
6.2. The following table shows the legal grounds according to the identified purposes:
| PURPOSE | Registering on MARKETPLACE |
| GROUNDS |
|
| PURPOSE | Purchasing products, goods and/or services from Selling Partners |
| GROUNDS |
|
| PURPOSE | Analysing, answering, and managing your messages, customer support, and requests for information |
| GROUNDS |
|
|
DESCRIPTION
OF THE LEGITIMATE
INTERESTS |
For users not registered on MARKETPLACE, the communication of personal data for this purpose is a legal obligation, being a necessary requirement for ATPN to follow up on and provide proof of the analysis, response, and management of your messages, customer support, and requests for information. |
| PURPOSE | Enquiring about orders and status |
| GROUNDS |
Execution of a contract to which the data subject is a party (General Conditions of Sale). |
| PURPOSE | Sending newsletters or other publications that you requested and/or that may be of interest to you |
| GROUNDS |
Consent. |
| PURPOSE | Optimising your journey |
| GROUNDS |
|
|
DESCRIPTION
OF THE LEGITIMATE
INTERESTS |
ATPN is interested in monitoring the use made by Users of MARKETPLACE in order to improve the User experience, particularly in the process of placing orders and making purchases. |
| PURPOSE | Information systems security |
| GROUNDS |
Legal obligation, namely under the General Data Protection Regulation and the Legal Framework for Cybersecurity. |
| PURPOSE | Analysing data to detect fraud or improper use of MARKETPLACE |
| GROUNDS |
ATPN's legitimate interests. |
|
DESCRIPTION
OF THE LEGITIMATE
INTERESTS |
ATPN is interested in ensuring that Users do not misuse MARKETPLACE, seeking to prevent fraudulent and prohibited activities, as outlined in the Terms of Use, which should be detected when they occur. |
7. WHAT PERSONAL DATA DO WE COLLECT?
7.1. ATPN will collect and process the following personal data, considered as minimum, necessary, and adequate for the respective purposes:| PURPOSE | DATA |
| Registering on MARKETPLACE | Name, Email, Address, Telephone, and VAT Number |
| Purchasing products, goods and/or services from Selling Partners | Name, Email, Address, Telephone, and VAT Number |
| Analysing, answering, and managing your messages, customer support, and requests for information | At the moment, the website does not yet allow submitting these messages. |
| Enquiring about orders and status | The same data collected when registering on MARKETPLACE |
| Sending newsletters or other publications that you requested and/or that may be of interest to you | At the moment, the website does not have this feature |
| Optimising your journey | IP |
| Information systems security | IP |
| Analysing data to detect fraud or improper use of MARKETPLACE | Name, Email, Address, Telephone, and VAT Number, IP |
8. HOW DO WE COLLECT YOUR PERSONAL DATA?
8.1. We will collect your personal data through the forms on available on MARKETPLACE, but also through MARKETPLACE itself and the communication and interaction it has with your device, and also through the messages you send us.8.2. Your personal data is collected through your device as follows:
a. Through your user and customer data;
b. Through your order placement and purchasing activities;
c. Through your messages in the context of user support and requests for information, and the respective contact details;
d. Through your subscription to the newsletter;
e. Through your browser;
f. Through cookies, pixel tags, and other similar technologies;
g. IP address.
8.3. ATPN undertakes to process your data in accordance with the law and in a legitimate manner.
8.4. ATPN will not sell, rent, or share your personal data with third parties. However, in the cases clearly identified in this Privacy Policy, ATPN may disclose your personal data to third parties. See Point 14 for more information.
8.5. The use of MARKETPLACE and the services provided by ATPN are not directed at minors, and no personal data of minors will be processed intentionally.
9. WHAT ARE COOKIES, TRACKING PIXELS AND OTHER SIMILAR TECHNOLOGIES?
9.1. Cookies are means of collecting information generated by a website and stored by your browser on the hard drive of your device.
9.2. Cookies may be strictly necessary for the operation of the website, for example to:
a. Identify and authenticate the user; or
b. Memorise the user's usual preferences; or
c. Allow the user to complete tasks without having to re-enter information (e.g. when changing pages or returning, as in the case of form data, shopping cart, etc.); or
d. Make, enable, facilitate, or support communications from/through the website; or
e. Provide some features requested by the user; or
f. Information systems security and/or fraud prevention.
9.3 These cookies necessary for the website to function will be stored on your device and do not require your consent.
9.4. Cookies can also be used to collect information for the following purposes:
a. Measuring and obtaining website usage statistics, e.g. number of unique visitors, detecting search engine keywords, detecting navigation aspects such as visit duration, most visited pages, or most accessed content (analytics cookies); or
b. Adapting advertising and marketing based on your behaviour and profile, customising the ads to be shown (tracking, advertising, analytics cookies); or
c. Third parties, other than ATPN, collecting your browsing information across different websites in order to create profiles (third-party cookies).
9.6. Similarly to cookies, tracking pixels, web beacons, and other similar tools are images and/or pieces of code that are loaded when the user visits a website, a page, or content, but also when they open an email.
9.7. These tools contain an external link to a server and allow tracking user behaviour to obtain data for purposes such as online marketing, analytics, but also retargeting marketing.
9.8. This is done as follows: when the user visits the destination website, this operation is recorded and noted in the server log files of the tool, and may include various pieces of information about the user, such as their operating system, duration visit, or IP address.
9.9. The storage of these tools will always depend on your acceptance and prior consent, which can be withdrawn at any time using specific tools and/or your browser.
9.10. To learn more about the cookies we use, you should consult the Cookie Notice, which you can access via the Cookie Management Tool located in the bottom left-hand corner of the screen.
9.11. To learn how to withdraw consent at any time, please refer to Section 13 of this Policy or open the Cookie Management Tool.
10. HOW DO WE PROTECT YOUR PERSONAL DATA?
10.1. Your personal data is kept secure through the adoption of various technical and organisational security measures aimed at ensuring the confidentiality, integrity, and availability of processing operations, for example by ensuring access is restricted to authorised persons only.
10.2. To protect your personal data, we only resort to data centre providers that offer us adequate and documented security measures, namely guarantees that your personal data is stored on servers maintained in controlled environments with limited access and resilience guarantees.
10.3. Personal data is stored on servers that provide us with adequate security guarantees to protect personal data against unauthorised disclosure, loss, misuse, alteration, processing or access, as well as against any other form of unlawful processing.
10.4. Similarly, when you browse MARKETPLACE, we protect your data with encryption, such as Transport Layer Security (TLS, a security protocol that protects internet telecommunications).
10.5. Although we take the care and precautions we deem appropriate to protect the personal data you provide and we collect, it's important to be aware that no security system is completely impervious.
10.6. We remind you to take certain precautions when browsing and using MARKETPLACE, especially when using public or shared networks, and we recommend that you keep your password secret and do not share it with other people (if you believe your password has been used improperly, please notify us immediately). You should also be careful to log in and log out whenever you close the browser.
11. HOW LONG DO WE KEEP YOUR PERSONAL DATA?
11.1. Your personal data will be kept for as long as necessary for the purposes for which it is intended, as outlined in this Privacy Policy. Therefore:| PURPOSE | Registering on MARKETPLACE |
| MAXIMUM TIME |
|
| PURPOSE | Purchasing products, goods and/or services from Selling Partners |
| MAXIMUM TIME | Throughout the duration of the period to which ATPN is obligated under the terms of the law. |
| PURPOSE | Analysing, answering, and managing your messages, customer support, and requests for information |
| MAXIMUM TIME |
|
| PURPOSE | Enquiring about orders and status |
| MAXIMUM TIME |
|
| PURPOSE | Sending newsletters or other publications that you requested and/or that may be of interest to you |
| MAXIMUM TIME |
|
| PURPOSE | Optimising your journey |
| MAXIMUM TIME |
|
| PURPOSE | Information systems security |
| MAXIMUM TIME | 5 years (Article 118(1)(c), Penal Code) |
| PURPOSE | Analysing data to detect fraud or improper use of MARKETPLACE |
| MAXIMUM TIME |
|
11.2. If the law provides for a specific or mandatory period, that data retention period shall apply.
11.3. Notwithstanding the above, the periods indicated do not affect the retention of personal data beyond those periods in the following situations:
a. until the limitation period for any rights related to that purpose has expired;
b. for the purposes of declaring, exercising, or defending ATPN's rights in legal proceedings;
c. pending the final judgement of a judicial decision in the event of litigation related to that purpose;
d. for the fulfilment of new legal obligations to which ATPN becomes subject;
e. for the fulfilment of orders from judicial authorities and/or criminal police bodies in the context of duly identified legal proceedings, in compliance with a reasoned order from the competent judicial authority;
f. for the fulfilment of acts issued by administrative authorities and competent regulatory bodies within the scope of their powers and competences, namely duly identified and reasoned administrative proceedings.
11.4. In all other cases, personal data will be retained for a maximum of the periods indicated above, periods that ATPN considers sufficient to fulfil the purposes indicated above.
11.5. At the end of the retention period, all personal data collected will be deleted or anonymised.
12. HOW YOU CAN EXERCISE YOUR RIGHTS:
12.1. Before we explain how you can exercise your rights, you should know what these rights are.
12.2. The legislation grants you the right to request the exercise of the following rights, which are exercised in accordance with and within the limits defined by law:
| ACCESS | Confirmation of whether personal data concerning you is being processed and, if so, the right to access your personal data. |
| RECTIFICATION | Rectification of inaccurate personal data concerning you and the completion of your incomplete personal data. |
| DELETION | Deletion of your personal data when one of the reasons listed in the legislation applies. |
| LIMITATION | Limitation of processing if one of the situations listed in the legislation applies. |
| OPPOSITION | Oppose, at any time, to the processing of personal data concerning you or to be subject to decisions based solely on automated processing, including profiling. |
| PORTABILITY | Receive the personal data concerning you and that you have provided to us in a structured, commonly used, and machine-readable format. |
| WITHDRAWING CONSENT | Withdraw consent previously given for some processing activities. |
12.3. You also have the right to lodge a complaint with the competent supervisory authority (in Portugal, the National Data Protection Commission at www.cnpd.pt).
12.4. In order to exercise the above rights, please contact ATPN by email at marketplace@portocvb.com.
12.5. You can also contact the Data Protection Officer at jsampaio@portocvb.com.
12.6. If you ask us to delete some or all of your personal data, we may not be able to provide you some of the services you have requested and ATPN may only retain the personal data necessary to fulfil its legal obligations.
13. HOW TO WITHDRAW CONSENT:
13.1. You have the right to withdraw your consent at any time and without any justification.
13.2. We remind you that withdrawing consent does not affect the lawfulness of processing carried out based on consent that had been previously given, and ATPN will keep a record of this consent in order to fulfil its legal obligations (to demonstrate the lawfulness of processing until the withdrawal of consent).
13.3. To withdraw consent:
| PURPOSE | WHAT YOU CAN DO |
| Sending newsletters or other communications that you requested and/or that may be of interest to you | You will find the option to remove/unsubscribe at the bottom of the messages. |
| Optimising your journey |
|
14. WHEN DO WE COMMUNICATE DATA TO THIRD PARTIES?
14.1. ATPN may resort to third parties (subcontractors) to provide certain services, for example, data centre management, maintenance and technical support, marketing or payment management, communications and marketing, and they may have access to some of the personal data, namely the data necessary for the contracted purposes.
14.2. ATPN ensures that the entities that have access to the data are reliable and offer high guarantees of protection, never transmitting data to them beyond what is necessary for the provision of the contracted service(s). However, ATPN remains responsible for the personal data provided.
14.3. ATPN may also disclose your data to the following entities:
1. To Selling Partners who have shops on MARKETPLACE;
2. Other partners outside its corporate group (with your prior authorisation);
3. Tax Authority, for the purposes of complying with tax obligations;
4. Legal representatives and courts, for the purpose of representing, declaring, exercising, or defending ATPN's rights in legal proceedings;
5. Judicial authorities or competent criminal police bodies in the context of duly identified legal proceedings, in compliance with a reasoned order from the competent judicial authority.
15. THIRD-PARTY WEBSITES.
15.1. MARKETPLACE may contain links to other websites which may collect and process your personal data for the purposes of those websites, and such processing is the sole responsibility of the owners of those websites. ATPN bears no responsibility for their policies and/or practices.
15.2. Examples of such third parties include Facebook through the buttons on the PLATFORM, or Google through the videos (YouTube) on MARKETPLACE.
16. DATA TRANSFERS OUTSIDE THE EUROPEAN UNION.
16.1. By default, no data transfers will occur outside the European Union, and ATPN will make every effort to ensure that no such data transfers occur.
16.2. If data transfers to third countries outside the European Union are necessary, such as for the provision of services to ATPN, they will comply with legal requirements. This includes assessing the adequacy of the destination country's data protection regulations and ensuring that appropriate safeguards are in place for such transfers. No personal data will be transferred to jurisdictions that do not provide adequate security and protection guarantees.
17. MINORS.
17.1. MARKETPLACE's services are not aimed intended for individuals under the age of eighteen (18), in accordance with the Terms of Use and General Conditions of Sale, and we therefore ask that minors do not provide us with personal data through MARKETPLACE.18. SPECIAL CATEGORIES OF PERSONAL DATA.
18.1. The ATPN would appreciate it if you did not send us or disclose any information relating to:- Physical or mental health, including information about the provision of health services or information revealing information about your health status;
- Racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, or data relating to sex life or sexual orientation.
19. CHANGES TO THE PRIVACY POLICY.
19.1. ATPN reserves the right to adjust or change this Privacy Policy at any time, and such changes will be publicised.20. OUR CONTACT DETAILS.
20.1. If you have any doubts or questions regarding this Privacy Policy, please contact us in writing at marketplace@portocvb.com.21. LATEST VERSION.
- PORTO (Portugal), 01.01.2024.