Privacy and Data Policy

PRIVACY POLICY

IN COMPLIANCE WITH THE GENERAL DATA PROTECTION REGULATION (EU REGULATION 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL OF 27/04 2016), WE ALSO INFORM THE FOLLOWING ABOUT OUR PRIVACY POLICY:

A) Who is responsible for the processing of your data;

B) What data we collect from our customers and their purpose;

C) Who are the recipients of your data;

D) Where we store your data;

E) What are your rights when you provide us with your data;

F) How long we store your data;

G) Warranties

 

A) WHO IS RESPONSIBLE FOR THE PROCESSING OF YOUR DATA? (Controller)

The person responsible for the processing of Personal Data is the commercial company, Velvet Euphoria – Atividades Hoteleiras Lda, with the unique registration number and legal person 514987081, headquartered at Rua Câmara Pestana 23, 1150-082 Lisbon, in the parish of Arroios, municipality of Lisbon, Portugal.

To deal with matters/questions related to the processing of your personal data, you should contact us through the following means:

- Tel.: (+351) 210 108 412

- E-mail address: nair.amores@torelboutiques.com

- Address: Rua Câmara Pestana 23, 1150-082 Lisbon, in the parish of Arroios, municipality of Lisbon – Portugal.

 

B) WHAT DATA WE COLLECT FROM OUR CUSTOMERS, HOW DO WE USE IT, AND THE PURPOSE OF IT?

Our company collects the following types of personal data from customers:

-Full name

-E-mail address

-Phone or mobile number

-Address.

-NIF

-IBAN

 

The purposes of collecting and processing Personal Data are as follows:

   a. Marketing: we will use your personal data to communicate with you, send you information about our services, products and events, newsletter, promotions and invitations within the scope of the company's activity.

   b. Supply of products and services: we will use your personal data to fulfill and carry out a contract for the purchase and sale of our products/services or for a contract for the provision of services with our company.

   c. Communication: we may use your personal data to send you information/news related to services and/or products, or to send invitations, as well as to aid in matters relating to customer support;

   d. Recruitment: Velvet Euphoria – Atividades Hoteleiras Lda, during the staff selection and recruitment process, collects and processes the personal data of the respective candidates. The personal data processed will be those contained in the application form and the Curriculum Vitae, as well as all personal data that you spontaneously decide to transmit to Velvet Euphoria – Atividades Hoteleiras Lda, including, but not limited to, name, age, gender, photograph, data of contact information (email and phone number), education information, employment history.

   e. Video surveillance of the establishments of Velvet Euphoria – Atividades Hoteleiras Lda: The establishments of our company have a video surveillance system. The image recordings obtained are kept for a period of 30 days from the respective capture, after this period the images will be eliminated, without prejudice to being kept for a longer period by court order.

We further inform that you can unsubscribe from the Newsletter as well as any other communications identified above at any time, using the option we make available in each communication.

With the exception of treatment for the purpose of supplying products and services (treatment necessary for the performance of a contract), and treatment within the scope of recruitment processes, in which treatment is based on the legitimate interest of the company, the legal basis of data processing is the consent of the holders.

The Personal Data collected when placing an order or requesting the provision of service are necessary for the execution of the respective contract, so if the user, in any way, opposes the respective data processing, our company will not be able to comply with the execution of the contract.

C) WHO ARE THE RECIPIENTS OF YOUR DATA? WITH WHOM CAN VELVET EUPHORIA – ATIVIDADES HOTELEIRAS LDA SHARE YOUR PERSONAL DATA?

Your personal data may be disclosed by our company within its business group, as well as Velvet Euphoria – Atividades Hoteleiras Lda may subcontract third parties for the provision of certain services, such as marketing services (including sending sms and emailing) or website maintenance and digital providers, digital marketing software in the cloud, online marketing platform company. Therefore, your personal data may be processed by companies subcontracted by our company, namely for hosting web pages, sending information about products and services, special offers or invitations, email, answering customer questions about the services. However, we emphasize that these companies will only be provided the personal data necessary for the provision of the service in question.

In these cases, these third-party companies may need to access certain information and data from the data subjects. Velvet Euphoria – Atividades Hoteleiras Lda guarantees that, in such cases, these third parties will have limited access to the information of the data subjects, restricted only to the data necessary for the execution of the contracted tasks and that a contract has been granted between the parties regulates the protection of Personal Data, in which these third-party companies undertake not to reveal, in any way, Personal Data, nor to use them for purposes other than the provision of contracted services.

Our company does not intentionally collect personal information from people under 18 years old.

 

D) WHERE DO WE STORE YOUR DATA?

Our company stores your personal data in a database on online marketing platforms and on a data management software, and the customer's Personal Data is protected from unauthorized access, use or disclosure.

Our company follows technical, electronic and organizational procedures necessary and adequate to guarantee the security of your Personal Data and to prevent its loss, misuse or improper access.

It will only process your data for the purposes for which they were collected, under the terms set out in this Privacy Policy.

Our company takes proper steps to ensure that your information is accurate, complete and current, but it is up to the customer to update or correct their personal information when necessary.

 

E) WHAT ARE YOUR RIGHTS WHEN YOU PROVIDE US WITH YOUR DATA?

In accordance with applicable law, our company undertakes to respect the confidentiality of your personal information and guarantee the exercise of your rights to:

   a) Right to the protection of personal data (Article 1 GDPR-General Data Protection Regulation): that the regulation establishes the rules on the protection of natural persons with regard to the processing of personal data and the free movement of such data.

   b) Right to Information: our customers have the right to obtain clear, transparent and understandable information about how our company uses their personal data (article 13 GDPR - General Data Protection Regulation);

   c) Right to access to the information we have about the customer: in addition to the right to information, you can access your personal data that we process and keep, therefore, at any time you can request our company to access the information we have about you ( article 15 GDPR-General Data Protection Regulation);

   d) Right of Correction: you have the right to correct your personal data if they are incorrect, out of date or if you wish to complete them. To do so, you can contact us through the contacts mentioned above (article 16 GDPR- General Data Protection Regulation);

   e) Right to erasure or right to be forgotten (Article 17 GDPR - General Data Protection Regulation): you can ask us to delete your data. The right to erase data is commonly known as the “Right to be forgotten”, therefore, the data subject has the right to obtain from our company the erasure of their personal data, without undue delay and the company has an obligation to erase their data personal, without undue delay, when one of the following reasons applies:

  • a) Personal data are no longer necessary for the purpose for which they were collected or processed;
  • b) The holder withdraws the consent on which the data processing is based pursuant to article 6, paragraph 1, point a), or article 9, paragraph 2, point a) of the GDPR and if there is no other legal basis for such treatment;
  • c) The holder opposes the processing under the terms of article 21, paragraph 1 of the GDPR, and there are no prevailing legitimate interests that justify the processing, or the holder opposes the treatment under the terms of article 21. , no. 2 of the GDPR;
  • d) Personal data were processed unlawfully;
  • e) Personal data must be erased in order to fulfill a legal obligation arising from the law of the Union or of a Member State to which the controller is subject;
  • f) Personal data were collected in the context of the provision of information society services referred to in article 8, paragraph 1 of the GDPR;

   f) Right of opposition, including direct marketing: You can unsubscribe from our company's Newsletter or choose to be removed from our direct marketing communications at any time. (Article 21 GDPR - General Data Protection Regulation);

   g) Right at any time to withdraw your consent to the processing of data: you can withdraw your consent to the processing of data when such processing is based on your consent. Withdrawal of consent does not affect the legality of consent-based processing prior to withdrawal.

   h) Right to file a complaint with the CNPD: if you believe that the processing of your personal data carried out by our company violates applicable data protection legislation, you may file a complaint with the National Data Protection Commission ("CNPD"). Please do not hesitate to contact us before filing any complaint with the CNPD.

   i) Right to data portability: you have the right to move, copy or transfer data from our database to another (article 20 GDPR - General Data Protection Regulation);

   j) Right to limit the processing of data: you have the right to request the restriction of the processing of your data in the following situations: if you dispute the accuracy of the data, if the processing is unlawful and you do not want to delete your data, but only limit them, if the data is no longer necessary for our company, but necessary for the customer or if you have exercised the above-mentioned right of opposition, during the period of time in which our company analyzes whether your legitimate interests for the processing prevail or not over that right . (Article 18 GDPR - General Data Protection Regulation);

   k) Right to notification (Art. 19 of the GDPR): The data subject has the right to be notified of any rectification, removal or limitation of the processing that the controller has carried out as a result of a request for rectification, removal or limitation of the treatment.

   l) Right not to be subject to autonomous decisions (Art.22º of the GDPR): The data subject has the right not to be subject to any decision taken solely on the basis of automated processing, including the definition of profiles, which produces effects on the its legal sphere or that significantly affects it in a similar way.

The provisions of the previous paragraph do not apply if the decision:

  • a) Is necessary for the conclusion or execution of a contract between the data subject and a data controller;
  • b) Is authorized by the law of the Union or of the Member State to which the controller is subject, and in which appropriate measures are also foreseen to safeguard the rights and freedoms and legitimate interests of the data subject;
  • c) Is based on the explicit consent of the data subject.

     m) Right to be warned in case of breach of personal data (Article 34 of the GDPR): When the breach of personal data is likely to imply a high risk for the rights and freedoms of individuals, our company will report the data breach to the data subject without undue delay.

     n) Rights related to the principles of the processing of personal data as enshrined in article 5 of the RGPD - General Data Protection Regulation;

To request the exercise of any of the rights listed above, in addition to the forms specifically referred to in the respective paragraphs, you may send a communication to the address identified above or by sending an email to the email address also mentioned above, which you can also use if you want to ask us any questions regarding this Privacy Policy.

 

F) How long do we store your data?

We only keep Personal Data for as long as is necessary to achieve the purpose for which it was collected, to respond to your needs or to comply with our legal obligations.

To determine how long we keep your data, we use the criteria set out below. If several criteria apply at the same time, we will keep your personal data in accordance with the criteria that imply the retention of your Personal Data for the longest time period.

 a) When purchasing products and/or services, we will keep your personal data for the duration of our business relationship, including any complaints that may arise, as well as for a period of two years after the termination thereof, without prejudice to the fulfillment of legal obligations of the controller;

 b) When you contact us with questions, we will retain your personal data for as long as necessary to resolve your issue;

 c) When making online reservations on our website, we will retain your data until you ask us to delete them or after a period of inactivity of two years;

 d) When you have consented to the sending of direct marketing, we will retain your personal data until you unsubscribe or ask us to delete it;

 e) Regarding the data collected in the recruitment process, for a maximum period of 1 year from the end of the process;

 f) The time period provided for in the applicable legislation; or

 g) Until the specific purpose applicable to certain data ceases to exist.

 

In any of these situations, if there is a pending judicial or administrative proceeding, the data will still be kept for the duration of the proceeding and up to six months after the final decision to be rendered.

We may also retain some of your personal data to the extent necessary to comply with our legal obligations, as well as to manage or enforce our rights, namely by resorting to legal proceedings.

After the above-mentioned conservation periods, the Personal Data will be deleted and/or erased in a secure way.

G) Warranties

The data owner warrants that the Personal Data communicated to our company is correct and accurate and undertakes to notify any changes or modifications to them and assumes exclusive responsibility for damages caused by erroneous, inaccurate or incomplete data communication.

The data owner is expressly warned that when revealing Personal Data in public media of our establishments (company) such as Facebook and Instagram, this information may be seen and used by third parties. We do not read any personal communications posted on your customers' own websites.