Privacy Policy

  

Privacy Policy


The protection of your personal data is important to us, which is why Haliotis has adopted solid principles on the protection of personal data.


Through this personal data protection policy, we intend to clarify for the user how we handle their personal data when using the HALIOTIS Website (hereinafter, "Website") and to comply with the provisions of the legislation on the protection of personal data, namely Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, "GDPR"), regarding the information to be provided to the user, the data subject.


Identity and contact details of the Data Controller and the Data Protection Officer:


When you use the Website, HALIOTIS processes your personal data as Data Controller for its own purposes (indicated below).


  • Name: Haliotis Atividades Marítimo Turísticas Lda ("HALIOTIS")
  • Registered office: Hotel Azoris Faial Garden, R. Cônsul Dabney, 9901-856 Horta
  • Tax ID (NIPC): 506 796 876
  • Data Protection Officer: DataProtectionOfficer@haliotis.pt


Purposes and legal basis for processing, personal data and retention periods:


When you use the Website, HALIOTIS collects personal data from the user (some necessary and mandatory, others optional, without which certain features may not work), namely:


  • To respond to contact requests, we collect the telephone contact, e-mail address and name, based on contractual execution (pre-contractual measures at the data subject's request) (pursuant to Article 6(1)(b) GDPR), retained for as long as necessary to prove compliance with legal obligations.
  • For the security and resilience of the Website (fraud prevention and detection), we collect IP address, service status, geolocation, device ID, device brand and model, device name, and device operating system, based on our legitimate interest in ensuring security and preventing fraud (Article 6(1)(f) GDPR), retained for 5 years (Article 118(1)(c) of the Portuguese Criminal Code).


WHAT PERSONAL DATA DO WE PROCESS?


We collect and process your personal data as part of our activities with the aim of achieving a high level of personalization of the products and services we provide to you.


We may collect various types of personal information about you, depending on whether you are:


A user accessing our website:


  • identification data (e.g. name, ID number and passport number, nationality, location and IP address);
  • contact information (e.g. postal address and e-mail address, telephone number);
  • data related to your habits and preferences;
  • data on the use of our products;
  • data from your interactions with us: contact records, our social networks, e-mails, chat conversations.


We never request personal data relating to your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, data concerning your sexual orientation, or data relating to criminal convictions and offences (criminal record data), unless required by a legal obligation.


SPECIFIC CASES OF PERSONAL DATA PROCESSING, INCLUDING INDIRECT PROCESSING


In certain circumstances, we may collect and process the personal data of individuals with whom we have, may have had, or have had a direct relationship, such as:


  • users who access our web pages;
  • potential or existing customers (wholesale or retail);
  • participants in our courses or events related to our activity.


WHY AND ON WHAT LEGAL BASIS DO WE USE YOUR PERSONAL DATA?


Compliance with legal and regulatory obligations: we may process your personal information to comply with various legal and regulatory obligations, namely:


  • Performance of a contract (commercial);
  • Legal obligation (Royal Legislative Decree 1/2007, of 16 November, and other complementary regulations, Commercial Code).


Performance of a contract: likewise, we process your personal information to enter into and perform our contracts, including for the following purposes:


  • information about our products and services;
  • helping you and responding to your requests;
  • assessing whether we can offer a product or service and under what conditions;
  • providing electronic products or services to our corporate clients, of which you may be an employee, shareholder, beneficiary or client.


We process your personal data to market our products or services, including:


  • personalizing our offer of products and services to you or the entity you represent;
  • improving the quality of our banking, financial or insurance products or services;
  • advertising products or services that match your circumstances and profile, carrying out activities such as: Segmentation of potential and current customers.


Should we need to carry out further processing for purposes other than those listed in the previous section, we will inform you and, where appropriate, obtain your consent to carry out such processing.


WITH WHOM MAY WE SHARE YOUR PERSONAL DATA?


To fulfil the purposes mentioned above, we only share your personal data with:


  • Service providers who perform services on our behalf;
  • Judicial authorities, state bodies or public bodies.


INTERNATIONAL DATA TRANSFERS


Personal data is processed within the territory of the European Union/European Economic Area (EU/EEA). HALIOTIS may, on occasion, transfer personal data outside the EU/EEA in a safe and lawful manner, ensuring that data is only transferred under the mechanisms permitted by Chapter V of Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data ("GDPR").


HOW LONG DO WE KEEP YOUR PERSONAL DATA?


We will keep your personal data for: (i) the period established by law; or (ii) the period necessary to fulfil our obligations. Most personal data collected in relation to a specific customer is kept for the duration of the contractual relationship with that customer, the tax period established after the end of the contractual relationship, or as required by applicable law.


WHAT ARE YOUR RIGHTS AND HOW CAN YOU EXERCISE THEM?


Depending on the data protection laws that apply, you have certain rights regarding your personal data. In accordance with the General Data Protection Regulation, you may exercise the following rights, through a written request addressed to HALIOTIS's Data Protection Officer at the address indicated above or to the following e-mail address: DataProtectionOfficer@haliotis.pt


  • Access: you can obtain information related to the processing of your personal data and a copy of such personal data;
  • Rectify: if you consider your personal data to be inaccurate or incomplete, you can request that such personal data be corrected;
  • Erasure ("right to be forgotten"): you can request the deletion of your personal data, to the extent permitted by law;
  • Restriction: you can request the restriction of the processing of your personal data;
  • Objection: you may object to the processing of your personal data for reasons related to your particular situation. You have the right to object to the processing of your personal data for direct marketing purposes, including profiling related to your activity;
  • Withdraw your consent: where you have given your consent to the processing of your personal data, you have the right to withdraw it at any time;
  • Data portability: where it is legally and technically possible, you have the right to receive the personal data you have provided in a portable format or, where technically possible, to have it transferred to a third party.


The user has the right to lodge a complaint regarding the protection of personal data with the National Data Protection Commission (CNPD), the national supervisory authority for the purposes of the GDPR and of Law No. 58/2019, of 8 August, which ensures the implementation of the GDPR in the national legal order.


SECURITY IN DATA PROCESSING:


HALIOTIS has implemented appropriate technical and organisational security measures to ensure the security of the personal data provided to it, aiming to prevent unauthorised alteration, loss, processing and/or access, taking into account the current state of technology, the nature of the data processed and the risks to which it is exposed, with the user being aware that security measures are not impregnable.


HOW CAN YOU CONTACT US?


If you have any questions about the processing of your personal data, about this Data Protection Notice, or if you would like a copy in your own language, please contact: DataProtectionOfficer@haliotis.pt


HOW CAN YOU FOLLOW CHANGES MADE TO THIS DATA PROTECTION NOTICE?


In a world of constant technological change, this personal data protection policy will be periodically reviewed and updated. We invite you to periodically check the most recent version of this notice.