OUR COMMITMENT TO YOUR PRIVACY
Responsible, transparent and secure processing of your personal data
1. Introduction
Aparthotel Imperatriz respects your privacy and is committed to protecting your personal data.
This Privacy Policy explains how we collect, use, store and protect personal data when you visit our website, contact us, make a reservation, use our services or interact with our loyalty programme.
Personal data is processed in accordance with the General Data Protection Regulation (EU) 2016/679, the Portuguese Law No. 58/2019 of 8 August and all other applicable data protection legislation.
By using this website or providing your personal data to us, you acknowledge that your data will be processed in accordance with this Privacy Policy.
2. Data Controller
The data controller responsible for processing your personal data is:
Aparthotel Imperatriz
Rua Imperatriz D. Amélia 72
9000-018 Funchal
Madeira, Portugal
Email:
Phone: +351 291 233 456
Where applicable, references to “we”, “us” or “our” in this Privacy Policy refer to Aparthotel Imperatriz.
3. Personal Data We May Collect
Depending on how you interact with us, we may collect and process the following categories of personal data:
Identification and contact data
Name, surname, email address, telephone number, address, country of residence and other contact details.
Reservation and stay data
Arrival and departure dates, room or studio preferences, number of guests, special requests, booking details, payment status, reservation history and information necessary to manage your stay.
Payment and billing data
Payment method, billing details, tax identification number when required, invoice information and transaction references.
We do not intentionally store full payment card details on our website unless this is required and handled through a secure payment provider.
Communication data
Messages sent through contact forms, emails, telephone requests, complaints, feedback or other communications with our team.
Loyalty programme data
If you register for a loyalty card or membership programme, we may process your membership details, card number, QR code or identification code, benefits, status and related activity.
Technical and website usage data
IP address, browser type, device information, pages visited, date and time of access, referring pages and information collected through cookies or similar technologies.
Legal and security data
Information required to comply with legal obligations, security requirements, guest registration obligations, fraud prevention, accounting, tax or administrative procedures.
4. How We Collect Personal Data
We may collect personal data directly from you when you:
- make a reservation through our website or booking engine;
- contact us by email, telephone or contact form;
- check in or stay at the hotel;
- request information about our services;
- register for a loyalty card or membership programme;
- subscribe to communications, where applicable;
- use our website or interact with our online services.
We may also receive personal data from third parties, such as booking platforms, travel agencies, payment providers or other partners involved in your reservation or stay.
5. Purposes of Processing
We process personal data for the following purposes:
Reservation management
To process, confirm, modify or cancel reservations and to provide accommodation services.
Guest services
To manage your stay, respond to requests, provide assistance, handle special requirements and improve the guest experience.
Communication
To reply to enquiries, provide information, manage complaints and communicate with you before, during or after your stay.
Billing and legal compliance
To issue invoices, comply with tax, accounting, legal, regulatory and administrative obligations.
Loyalty programme
To manage loyalty card registration, membership status, benefits, QR code validation and related services.
Website operation and security
To operate, maintain and protect our website, prevent misuse, improve functionality and ensure technical security.
Marketing communications
To send promotional communications, newsletters or offers only where we have a valid legal basis to do so, including your consent where required.
Service improvement
To analyse general use of our services, understand guest preferences and improve our accommodation, website and customer service.
6. Legal Basis for Processing
We process personal data only when we have a lawful basis to do so.
Depending on the situation, the legal basis may include:
Performance of a contract
When processing is necessary to manage your reservation, provide accommodation or deliver services requested by you.
Legal obligation
When processing is necessary to comply with legal, tax, accounting, administrative or regulatory obligations.
Legitimate interests
When processing is necessary for the normal operation of our business, website security, service improvement, fraud prevention, internal administration or communication with guests, provided that your rights and freedoms do not override those interests.
Consent
When you have given consent, for example for certain marketing communications, optional cookies or specific processing activities.
You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
7. Cookies and Similar Technologies
Our website may use cookies or similar technologies to ensure proper website operation, improve performance, analyse traffic and, where applicable, support marketing or personalisation.
Essential cookies may be necessary for the website to function correctly.
Non-essential cookies, such as analytics or marketing cookies, will only be used where legally permitted and, where required, after obtaining your consent.
You can manage or withdraw cookie consent through the cookie settings available on the website, where applicable.
You may also configure your browser to block or delete cookies.
For more information, please consult our Cookie Policy.
8. Sharing of Personal Data
We may share personal data with third parties only where necessary and lawful, including:
- booking engine providers;
- payment service providers;
- IT, hosting and website support providers;
- email and communication service providers;
- accounting, tax, legal or administrative service providers;
- public authorities, regulators, courts or law enforcement bodies where required by law;
- business partners involved in services requested by you;
- loyalty programme or QR code validation providers, where applicable.
Third-party service providers may only process personal data according to our instructions and must implement appropriate security and confidentiality measures.
We do not sell your personal data.
9. International Transfers
Whenever possible, personal data is processed within the European Economic Area.
If personal data is transferred outside the European Economic Area, we will ensure that appropriate safeguards are in place, such as adequacy decisions, standard contractual clauses or other legally recognised transfer mechanisms.
10. Data Retention
We keep personal data only for as long as necessary for the purposes for which it was collected.
Retention periods may vary depending on the type of data and the legal basis for processing. For example:
- reservation and guest data may be kept for the period necessary to manage the stay and respond to related requests;
- billing and accounting data may be kept for the legally required period;
- communication data may be kept for the time necessary to handle the request;
- loyalty programme data may be kept while the membership remains active or as required for administration;
- marketing data is kept until consent is withdrawn or objection is made, where applicable;
- technical and security data may be kept for a limited period necessary to protect the website and systems.
When personal data is no longer required, it will be deleted, anonymised or securely archived where legally required.
11. Data Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.
These measures may include access control, secure systems, restricted internal access, confidentiality obligations, regular monitoring and protection of digital infrastructure.
However, no method of transmission over the internet or electronic storage is completely secure.
We therefore cannot guarantee absolute security, but we take reasonable measures to protect your personal data.
12. Your Rights
Under applicable data protection law, you may have the following rights:
Right of access
You may request confirmation as to whether we process your personal data and obtain access to that data.
Right to rectification
You may request correction of inaccurate or incomplete personal data.
Right to erasure
You may request deletion of your personal data where legally applicable.
Right to restriction of processing
You may request restriction of processing in certain circumstances.
Right to data portability
Where applicable, you may request to receive personal data provided by you in a structured, commonly used and machine-readable format.
Right to object
You may object to processing based on legitimate interests or to processing for direct marketing purposes.
Right to withdraw consent
Where processing is based on consent, you may withdraw your consent at any time.
Right not to be subject to automated decisions
You have the right not to be subject to decisions based solely on automated processing, including profiling, where such decisions produce legal or similarly significant effects.
13. How to Exercise Your Rights
You may exercise your rights by contacting us at:
To protect your privacy and security, we may need to verify your identity before responding to your request.
We will respond to requests in accordance with the time limits established by applicable data protection law.
14. Complaints to the Supervisory Authority
If you believe that your personal data has been processed in breach of applicable data protection law, you have the right to lodge a complaint with the Portuguese supervisory authority:
Comissão Nacional de Proteção de Dados — CNPD
You may also contact us first so that we can try to resolve your concern directly.
15. Children’s Privacy
Our website and services are not intended to knowingly collect personal data from children without the consent of a parent or legal guardian where required by law.
If we become aware that we have collected personal data from a child without appropriate authorisation, we will take steps to delete or appropriately handle that data.
16. Links to Third-Party Websites
Our website may contain links to third-party websites, platforms or services.
We are not responsible for the privacy practices, content or security of third-party websites.
We recommend that you read the privacy policies of any external websites you visit.
17. Updates to This Privacy Policy
We may update this Privacy Policy from time to time to reflect legal, technical or business changes.
The updated version will be published on this page with the date of the latest update.
Last updated: [insert date]
18. Contact
For any questions about this Privacy Policy or the way we process your personal data, please contact us:
Aparthotel Imperatriz
Rua Imperatriz D. Amélia 72
9000-018 Funchal
Madeira, Portugal
Email:
Phone: +351 291 233 456
