Privacy Policy

Data Protection Policy

How we process your data

Pursuant to Article 12 of the General Data Protection Regulation (GDPR), we are obliged to tell you how we process your data when you use our website. We take the protection of your personal data very seriously, and this Data Protection Policy is intended to provide you with details of how your data are processed and your statutory rights in this connection.

We reserve the right to amend the Data Protection Policy with future effect, in particular if the website is updated, if new technologies are deployed, if the legislative basis is amended or if relevant decisions are handed down by the courts.

We encourage you to review the Data Protection Policy from time to time and to keep a print-out or copy with your records.

Definitions

• "Website" means all of the controller's webpages hosted on the domain https://www.LisbonGolfVillas.com/.
• "Personal data" means any information relating to an identified or identifiable natural person ("data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Personal data therefore include a person's name, email address and telephone number, but also data about his or her preferences, hobbies and memberships.
• "Processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
• "Pseudonymisation" means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.
• "Consent" of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
• "Google" means Google, LLC 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; contact address in the European Union: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001.

Scope

The Data Protection Policy applies to all webpages hosted on the domain https://www.LisbonGolfVillas.com/. It does not apply to any linked websites provided by other companies.

Controller

The controller responsible for processing personal data within the scope of this Data Protection Policy is as follows:

Golden Lux Lda
Rua D. Antonio Caetano de Sousa 17
louis.dias@lisbongolfvillas.com
Tel.: +351 917271869

Security

We take extensive technical and organisational precautions to protect your personal data against unauthorised access, misuse, loss and other external interference. We review our security measures on a regular basis and ensure that they reflect the state of the art.

Your rights

You are entitled to exercise the following rights in respect of your personal data:

• right of access (Article 15 GDPR),
• right to rectification (Article 16 GDPR) or erasure (Article 17 GDPR),
• right to restriction of processing (Article 18 GDPR),
• right to object (Article 21 GDPR),
• right to withdraw consent (Article 7(3) GDPR),
• right to receive data in a structured, commonly used and machine-readable format ( "data portability") and right to transmit data to another controller provided the requirements laid out in Article 20(1)(a) and (b) GDPR are met (Article 20 GDPR)

You can exercise these rights by contacting us using the contact details provided above in the section entitled "Controller", or by contacting our appointed Data Protection Officer.

You also have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data (Article 77 GDPR).

Use of the website, access data

In general terms, you can use our website for purely informative purposes without disclosing your identity. When you visit the individual pages of our website, access data are transferred to our webspace provider, but these data are only processed for the purpose of displaying our website to you. They include:

• browser type/version
• operating system used
• browser software language and version
• host name of the end device accessing the website
• IP address
• requesting website
• content of the request (specific page)
• date and time of the server request
• access status/HTTP status code
• referrer URL (last page visited)
• quantity of data transferred
• time zone difference to Greenwich Mean Time (GMT)

Temporary processing of your IP address by the system for the duration of the session is necessary to ensure that the technical prerequisites are met for delivery of the website to your computer. However, IP addresses are immediately truncated and thus pseudonymised for this purpose. The legal basis for this processing is Article 6(1)(f) GDPR.

Access data are not used to identify individual users and are not combined with data from other sources. They are erased when they are no longer required to achieve the purpose of processing. If data are collected for the purpose of providing the website, they will therefore be erased when you leave the website.

IP addresses are stored in log files to guarantee the functionality of the website. Access data are also used to optimise the website and protect our information technology systems. They are not evaluated for marketing purposes. Generally speaking, they are erased after a period lasting no longer than thirty days; in individual cases, however, they may be processed after this period has expired. In such cases the IP address will be deleted or encrypted in such a way that it is no longer possible to assign it to the original client.

It is absolutely vital for us to collect data on the provision of the website and to process log file data in order to operate our website. You have the right to object to processing of this kind. You have a right to object on grounds relating to your particular situation, unless we can provide proof of compelling legitimate grounds for the processing that override your interests, rights and freedoms, or unless the processing is carried out for the establishment, exercise or defence of legal claims (Art. 21(1) of the General Data Protection Regulation [GDPR]). In the event that your objection is legitimate, we will review the situation and either stop processing the data, change how we process the data or notify you if there are compelling legitimate grounds for us to continue processing the data.

Cookies

In addition to the access data referred to above, cookies are also stored in the web browser of the end device you use to visit our website. Cookies are small text files containing a sequence of characters which are stored locally in the cache of the browser you use. Cookies do not form part of the PC system and cannot execute programs. Their purpose is to make our website more user-friendly. It may be necessary to use cookies for technical reasons or other purposes (e.g. analysis/evaluation of website usage).

a) cookies which are necessary for technical reasons

Certain parts of our website require the visiting browser to be identifiable even after moving to a different page. Cookies are used to process the following data in this connection:

• language settings
• log-in details

The user data collected by cookies which are necessary for technical reasons are not used to create user profiles. We also use session cookies, which store a session ID that assigns your browser's requests to the relevant session. Session cookies play a vital role in the delivery of our website. In particular , they allow us to recognise your end device when you return to our website. We use session cookies to recognise follow-up visits to our website by users who hold an account with us, and to avoid them needing to log in again every time. The legal basis for processing of this kind is Article 6(1)(f) GDPR. The purpose of session cookies is therefore to make it easier and more convenient for you to use our website. They are deleted as soon as you log out or close your browser.

The default setting for most browsers is to accept cookies automatically. You can object to cookies being used to process your data. You have a right to object on grounds relating to your particular situation, unless we can provide proof of compelling legitimate grounds for the processing that override your interests, rights and freedoms, or unless the processing is carried out for the establishment, exercise or defence of legal claims (Art. 21(1) GDPR). In the event of a justified objection on your part, we will examine the situation and either stop or modify the data processing or demonstrate to you our compelling legitimate grounds for continuing the processing. You can disable or restrict the transfer of cookies by changing the settings in your web browser. Cookies which have previously been stored can be deleted at any time. You can also arrange for this to take place automatically. If you disable the use of cookies on our website, it may no longer be fully functional.

b) Cookies not required for technical purposes

We also use cookies on the website that allow us to analyse users’ surfing behaviour. The following data is processed in the cookies, for example:

• Search terms entered
• Frequency of page views
• Use of website functions

These cookies are used to make the website easier to use and more attractive. The legal basis for this processing is Art. 6(1)(1)(f) GDPR. The cookies not required for technical purposes are deleted automatically when a session ends.

You may object to the processing of your data using cookies. You have a right to object on grounds relating to your particular situation, unless we can provide proof of compelling legitimate grounds for the processing that override your interests, rights and freedoms, or unless the processing is carried out for the establishment, exercise or defence of legal claims (Art. 21(1) GDPR). If you do not want cookies to be used, you can modify your browser settings to block cookies from being set at all or in specific situations, and to delete any cookies already stored. You can also configure the settings so that you are notified before any cookies are set. If you modify your browser settings for the use of cookies or disable cookies, the functionality of this website may be limited.

c) Cookie banner notification

When you visit the website, an information banner notifies you about the use of cookies and refers you to this privacy policy. It includes information about how to prevent the storage of cookies in the browser settings.

Contacting our company

When you make contact with our company, e.g. via email or the contact form on the website, we process the personal data you provide in order to respond to your request.

In order for us to handle requests submitted via the contact form on our website, we need a name or pseudonym, a valid email address and a telephone number. The following data are also processed when the message is submitted:

• IP address
• date/time of submission

The legal basis for processing of this kind is Article 6 (1) (f) GDPR or Article 6(1)(b) GDPR if contact is made with the aim of concluding a contract.

We process the personal data provided via the contact form solely in order to handle the request for contact. In the event that such a request is submitted via email, this too constitutes the necessary legitimate ground for processing the data. The other personal data processed when the contact form is submitted are used to prevent misuse of this form and to protect our information technology systems.

No data are transferred to third parties, regardless of whether contact is made via email or the contact form. The data are used exclusively to communicate with you. The data generated in this connection are erased once it is no longer necessary to process them; alternatively, the processing of these data is restricted in so far as possible in view of the mandatory retention periods.

You can object at any time to the processing of your personal data in connection with contact requests. You have a right to object on grounds relating to your particular situation, unless we can provide proof of compel-ling legitimate grounds for the processing that override your interests, rights and freedoms, or unless the pro-cessing is carried out for the establishment, exercise or defence of legal claims (Art. 21(1) GDPR). A right to object exists in particular if the processing is not required in order to perform a contract with you, which is outlined by us in the previous description of functions. This applies in particular if the processing of your data is no longer necessary to execute a contract with you, as explained previously. It may no longer be possible to continue handling your contact request in such cases. In the event that your objection is legitimate, we will review the situation and either stop processing the data, change how we process the data or notify you if there are compelling legitimate grounds for us to continue processing the data.

Processing and transfer of personal data for contractual purposes

We process your personal data if and to the extent that this is necessary to initiate, establish, execute and/or terminate legal relations with our company. The legal basis for processing of this kind is Article 6(1)(b) GDPR.

Once the relevant purpose has been achieved (e.g. the contract has been executed), the personal data will be blocked or erased rather than processed further unless we have obtained consent from you (e.g. consent to the processing of your email address for the sending of advertising emails), a contractual agreement exists, a statutory authorisation exists (e.g. authorisation to carry out direct advertising), or we have a legitimate interest (e.g. storage with a view to the later enforcement of claims) in continuing to store the data and are entitled to process them in so far as necessary in the relevant context.

We will transfer your personal data in the event that:

• such transfers are necessary for the establishment, execution or termination of legal relations with our company (e.g. in cases where data are transferred to a payment service provider/shipping company in order to execute a contract we have concluded with you) (Article 6(1)(b) GDPR), or
• the data are required by a subcontractor or vicarious agent engaged solely for the purpose of providing the services or products you have requested (unless you are expressly notified otherwise, such parties are only entitled to process the data in so far as necessary to provide the service or product), or
• an enforceable official order exists (Article 6(1)(c) GDPR) or
• an enforceable court order exists (Article 6(1)(c) GDPR) or
• a legal obligation exists (Article 6(1)(c) GDPR), or
• processing of the data is necessary to protect the vital interests of the data subject or another natural person (Article 6(1)(d) GDPR), or
• we are entitled or even obliged to transfer data in order to pursue our overriding legitimate interests (Article 6(1)(f) GDPR).

We will not otherwise transfer your personal data to other individuals, companies or authorities unless you have expressly consented thereto. The legal basis for processing of this kind is Article 6(1)(a) GDPR.

Processing and transfer of personal data in the online booking system

If you wish to make a booking in our online shop, you are required to provide personal data such as your name, address and email address in order to initiate and conclude the contract. The mandatory information required to process the booking and contract are clearly marked as such; any other information is provided voluntarily. We process your data in order to process the booking. To do this, we forward payment data in particular to the payment service provider selected by you or to our main bank. When processing your booking or booking enquiry, the booking information is also sent to external Internet booking engine operators (e.g. TourOnline AG, Borsigstraße 26, 73249, Wernau “DIRS 21”) for contract execution or preparation. The legal basis for the processing is Art. 6 ( 1 )(1)(b) GDPR.

The personal data processed in connection with your booking or booking enquiry is sent to the relevant operator of the holiday home, holiday villa or holiday apartment.

To prevent unauthorised third parties from gaining access to your personal data, the booking process on the website is encrypted using SSL technology.

We delete the data collected during this process once it no longer needs to be retained, or restrict processing if statutory retention periods apply. Due to mandatory regulations under commercial and tax law, we are required to store your address, payment and booking data for ten years. Two years after the contract has ended, we will restrict processing and reduce processing to that required for compliance with the applicable statutory obligations.

Comment function and reviews of accommodation on the website

You can leave comments and review accommodation on the website. When you do so, we process the following personal data:

• Email address
• Name provided (no obligation to provide your actual name; you may use a pseudonym).

The following data is also processed at the time of adding a comment or review:

• IP address
• Date/time of entry.

When publishing your entry, the email address that you provide is not published, only the name/pseudonym that you have entered. We do not review your entry before it is published. We reserve the right to remove entries at any time if they are found to be unlawful.

We process your email address and name/pseudonym so that, where necessary, we are able to determine whether the entry is a genuine experience report. Furthermore, we want to be able to contact you if we receive a complaint that your entry on the website is unlawful, and to be able to defend ourselves against complaints or claims that may be asserted against us as a result of your entry.

For this reason, we also process your IP address. We delete the IP address after one week. We process your email address for the duration of time that your entry remains on the website or while we are dealing with the entry in the context of a legal dispute.

If you or we delete your entry, we will process the email address, name provided and other information provided voluntarily until the statutory limitation periods expire for the prevention and defence reasons specified, but will restrict the processing of this data after six months.

We do not pass on data to third parties unless we are obligated to do so by law or on account of an official or judicial order or the transfer of data is required for the purposes of our legitimate interests. The legal basis for the processing is Art. 6(1)(1)(f) GDPR.

You may object to the processing of your provided data on grounds relating to your particular situation, unless we can provide proof of compelling legitimate grounds for the processing that override your interests, rights and freedoms, or unless the processing is carried out for the establishment, exercise or defence of legal claims (Art. 21(1) GDPR).

You may have your entry deleted by us at any time. To do this, it is sufficient to contact us via email or telephone using the contact details specified in the "Controller" section. You have the right to take action in accordance with the "Your rights" section, but we ask that you contact our company in the first instance in the event of any complaints.

Email marketing Advertising to existing customers

Unless you have objected to your email address being processed for this purpose, we reserve the right to process the email address provided by you upon reservation in accordance with the statutory provisions, during or after execution of the contract, in order to email you content on subjects such as the following:

• Other interesting offers from our portfolio
• Overview of potential leisure offers.

The legal basis for processing of this kind is Article 6(1)(f) GDPR. We process data in this way as a convenience for our customers and in order to improve the service we provide. We erase your data if you unsubscribe to the newsletter, and no later than two years after termination of the contract.

You can object to receiving direct advertising at any time without incurring any expenses other than the basic rate cost of sending the message. You have a general right to object without specifying the reasons for doing so in this respect (Art. 21(2) GDPR). In order to do so, click on the unsubscribe link in the newsletter or forward your objection to the contact address provided in the section above entitled "Controller".

Newsletter

You have the option of subscribing to our email newsletter on the website, which we use to keep you regularly informed about our portfolio offers. The provision of a valid email address is required in order to receive the newsletter.

The double opt-in process is used for subscription to our email newsletter. Following provision of the data marked as mandatory, we send an email to the email address that you provided in which we ask you to explicitly confirm your subscription to the newsletter (by clicking on a confirmation link). If we do not receive confirmation within 24 hours, we block the information provided to us and delete it automatically after one month at the latest.

The following data is also processed at the time of subscribing:

• IP address
• Date/time of subscription and confirmation
• Gender, First name, Last name, Email address
• Booking date, Check-out date, Number of fellow travellers
• Apartment-ID, Domain

We process your IP address, the time of subscription and the time of your confirmation in order to document your newsletter subscription and to prevent the misuse of your personal data. The legal basis for the processing is Art. 6 ( 1 )(1)(f) GDPR. We process this data up to two years after the end of the contract. We delete this data when the newsletter subscription ends.

Following receipt of your confirmation, we process the email address and name/pseudonym of the recipient concerned for the purposes of sending our email newsletter. The legal basis for the processing is Art. 6 ( 1 )(1)(a) GDPR. We delete this data when you end the newsletter subscription.

You may withdraw your consent at any time by notified us or by clicking on the unsubscribe link in the newsletter. The lawfulness of the processing carried out based on the consent up to the time of withdrawal of consent is not affected by the withdrawal (Art. 13(2)(c) GDPR).

We analyse your user behaviour when sending the newsletter. For the purposes of this analysis, the emails sent contain tracking pixels. To perform the analysis, we link the data specified in the "Access data" section and the web beacons to your email address and an individual ID. Links contained in the newsletter also contain this ID.

Using the data acquired, we create a user profile in order to tailor the newsletter to your personal interests. Following unsubscription, we process the data anonymously and purely for statistical purposes. The legal basis for the processing is Art. 6(1)(1)(f) GDPR. You have a general right to object to data processing for the purposes of direct advertising without specifying the reasons for doing so (Art. 21(2) GDPR).

Application process

We are delighted that you have taken an interest in us and are applying for or have applied for a position in our company. We process the data that is necessary for the online application process (name, email address and location) as well as data that you have provided to us in connection with your application in order to assess your suitability for the position and to carry out the application process.

The legal basis for the processing of your personal data in the context of this application process is primarily Section 26 of the German Federal Data Protection Act (Bundesdatenschutzgesetz — BDSG). Applicant data is deleted after six months in the event of rejection (or two years if you consent to further retention in our applicant pool).

Hosting

External hosting companies provide infrastructure and platform services, computing capacity, memory resources and database services, security and technical maintenance services. All of the data necessary to operate and use our website are processed in this connection. The legal basis for processing of this kind is Article 6(1)(f) GDPR.

Integration of third-party content

Third-party content (such as videos, maps, RSS feeds and graphics from other websites) is integrated into the website. The providers of this content ("third parties") require access to our users' IP addresses in order to send the content to their browsers. Some of the third parties may process data outside the European Union. You can exercise your right to object by installing a JavaScript blocker like "NoScript" or disabling JavaScript in your browser, though this may restrict website functionality.

Google Web Fonts

We use Web Fonts, which are provided by Google, to ensure the uniform presentation of fonts. When accessing a page, your browser loads the required Web Fonts in your browser cache. To do this, your browser must establish a connection with the Google servers. Google Web Fonts are used in the interests of ensuring the uniform, attractive presentation of our website. This constitutes a legitimate interest within the meaning of Art. 6(1)(1)(f) GDPR.

Google Maps

This website uses the "Google Maps" service provided by Google to display maps. Google is told when you visit the relevant sub-pages of our website. The data referred to in the section "Access data" are also transferred to Google. Google stores your data as usage profiles and processes them for the purpose of advertising, market research and/or demand-oriented design of its website. The legal basis for processing of this kind is Article 6(1)(f) GDPR.

Statistical, analytics and marketing services

We use third-party statistical, analytics and marketing services to optimise our website. These third parties use cookies to deliver their services. You have a right to object on grounds relating to your particular situation (Art. 21(1) GDPR).

Google Analytics

We use Google Analytics to tailor our website to your interests. It uses cookies stored on your computer to analyse your use of the website. The legal basis for the processing of data by Google Analytics is Article 6 (1) (f) GDPR. Google Analytics cookies are erased after a period of no more than 14 months. You have the right to object to this processing by installing a browser plug-in or disabling cookies.

Usage-based online advertising

Facebook Custom Audiences

The website uses the "Website Custom Audiences" function and the "Facebook pixel" provided by Facebook Inc. This allows website users to see personalised advertisements when visiting Facebook or other websites. The legal basis for the processing of your data is Article 6 (1) (f) GDPR.

Facebook Analytics

Our website uses Facebook Analytics to track your user behaviour. The aim is to evaluate our web-based activities more accurately and improve the service we provide. Your data are processed on the basis of Article 6(1)(f) GDPR.

Google AdSense

The website uses the online advertising service Google AdSense to enable adverts tailored to your interests to be displayed. For this purpose, statistical information is collected about you. The legal basis for the processing of your data is Art. 6 ( 1 )(1)(f) GDPR.

Google AdWords Conversion

We use the Google Adwords service and Ad Server cookies which track metrics like ad impressions or user clicks to gauge the success of advertising campaigns. The legal basis for the processing of your data is Article 6 (1) (f) GDPR.

Google Remarketing

This application helps us to get in touch with you again by displaying our advertisements on other websites after you have left our website. The legal basis for processing of this kind is Article 6(1)(f) GDPR.

Intent Media

We use the Intent Media service to display interest-related offers and adverts. Intent Media collects personal data on usage behaviour for this purpose. The legal basis is Art. 6 ( 1 )(1)(f) GDPR.

Bing Ads

We use the conversion and tracking tool Bing Ads to analyse the use of our website. Microsoft stores a cookie on your computer if you reached our website via a Bing Ads advert. The legal basis is Art. 6 ( 1 )(1)(f) GDPR.

Social network plug-ins

Social network plug-ins from Facebook, Google, Instagram, Twitter, and Github are integrated on our website. Through the activation of the plug-in by clicking on it, your personal data is sent to the relevant plug-in provider. The legal basis for the use of the plug-ins is Art. 6 ( 1 )(1)(f) GDPR.