PRIVACY POLICY

Data controller

Saboia Residence, Lda., corporate entity no. 516172948, with registered office at Rua da Moeda, 4, 1200-275 Lisbon, is the data controller responsible for the processing of personal data collected through the website https://www.clubedolagohotel.pt, the forms made available therein, the booking process and the provision of the services of Clube do Lago Hotel.

For any questions relating to the processing of personal data or to exercise the rights provided for in this policy and under applicable legislation, the data subject may contact Saboia Residence, Lda. at geral@clubedolagohotel.pt.

The Data Protection Officer of Saboia Residence, Lda. is Claudia Lago, who can be contacted at geral@clubedolagohotel.pt.

2. Legal framework

For the purposes of this Privacy Policy, personal data is processed in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016), Law no. 58/2019 of 8 August, and all other applicable legislation.

3. Applicable principles

Saboia Residence, Lda. ensures that personal data is processed lawfully, fairly and transparently, for specified, explicit and legitimate purposes, in accordance with the principles of data minimisation, accuracy, storage limitation, integrity, confidentiality and accountability.

The entity only collects and uses data that is adequate, relevant and necessary for the purposes identified in this policy and, accordingly, adopts appropriate technical and organisational measures to protect personal data.

4. Categories of personal data processed

Depending on the relationship established with the data subject and the purpose of the processing, the following data may be processed, in particular:

Identification data, such as first name and surname;

Contact details, such as email address, telephone number and address;

Data relating to the customer’s booking, stay, preferences and requests;

Data required for invoicing and compliance with legal obligations;

Data relating to communications, information requests, complaints and reviews;

Technical data relating to the use of the website, as set out in the Cookie Policy;

Other data strictly necessary for a specific purpose, provided that such purpose is communicated to the data subject.

Saboia Residence, Lda. does not request excessive personal data or data that is not strictly necessary for the specific purpose of the processing. In particular, the data subject will never be asked, through forms or by email, to provide special categories of personal data that are not necessary to respond to their specific request.

5. Purposes and legal bases for data processing

Personal data may be processed for the following purposes:

  1. Management of information requests and contacts – for the purpose of responding to requests sent through the website, by email or through other contact channels. The legal basis for this processing is the taking of pre-contractual steps at the request of the data subject or, as applicable, the legitimate interest of the entity in responding to and managing the contacts received.
  2. Management of bookings and provision of accommodation services – for the purpose of receiving, processing, confirming and managing bookings, providing the requested services and communicating with the customer throughout the contractual relationship. The legal basis for this processing is the performance of the contract or the taking of pre-contractual steps at the request of the data subject.
  3. Invoicing and compliance with legal obligations – for the purpose of issuing and retaining accounting and tax documents and complying with other applicable legal obligations. The legal basis for this processing is compliance with a legal obligation.
  4. Communications necessary for the stay – for the purpose of sending confirmations, changes, operational information, instructions or other notices necessary for the performance of the booking or provision of the service. The legal basis for this processing is the performance of the contract or compliance with a legal obligation, as applicable.
  5. Promotional communications – for the purpose of sending newsletters, offers, campaigns or other marketing communications where there is a legal basis for doing so. Where the processing is based on consent, such consent will be requested separately, specifically and voluntarily, and the provision of the service will not in any way be conditional upon giving such consent.
  6. Evaluation of the customer experience – for the purpose of requesting comments, reviews or information about the stay experience. The legal basis for this processing is the customer’s consent.
  7. Exercise or defence of rights – for the purpose of managing complaints, audits, judicial or administrative proceedings and retaining information necessary for the defence of rights. The legal basis for this processing is compliance with legal obligations or a legitimate interest pursued by the data controller, as applicable.
  8. Website and premises security – for the purpose of preventing fraud, unauthorised access, security incidents and misuse. The legal basis for this processing is compliance with legal obligations or a legitimate interest pursued by the data controller.
  9. Cookies and similar technologies – for the purposes described in the Cookie Policy, available at https://www.clubedolagohotel.pt/politica-cookies/.

Saboia Residence, Lda. does not use consent as the legal basis for processing that is necessary to manage a booking, provide the contracted service or comply with a legal obligation where another applicable legal basis exists.

6. Consent

Where processing depends on the data subject’s consent, such consent will be requested through a free, separate, informed and unambiguous expression of wishes, by means of a clear affirmative action.

Submitting a form does not, in itself, constitute general consent to all processing purposes. Optional purposes, namely promotional communications, will be presented separately from the purposes necessary to manage the request or booking.

The data subject may withdraw their consent at any time, without affecting the lawfulness of processing carried out on the basis of consent previously given. Consent may be withdrawn by contacting geral@clubedolagohotel.pt or through the mechanism provided in the promotional communication itself, where applicable.

7. Recipients of personal data

Personal data may be disclosed, to the extent strictly necessary for the purposes described in this policy, to the following categories of recipients:

  1. Authorised employees and collaborators of Saboia Residence, Lda. who need access to the data in order to perform their duties;
  2. Providers of booking services, system hosting, IT maintenance, email, customer support and security services;
  3. Payment, accounting, invoicing and auditing service providers;
  4. Marketing or survey service providers, where there is a legal basis for the disclosure;
  5. Legal advisers, insurers and other professional service providers, where necessary for the exercise or defence of rights;
  6. Public entities and administrative, judicial or law enforcement authorities, where disclosure is required or permitted by law.

Saboia Residence, Lda. does not disclose personal data to third parties for purposes that are incompatible with those communicated to the data subject. Where a service provider processes personal data on behalf of Saboia Residence, Lda., all contractual and organisational safeguards required by applicable legislation will be adopted.

8. Retention periods

Personal data is retained only for the period necessary for the purposes for which it was collected, without prejudice to retention periods imposed by law or necessary for the exercise and defence of rights. In particular:

  1. Data relating to information requests is retained for the period necessary to respond to and manage any subsequent enquiries;
  2. Data relating to bookings and stays is retained for the duration of the contractual relationship and thereafter for the periods necessary to comply with legal, accounting or tax obligations or to defend rights;
  3. Data used for promotional communications is retained until consent is withdrawn, the data subject objects or the purpose ceases, without prejudice to retaining proof of consent and other legally applicable periods;
  4. Data relating to complaints, disputes or requests to exercise rights is retained for the period necessary to process them and for the applicable limitation periods;
  5. Technical data and cookies are retained for the periods indicated in the Cookie Policy.

When the purpose of the processing ceases and there is no basis for further retention, personal data will be deleted, destroyed or anonymised.

9. Rights of data subjects

Under the terms and within the limits provided for by the GDPR, the data subject may exercise the following rights:

  1. Right of access to their personal data;
  2. Right to rectification of inaccurate or incomplete data;
  3. Right to erasure of data where the legal requirements are met;
  4. Right to restriction of processing;
  5. Right to object to processing, particularly where it is based on legitimate interests or for direct marketing purposes;
  6. Right to data portability, where the legal requirements are met;
  7. Right to withdraw consent at any time, where processing is based on consent;
  8. Right not to be subject to a decision based solely on automated processing, including profiling, where applicable.

The exercise of a right may be subject to the limitations provided for in the GDPR or other applicable legislation, particularly where the retention of data is necessary to comply with a legal obligation or for the exercise and defence of rights.

10. Exercise of rights

Rights may be exercised by contacting geral@clubedolagohotel.pt. Saboia Residence, Lda. may request additional information necessary to confirm the identity of the applicant where there are reasonable doubts as to the identity of the person making the request.

Requests will be dealt with without undue delay and within the periods provided for by the GDPR. Where a request is not granted, the data subject will in all cases be informed of the reasons for the refusal and of the available means of complaint or appeal.

11. Complaint to the supervisory authority

Without prejudice to any other administrative or judicial remedy, the data subject has the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD), as the national supervisory authority for the protection of personal data, in accordance with the law.

Contact details and information regarding the CNPD are available at https://www.cnpd.pt.

12. Records of processing activities and accountability

Saboia Residence, Lda. maintains, where legally required, an internal record of processing activities under its responsibility, indicating the purposes, categories of data subjects and personal data, recipients, transfers, retention periods and applicable security measures.

13. Security

Saboia Residence, Lda. adopts appropriate technical and organisational measures to protect personal data against destruction, loss, alteration, disclosure or unauthorised access, taking into account the nature, scope, context and purposes of the processing and the risks to data subjects.

Access to data is restricted to persons who need it to perform their duties and who are subject to confidentiality obligations.

14. Changes to the policy

This policy may be updated to reflect legal, regulatory or technological changes or changes to the processing activities carried out by Saboia Residence, Lda.

The current version is available at https://www.clubedolagohotel.pt/politica-de-privacidade/, indicating the date of the latest update.

Last updated: 09/09/2026