Privacy and Data Policy
For Galo Resort Hotels, the privacy and security of the personal data of our guests and other partners are of crucial importance.
This policy applies to all systems, people and processes that make up the Galo Resort Hotels’ information system. Galo Resort Hotels management has made a commitment to maintaining the security of personal data, a commitment that extends to all the organisation’s employees. Galo Resort Hotels promotes the security of information and protection in the processing of personal data collected through physical travel agencies and operators, Online Travel Agencies (OTA) and our online reservation tool (which is incorporated into the company’s website), and retained by the company.
We respect your privacy in the processing of your personal data. We would like to reiterate our commitment to the implementation of compliance measures, in particular to ensure:
a) The lawful processing of personal data, supported by a legal framework and the legitimate interest or consent of the data subject;
b) That processing is limited to the purpose for which the data was made available;
c) That mechanisms are put in place in order to ensure the accuracy and completeness of the data available;
d) That the data required is minimised, requesting only data that is necessary for the intended purpose;
e) A time limit on data storage in accordance with the retention periods defined; f) The implementation of measures to maintain the integrity and confidentiality of information.
Galo Resort Hotels is setting up procedures in order for the company to comply with the principles outlined above, and the requirements of the new General Data Protection Regulation (GDPR), for existing information systems and for prior impact assessment and implementation of measures for privacy in future data processing.
1. Galo Resort Hotels
Galo Resort Hotels is a tourist resort made up of 3 4-star hotels (Galo Sol, Alipno Atlântico and Galo Mar), which is in Caniço de Baixo on the Island of Madeira, Portugal. The resort provides accommodation and all related services for its guests, specifically a gym, restaurants and leisure and recreation facilities.
2. Categories of Personal Data processed by Galo Resort Hotels
In order to be able to function, and to provide a personalised service to guests during their stay, Galo Resort Hotels, as the entity responsible for the processing of the personal data of its guests, collects the following categories of data:
- Identification data (e.g. name, passport number, photo, signature);
- Demographic data (e.g. gender, date of birth, nationality, area of residence, postcode and country of residence);
- Contact details (e.g. address, mobile phone number, email address);
- Sensitive data, at the customer's request (e.g. dietary restrictions, personal preferences and health history)
- Financial data (e.g. Credit Card details)
3. Purposes of personal data processing: legal obligation, contractual relationships or legitimate interest
In order to fulfil its duties, by way of any contractual relationship, legal obligation and / or legitimate interest, Galo Resort Hotels may process your personal data for the purposes described below for each type of entity.
Personal data will be retained for a mandatory period, as required by law, depending on the purpose of the collection of data, for which the periods differ, whether it is a legitimate interest, regulation or required by law. Data will be processed according to the criteria applicable for retention of information and in accordance with the legal and regulatory obligations to which Galo Resort Hotels is subject.
The processing of personal data relating to children under 13 is only carried out with the consent of their parents or legal guardians.
- Reservation management e.g. name, email address, phone number and passport number
- Billing e.g. name, fiscal number, address;
- Ensuring guests have a safe, pleasant stay; e.g. food restrictions, mobility restrictions, health concerns;
Billing, e.g. name, fiscal number, address;
Reservations and vacancy management, e.g. name and mobile phone number
Pass to beach complex, e.g. name
4. Purposes of personal data processing by explicit consent from the data subject
Galo Resort Hotels may, with your explicit consent, process your data in order to guarantee a personalised welcome during your stay, specifically:
Retaining your personal preferences (e.g. sports, leisure and cultural preferences, dietary preferences or restrictions and special physical needs);
For sales/ marketing purposes and contact details related to sales/ marketing campaigns, such as the sending of newsletters. Guests always maintain the option to unsubscribe at any time.
5. Purposes of data processing through our website http://www.galoresort.com
For the convenience of its users, Galo Resort Hotels provides guests with the possibility of interacting with the hotel and making reservations online, through the website www.galoresort.com, where they can:
Contact the hotel to request general information. The online form requests the guest’s name, email address, mobile phone number, and country and area of residence.
Sign up to our Newsletter (name and email address required)
Make reservations online. ID information, contact details and payment information (required name, email address, phone number, city of residence, address, post code, country of residence and credit card details).
A cookie is a small amount of text sent to your browser by a website you visit. It helps the website to remember information about your visit and other settings, so we can make your next visit easier and more useful to you.
Technical Cookies: We use technical cookies to show you our website, to make them function correctly and try to give you an advanced, user-friendly website.
Functional Cookies: We also use these cookies to remember your preferences and help you use our website efficiently.
Analytics Cookies: We use analytics cookies to help us to understand how visitors engage with the website. It may use a set of cookies to collect information and report website usage statistics without personally identifying individual visitors. This means we can find out what works best to improve our website.
7. Sharing of personal information with third parties
In order for Galo Resort Hotels to be able to fulfil its duties and to provide you with a quality service, you may have to communicate with or give access to your personal data to third parties: In these cases, Galo Resort Hotels will only transmit your personal data to the following categories of recipients:
a) Entities and authorities to whom personal data must be passed on, due to legal obligation (The Foreigners and Borders Service (SEF) and the police)
b) The Portuguese Tax and Customs Authority
c) The company responsible for the application that makes reservations on our website: www.galoresort.com
d) Other entities necessary to the Resort’s management and operations, specifically: accounting, computer assistance, computer security and communications.
8. The Rights of Data Subjects Customers, as data subjects, are entitled to the following rights:
8.1. The Right to Access
You may request information, at any time, about how your personal data is processed by Galo Resort Hotels. You may also access your personal data, as well as obtain the following information:
- The purposes for which your personal data is processed;
- The type of personal data that is processed;
- The third parties your personal data may have been shared with, including EU institutions or international organisations;
- The period of retention for your data or, if this is not possible, the criteria used to define this period;
- Your rights in relation to the processing of your personal data;
- If personal data has not been collected from you, information about how it was collected and the type of data stored;
8.2. The Right to Correction
If you believe that your personal information (provided by you) is incomplete, you may request that it be completed, or you may request that it be corrected if it is found to be incorrect. (E.g. address, fiscal number, contact details, personal preferences).
8.3. The Right to Erasure
In certain circumstances, the data subject may request that their personal data be deleted. Galo Resort Hotels will inform you whether or not this right can be honoured, as retention obligations due to legal regulations or legitimate interest may prevent them from being able to do so.
8.4. The Right to Restriction of Processing
The right to restrict the processing of your personal data allows you to request the person responsible for processing the data to restrict the scope of access and processing of your personal data or to block the processing altogether.
You may request the restriction of processing of your personal data in the following cases:
If you contest the accuracy of your personal data, for a period of time that allows Galo Resort Hotels to verify its accuracy;
If Galo Resort Hotels no longer requires personal data for processing purposes, but if such data is necessary for the purposes of declaration, exercise or defence of a right in legal proceedings.
8.5. The Right to Data Portability
You may ask Galo Resort Hotels to send you the personal information you provide in a format that is structured, relevant and machine-readable. You also have the right to ask Galo Resort Hotels to pass this information on to another party responsible for processing it, as long as they are technically able to do so. The right to portability only applies in the following cases:
- Where processing is based on explicit consent or the signing of a contract;
- Where the processing in question is carried out automatically.
8.6. The Right to object to processing You have the right to object to the processing of your personal data at any time on grounds relating to your particular circumstances, and where the processing is performed for purposes other than those for which the data has been collected, but that the data is compatible with.
Galo Resort Hotels will, in such cases, cease to process your personal data, unless the Hotels have legitimate reasons to proceed with the processing, and that these reasons prevail over your interests. The exercise of your right to object may entail the suspension or termination, in whole or in part, of the benefits gained from the purpose of processing the data in question. You may also object to the processing of your data for direct marketing purposes.
8.7. The Right to Withdraw Consent
In cases where data is processed on the basis of your consent, you may withdraw your consent at any time. If you withdraw your consent, your personal data will no longer be processed unless on other grounds, such as legal and regulatory obligations or for the public interest of Galo Resort Hotels, which justifies such processing.
8.8. The Right to Complain to Galo Resort Hotels or any Supervisory Authority
You may exercise your rights free of charge, unless the application is manifestly unfounded or excessive, and in such cases a reasonable fee may be charged to cover any costs incurred. Replies to requests should be made within a maximum period of 30 days, unless it is a particularly complex request, in which case the time period may be longer.
Galo Resort Hotels has appointed a Personal Data Protection Officer, pursuant to articles 37, 38 and 39 of the General Regulation for Data Protection. You may contact the Galo Resort Hotels DPO and exercise your rights through the following channel: - E-mail: by e-mail, to the address: firstname.lastname@example.org
If you wish to file a complaint regarding matters related to the processing of your personal data, you may do so at the National Commission for Data Protection (CNPD), the Portuguese Data Protection Authority (www.cnpd.pt).
9. Changes to this policy