Commitment of the company MONTINHO DO POÇO, LDA,

The protection of privacy and personal data is a fundamental commitment of the company MONTININHO DO POÇO, LDA. to customers ("Customers") of its services and products.

The company Montinho do Poço Lda, takes appropriate measures to ensure the protection of your personal data, in compliance with applicable legislation, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data or General Data Protection Regulation (hereinafter "GDPR"). We therefore recommend that you review our Privacy Policy and its updates to ensure that you understand how your personal data is handled. If the Privacy Policy is modified, the date of the last modification, available at the bottom of this page, is also updated. If the change is material, a notice may also be posted on the Site.

What is personal data?

Personal data is all information relating to an identified or identifiable natural person. Also constituting personal data is the collection of distinct information that can lead to the identification of a particular person. Examples of personal data: first and last name, address, e-mail address, civil identification number, location data, an IP (internet protocol) address, connection logs (cookies).

Who is the data controller?

The company Montinho do Poço, Lda. located at Estrada do Clube Náutico S/N, 7480-107, Avis, [email protected] is responsible for the treatment of your data.

What data is collected and for what purposes?

Montinho do Poço, Lda collects two (2) types of information: personal information and anonymous information. Anonymous information is information that in general does not reveal your identity or does not relate directly to a specific individual. If anonymous information reveals your identity or relates to a specific individual, it will be treated as personal information.

Anonymous information includes: browser and device information; information collected through cookies, widgets and other technologies; demographic information and other information provided by you; and aggregate information. We collect anonymous information in several ways: through your browser or device, pixel tags and other similar technologies, analytics, IP address and aggregate information. We collect personal information in several ways: when you voluntarily provide it to us, such as when you contact us by phone, email or fax, when you make a reservation at our lodging, when you fill out a form, among others. We also collect personal information from other sources, such as public databases, marketing partners and other third parties. Personal information we collect Identification Data, such as, name, gender, age or date of birth, marital status, occupation, citizen card/passport/residence permit number and its expiration date, national or foreign tax number, and photograph; Contact Data, such as, address, email address, telephone and cell phone contacts, among others.

The data is collected and processed for the following purposes:

- Provision of services;

- Supply of goods;

- Execution of contracts and pre-contractual diligences

- Compliance with legal obligation;

- Legitimate interest

- Customer contact management;

- Invoicing and collection from the Customer;

- Client registration on the website;

- Informing the Customer, upon request, of the availability of new services, special offers and campaigns, updated information on existing activities in our accommodation and, in general, for marketing purposes of the company Montinho do Poço, Lda;

- Sending newsletters, opinion and satisfaction surveys and other information regarding services provided to the Customer;

For cases where it appears to be necessary, we will request your express consent before using the information for purposes other than those expressly provided for in this Policy and privacy. By providing your personal data to Montinho do Poço, Ltd. you consent to your personal data being treated in accordance with this Privacy Policy.

What is the period of data storage?

Your personal data will be kept for the period of time necessary to fulfill the purposes described in this Privacy Policy, unless a longer period of retention is required or permitted by law. The criteria used to determine our retention periods include:

- The length of the time period of the contractual relationship we have with you;

- Whether there is a legal obligation to which you are subject (for example, legal billing obligations require us to keep records of your transactions for a certain period of time before you can delete them);

- Whether retention is advisable in view of our legal position (such as prescription, litigation or regulatory investigations).

Can personal data be transmitted to third parties?

Your personal data may be transmitted to third parties. Third parties may have access to your personal data in their capacity as data controllers or only in their capacity as

processing of such data.

The company Montinho do Poço, Lda. may also transmit your personal data:

(i) to judicial and regulatory authorities;

(ii) to external consultants;

(iii) to third parties / collaborators who process our data;

(iv) in connection with legal proceedings;

(v) for the purpose of detection, prevention and investigation of serious crime;

(vi) to our advertising, plugins and content service providers. Personal information will only be transmitted in compliance with legal requirements and applicable regulations on data protection.

Montinho do Poço, Lda will ensure that transfers of your personal data to a third country outside of the European Union are done safely. We may share statistics and profile information with third parties, however such information will be anonymized so that the data subject cannot be identified. We will not sell your data and/or personal information to

other third parties.

What are the security procedures that ensure the protection of data?

The company Montinho do Poço, Ltd. takes all necessary and legally required precautions to ensure the privacy of your personal data processed and/or transmitted through its digital platforms, including physical security measures and other security measures, such as the use of firewalls and intrusion detection systems, the existence of a policy of access to information and logging. These precautions ensure the online and offline security of information. Whenever sensitive information is collected or used, the data is encrypted using the Secure Socket Layer (SSL) protocol. This technology is used to enhance the security of data transmission over the Internet by encrypting and protecting sensitive data and information using the HTTPS protocol. The SSL guarantees the holder of personal data that data will not be intercepted in a fraudulent way and that all information is treated with maximum security.

The company Montinho do Poço, Lda is not responsible for the content accessed through any link that leads the holder of personal data to navigate outside the digital platforms of the company Montinho do Poço, Lda, and the processing of personal data in these made, where such links are the responsibility of third parties. The websites and content of third parties are not subject to this Privacy Policy, so we recommend that whenever you browse these sites search and read carefully the privacy policies, as well as the terms and conditions applicable.

What are the rights of the holder of personal data

According to the RGPD, you are guaranteed the following rights:

Right to Information

- At the time of collection or processing, the personal data subject has the right to be informed of the following:

- Purpose of the processing;

- The person responsible for processing the data; - Entities to whom your data may be communicated;

- What compulsory and optional data will be collected.

Right of Access

- The holder of personal data has the right to access them, without restrictions or delay, as well as to know what information is available about the origin of the data, the purposes of processing and communication of the same to third parties.

Right of Rectification

- The holder has the right to demand that the data about him be accurate and current, and may at any time request its rectification to the data controller of Montinho do Poço, Lda.

Right to Forgetting

- The data subject has the right to have his/her data no longer processed, erased and deleted, under certain conditions, in the event that: They are no longer necessary for the purpose for which they were collected; The data subject withdraws his/her consent or objects to their processing;

- If the processing of the data does not comply with the legal provisions.

Right to Limitation of Processing

- The holder of personal data has the right to have their data limited to only what is essential for the purpose of the processing.

Right to Data Portability (transfer of data

- The data subject has the right to receive his/her data or to request the transmission of his/her data to another entity which becomes the new controller of his/her personal data (only if this is technically possible).

Right of objection

- You have the right to object, on request and free of charge, to the processing of your personal data for the purposes of direct marketing or any other form of prospecting and to the disclosure of your personal data to third parties, unless otherwise provided by law.

Right to Knowledge of a Data Breach

- The holder of personal data has the right to be informed if there is a security breach that compromises his/her data.

Right of Complaint to supervisory authority

- The personal data subject has the right to complain not only to the company's personal data controller, but also to the supervisory authority, the National Commission for Data Protection (www.cnpd.pt). If you wish to exercise your rights, please send your request to the contacts listed below.

Data Protection Officer

For any questions you may have concerning the protection of your personal data, please contact the Personal Data Protection Officer (DPO) at the following address: Email: [email protected].

Updating of the Privacy Policy

The present Privacy Policy is periodically reviewed by Montinho do Poço, Lda. so that its content may undergo updates.

The Privacy Policy and Data Protection of Montinho do Poço, Lda. was revised and published in January 2023