SUBJECT
ROOM 00 PORTUGAL, S.A. is the Data Controller of the personal data of the clients of each of the hotels (hereinafter the “Users”). Through this Privacy Policy, and in compliance with Articles 12 and 13 of Regulation (EU) 2016/679 (hereinafter “GDPR”). Room00 Group informs Users who use the Website about the processing of their personal data that may be collected through this and processed by Room00 Group.

INFORMATION ABOUT THE DATA CONTROLLER
Data Controller: ROOM 00 PORTUGAL, S.A. 
Tax ID: 518984974
Registered Address: Rua Joaquim António de Aguiar, Nº 45, 2º Esquerdo, freguesia de Santo António, 1070-150 Lisboa, Portugal.
Contact: DPO@room00group.com

DATA PROCESSED, LEGAL BASIS, PURPOSES AND RETENTION PERIOD

1. Reservation Data
Data processed
- First name
- Last name
- Email address
- Telephone number
- ID/Passport number

Legal basis
- Performance of a contract to which the data subject is a party

Purpose
- Reservation management
- Processing reservation payments
- Managing reservation modifications and cancellations

Retention period
- Personal data will be processed during the contractual relationship between Room00 Group and the User.
- Subsequently, the data will be blocked for the period required to comply with legal obligations.
- Once these obligations have been fulfilled, the data will be permanently deleted.

2. Registration Details
Data processed

• First name

• Last name

• Gender

• ID number

• Nationality

• Date of birth

• Place of usual residence

• Full address

• Town/City

• Country

• Home telephone number

• Mobile telephone number

• Email address

• Relationship between travelers (where minors are involved)

Legal basis
- Compliance with a legal obligation

Purpose
- Registration of records required by the State Secretariat for Security
- Processing personal data for the prevention, detection and investigation of criminal offences

Retention period
- Personal data will be retained for three (3) years from the end of the contracted service or benefit.

3. Bank Details
Data processed
- Banking and payment information

Legal basis
- Performance of a contract to which the data subject is a party

Purpose
- Processing reservation payments
- Guaranteeing reservations
- Paying for accommodation and related services

Retention period
- Personal data will be processed during the contractual relationship between Room00 Group and the User.
- The data will then be blocked for the period necessary to comply with legal obligations.
- After that period, the data will be permanently deleted.

4. Contact Information
Data processed

• First name

• Last name

• Email address

• Telephone number

Legal basis
- Consent

Purpose
- Handling and responding to requests, comments and suggestions
- Providing support to users while using the website

Retention period
- Personal data will be retained for the time necessary to respond to the request and/or resolve the issue raised by the User.
- The data will then be blocked to comply with legal obligations.
- After that period, it will be permanently deleted.

5. Promotional Communications
Data processed
- First name
- Last name
- Email address
- Telephone number

Legal basis
- Legitimate interest (where a contractual relationship exists)
- Consent

Purpose
- Sending information about promotions
- Conducting advertising and marketing activities related to Room00 Group

Retention period
- Personal data will be processed until the User withdraws their consent.
- Following withdrawal, the data will be blocked for the period required by law.
- After that period, the data will be permanently deleted.

6. Surveys and Service Quality Evaluations
Data processed
- First name
- Last name
- Email address
- Telephone number

Legal basis
- Consent

Purpose
- Improving and expanding the quality of Room00 Group’s products and services

Retention period
- Personal data will be processed until the User withdraws their consent.
- Following withdrawal, the data will be blocked for the period required by law.
- After that period, the data will be permanently deleted.

7. Video Surveillance
Data processed
- Video recordings and images captured by CCTV systems

Legal basis

• Legitimate interest

Purpose
- Ensuring the security of individuals, property and facilities located on the premises

Retention period
- Images will be retained for a maximum period of one (1) month from the date of capture.
- Where a criminal or administrative offence is recorded and must be reported to the authorities, the relevant footage will be retained solely for the purpose of being made available to those authorities.
- Such footage will not be used for any other purpose and will be deleted once no longer required.

TO WHOM WILL YOUR DATA BE COMMUNICATED?
Room00 Group informs you that, for the purposes described above, it will not transfer your personal data to third parties. However, Room00 Group may grant access to this personal data to technology service providers with whom it has entered into a data processing agreement; in particular, to:

Analytics service providers.
Hosting service providers.
Email service providers.
Booking management providers.
Customer service providers.
Promotional and/or marketing service providers.

The aforementioned providers may be located in jurisdictions that generally do not offer adequate safeguards regarding the processing of personal data. For all entities outside the European Economic Area (EEA), Room00 Group has signed contracts with those entities that include such safeguards, including the European Commission’s standard contractual clauses.

Users can obtain more information about technology service providers by requesting it from Room00 Group Group through the contact means provided in this privacy policy.

Room00 Group may also share your data with:
Companies interested in purchasing or acquiring the company or a part of its business and, consequently, granting access to any national or international auditor to conduct due diligence.
Other companies within the Room00 Group.
Authorities to investigate suspected fraud, harassment, or other violations of any law, rule, or regulation, or of the website’s policies.

SECURITY AND CONFIDENTIALITY
Room00 Group is committed to adopting the necessary physical, technical, and organizational measures, in accordance with applicable regulations, to guarantee the security of personal data and prevent the accidental or unlawful destruction, loss, or alteration of personal data transmitted, stored, or otherwise processed, or the unauthorized disclosure of or access to such data. Personal data will be treated confidentially by Room00 Group, which undertakes to inform and ensure, as required by law or contract, that this confidentiality is respected by its employees, partners, and any other person who needs access to the User’s personal data.

USER RIGHTS
The User may exercise the rights of access, rectification, erasure, objection and, where applicable, limitation of processing and data portability by sending an email to dpo@room00group.com.

The User may also file a complaint with a supervisory authority and, in particular, with the Spanish Data Protection Agency (www.aepd.es) if they believe that the rights set out above in this Privacy Policy have been violated or if they believe that the processing of their personal data violates applicable regulations.

CHANGES TO THE PRIVACY POLICY
Room00 Group reserves the right to modify this Privacy Policy at any time. Changes or updates to the Privacy Policy will be explicitly notified to the User through a notice on the Website, along with the updated version of the Privacy Policy.

Any contracted Service may be rejected or canceled by Room00 Group if there is a clear error in the price or if the information regarding the services, billing, and/or payment details is insufficient or inaccurate. Services may also be canceled if there are well-founded suspicions that they were carried out using stolen billing information, appear to be related to fraud, or are related to a previous payment dispute.