Frequent Asked Questions

Information relating to an identified or identifiable natural person ("data subject").

The protection of personal data is the implementation of technical and organisational measures to protect personal data from unauthorised access and to control the flow of such data.

According to the GDPR, "processing personal data" is any operation carried out on the data by automated and non-automated means, including its collection, registration, alteration, consultation, use, transmission and destruction.

It is the Policy that sets out the terms under which Enotel processes the personal data of its customers, users and jobseekers and the rights they may exercise in accordance with Regulation (EU) 2016/679 of the European Parliament and the Council - General Data Protection Regulation (GDPR) - and other applicable national legislation on privacy and data protection. See Enotel’s Policy on Privacy and the Protection of Personal Data here on the Portal. The processing of the data of employees and suppliers is available in areas restricted to these data subjects.

The GDPR applies to the processing of personal data carried out by a controller or a processor located in the territory of the European Union, regardless of whether the processing takes place within or outside the European Union. The GDPR also applies to the processing of the personal data of data subjects who are in the territory of the European Union, carried out by a responsible person, or a processor, not established in the European Union, where the processing activities are related to:
(a) the provision of goods or services to such data subjects in the European Union, irrespective of whether payment is made;
(b) the control of their behaviour within the European Union.
The GDPR also applies to the processing of personal data by a responsible person established outside the European Union, where the right of a Member State under public international law applies.

Enotel processes personal data that differ in nature and sensitivity, and in the purpose associated with the processing of such data, such as: 

• identification data (e.g., civil/tax identification, name, signature, customer number, account number, passport number);
• demographic data (e.g., gender, date of birth, nationality, country of residence);
• contact details (e.g., installation address, billing address, mobile phone, personal/professional email);
• image and video data (e.g., CCTV circuits on premises, photos or videos collected at public events);
• financial data (e.g., IBAN);
• curricular data and educational qualifications.

The categories of data subjects processed by Enotel include:

• users of the site(s);
• jobseekers;
• clients;
• service providers;
• workers and other employees.

As a personal data subject, in accordance with Regulation (EU) 2016/679 (GDPR), you have the following Rights (for more detailed information please refer to Enotel's Privacy Policy):

• the data subject's right of access: whenever you request it, you can obtain confirmation of whether your personal data is processed by Enotel. You can also access your personal data and obtain more information about the processing;
• right of rectification: where you consider that your personal data (objective personal data provided by you) are incomplete or incorrect, you may request rectification or complete it;
• right to deletion of the data ('right to be forgotten'): you may request that your personal data be deleted when personal data are no longer necessary for the purpose that motivated their collection or processing or in other situations (as described in the Privacy Policy). Under the applicable legal terms, Enotel is under no obligation to delete the data of the data subject to the extent that the processing proves necessary to comply with a legal obligation to which it is subject or for the purpose of declaration, exercise or defence of a right in judicial proceedings;
• right to limitation of processing: the limitation of processing allows the data subjects to request the person responsible to restrict access to personal data or to suspend processing activities;
• right of data portability: you may request Enotel to deliver, in a structured format, commonly used and read automatically, the personal data provided by you. The right of portability applies only in the following cases: (I) where the processing is based on express consent or the performance of a contract; and (II) when the processing in question is carried out by automated means;
• right of opposition: you have the right to object to the processing of your personal data at any time, for reasons related to your particular situation, in the following situations: (I) where the processing is based on Enotel's legitimate interest; or (II) where the processing is carried out for purposes other than those for which the data were collected but which are compatible with them. Enotel will no longer process your personal data in such cases unless it has legitimate reasons for processing them and these reasons prevails over your interests. You may also oppose the processing of your data for direct marketing purposes, including profiling that is related to such marketing;
• right to withdraw your consent: in cases where the processing of the data is done on the basis of your consent, you may withdraw consent at any time. If you withdraw your consent, your personal data will no longer be processed unless there is another basis, such as legal and regulatory obligations or the public interest of Enotel, which justifies such processing.

Personal data are requested from customers in the context of pre-contractual due diligence and the commercial relationship established with the customer, as agreed between the parties.
In the case of subscriptions and with your unambiguous consent, your contact information may also be used to send newsletters.

The customers’ personal data collected in the context of the contractual relationship between the parties are processed whenever necessary for the performance of the contract and for communications with the competent authorities in compliance with their legal obligations.

To ensure the security of your data, Enotel processes in a fully confidential manner the information that customers have provided, in accordance with its internal security and confidentiality policies and procedures. Enotel adopts various technical and organisational security measures to protect its customers' personal data from undue or unauthorised loss, dissemination, alteration, processing or access. The security of your data is covered during the period of data retention, which may be the period in which legal or contractual obligations with customers persist.
Please note: The security of your personal data also depends on your behaviour in the use of information technologies, including the Internet, social networks and social interaction. For more information see "What care should I take to protect my personal data?".

Your data will be processed by Enotel exclusively for the purposes described above under "What personal data of its customers does Enotel use and for what purpose?" The provision of information or the provision of the services by Enotel to its users or customers through the channels may, where appropriate, involve the use of services of subcontracted or jointly responsible third parties responsible for the processing of personal data, including entities based outside the European Union, for the provision of certain services and may involve access by these entities to the personal data of users or customers. In these circumstances and where necessary, Enotel shall only use subcontractors who provide sufficient guarantees for the implementation of the appropriate technical and organisational measures in such a way that the processing meets the requirements of the applicable standards. Such guarantees are formalised in a contract signed between Enotel and each of those third parties.

The request for any clarification related to the protection of personal data must be made in writing:

• to the e-mail address dpo@enotel.com;
• by post to the address Rua Simplício dos Passos Gouveia 29, 9004-576 Funchal - Madeira, Portugal, to the attention of the Quality Department of Enotel Lido.

Enotel has appointed a Data Protection Officer who is available for any data protection request. See "Who is the Enotel Data Protection Officer?" for more information and contacts. The exercise of your rights is free of charge unless the application is manifestly unfounded or excessive, and in such cases a reasonable fee may be charged in accordance with the associated costs.
Requests for information and the exercise of rights by the data subject are to be made in writing (including electronic means), with proof of identity, and sent to Enotel, which will respond to the data subject’s request in writing (including electronic means) no later than 30 days from receipt of the request, except in cases of particular complexity and a large number of requests, when the period may be extended up to two months.
The data subject may also lodge a complaint directly with the National Data Control Authority, the National Data Protection Commission (CNPD), using the contacts made available by this entity for this purpose (at www.cnpd.pt).

You must make a written request to Enotel, addressed to the Quality Department of Enotel Lido: Rua Simplício dos Passos Gouveia 29, 9004-576 Funchal - Madeira Portugal or send the request to: dpo@enotel.com.
A form for the exercise of rights as a data subject to be used to send Enotel information by post or email is available at the reception of Enotel hotels. The exercise of your rights is free of charge unless the application is manifestly unfounded or excessive, and in such cases a reasonable fee may be charged in accordance with the associated costs. By law, requests for information and the exercise of rights by the data subject must be made in writing (including electronic means), with proof of identity, and sent to Enotel, which will respond to the data subject’s request in writing (including electronic means) no later than 30 days from receipt of the request, except in cases of particular complexity and a large number of requests, when the period may be extended up to two months. The data subject may also lodge a complaint directly with the National Data Control Authority, the National Data Protection Commission (CNPD), using the contacts made available by this entity for this purpose (at www.cnpd.pt).

You can change or rectify your consent, free of charge, through the following channel:

•  at the reception of Enotel hotels, by filling out a form for this purpose.

Enotel's Data Protection Officer (EPD/DPO) service is provided by IN-FORMAR S.A., which has a contract for the provision of specialized external DPO services and Advice on matters of compliance with GDPR and Law No. 58/2019, of August 8.
The Data Protection Officer (EDP/DPO) has the mission of informing and advising Enotel on the obligations arising from the General Data Protection Regulation (GDPR) and verifying the applicability of Enotel's Data Protection Policy, ensuring that its customers and other data subjects are aware of how their Personal Data is processed, and what rights they have in this area, as well as being Enotel's point of contact with the Supervisory Authority, the National Data Protection Commission (CNPD).
Personal Data subjects can always contact the Data Protection Officer (EDP/DPO) to clarify any issues they consider relevant related to the processing of their Personal Data and the exercise of their rights. EPD contact - dpo@enotel.com.

A data breach is a breach of security that accidentally or unlawfully causes the destruction, loss, alteration, disclosure, or unauthorised access to personal data processed by Enotel.
Examples of data breach are: unauthorised verbal or written transmission of personal data to third parties; a cyberattack or failure that causes the loss, theft or storage in an unsafe place of documents or devices (e.g. laptop or mobile phone); sending personal data to the wrong recipient; sending emails to a set of recipients using the "To" option instead of "Bcc".

Taking into account the principle of proportionality and suitability of security, the costs of application and the nature, scope, context and purposes of the processing, as well as the risks of probability, Enotel applies appropriate security, technical and organisational measures to ensure a level of security of your personal data appropriate to the risk, such as:

• implementation of training and/or awareness-raising actions in information security and data protection for all employees;
• use of firewall and intrusion detection systems in its information systems;
• application of access control procedures, using differentiated access profiles and based on the principle of need to know;
• recording of actions carried out on information systems containing personal data (login);
• execution of a backup plan;
• anti-spam protection in the receiving and sending of corporate emails;
• installation, maintenance and management of antivirus and firewall systems on Enotel computers;
• pseudonymisation of personal data;
• controlled access to the physical facilities of Enotel's equipment;
• automatic fire detection and intrusion detection system.

To protect your privacy:

• NEVER share your personal data, including identification data or your data for access to Enotel services;
• keep any information that is confidential or that contains sensitive personal data protected from access by unauthorised third parties;
• do not share documents issued by Enotel on social networks or via the Internet;
• keep your computer, tablet or smartphone protected with antivirus and locked with keyword, pin, or biometrics.

The National Cybersecurity Centre provides a very simple set of information and good practices that you, as a citizen, should comply with in your day-to-day use of information technologies, internet access, use of email, and access to online communication platforms, among other recommendations. For more information see: https://dyn.cncs.gov.pt/pt/boaspraticas/.
You can access a free online course containing good practices in the use of the internet at: https://www.nau.edu.pt/curso/cidadao-ciberseguro/.