Privacy and Data Protection Policy

1. INTRODUCTION

1. a) Your privacy and the protection of your personal data are very important to ORBITUR – Intercâmbio de Turismo, S.A. (hereinafter referred to as 'ORBITUR').
2. b) We are committed to processing your personal data lawfully, fairly, transparently and in strict compliance with applicable laws, including the Regulation (EU) 2016/679 of 27 April 2016 (General Data Protection Regulation – GDPR) and the Law No 58/2019 of 8 August 2019.
3. c) Protecting your personal information is a daily priority in the exercise of our activity, whether in the context of reservations made at our campsites, holiday accommodation and complementary services, or arising from the relationship through our website, loyalty programs, promotional activities or contact with tourism partners.
4. d) If you have any questions, comments or suggestions to make about this policy, please contact us using the contact details below.

2. WHO IS THE DATA CONTROLLER?

The data controller of your personal data is

Orbitur – Intercâmbio de Turismo, S.A.
Av. da Boavista, 1681, 3.º, Salas 5 a 8
4100-132 Porto – Portugal
Corporate taxpayer No 500 207 739

3. PRINCIPLES OF OUR PRIVACY POLICY

1. e) We only collect data that is strictly necessary for the purposes for which the personal data are processed.
2. f) Only duly authorized staff and service providers access and process data within the scope of their functions.
3. g) We invest in technical and organisational measures that ensure the confidentiality, integrity and availability of information.
4. h) We respect in all circumstances the rights of data subjects, promoting good privacy and data protection practices.

4. CONCEPTS AND INFORMATION FOR DATA SUBJECTS

Within the scope and for the purposes of this policy, we comply with the definitions set forth in Article 4 of the General Data Protection Regulation, namely those indicated below, without excluding compliance with the other definitions indicated therein:

1. vi. Personal Data - means any information relating to an identified or identifiable natural person; an identifiable natural person being considered an identifiable person who can be identified, directly or indirectly, particularly by reference to an identification number or to one or more factors specific to the physical, physiological, mental, economic, cultural or social identity of that natural person;
2. vii. Processing - an operation or set of operations which are performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, comparison or interconnection, restriction, erasure or destruction;
3. viii. Consent - of the data subject, expressed through a free, specific, informed and unambiguous wishes, by which the data subject accepts, by means of a statement or unequivocal positive act, that the personal data relating to him or her are processed;
4. ix. Controller- the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data;
5. x. Subcontractor - a natural or legal person, public authority, agency or other body which processes personal data on behalf of the data controller.

5. WHAT PERSONAL DATA CAN WE COLLECT?

As part of your relationship with us, we may collect the following data:

1. h) Identification data: name, date of birth, nationality, taxpayer identification number.
2. i) Contact information: address, telephone number, email address.
3. j) Data related to reservations and stays: arrival and departure dates, services purchased, accommodation preferences.
4. k) Billing and payment data.
5. l) Website browsing data: IP address, operating system, access device, preferences, cookies.
6. m) Data related to loyalty programs (Orbitur Camping Club.
7. n) Information included in CVs, with regard to job applications.

6. HOW AND WHEN DO WE COLLECT YOUR PERSONAL DATA?

1. f) When you make reservations through our website, reception desks, customer service, tourism partners or associated digital platforms.
2. g) When you join the Orbitur Camping Club loyalty program.
3. h) When you subscribe to our newsletters, campaigns, or fill in contact forms.
4. i) When you visit fairs and participate in contests or events promoted by ORBITUR.
5. j) When you submit a spontaneous application or when applying in case of recruitment processes.

7. PURPOSE OF PERSONAL DATA PROCESSING

We process your personal data for the following purposes:

1. j) Managing reservations, stays, and contracted services;
2. k) Issuing invoices and managing payments;
3. l) Managing loyalty programs and promotional campaigns;
4. m) Communicating information about services, events, and news;
5. n) Compliance with legal obligations (tax, security, reporting to public authorities, such as the SEF (Foreigners and Borders Service) or police authorities;
6. o) Managing complaints, requests for information, or suggestions;
7. p) Recruitment and selection processes;
8. q) Continuously improving services and customer experience;
9. r) Exercising or defending rights in legal proceedings.

8. LEGAL BASIS FOR PERSONAL DATA PROCESSING

Processing personal data may be based on the following:

1. e) Performance of a contract (e.g., booking a stay);
2. f) Compliance with legal obligations;
3. g) Legitimate interest of ORBITUR (e.g., service improvement, security);
4. h) Consent of the data subject (e.g., marketing communications, use of non-essential cookies).

9. DATA STORAGE

Data will be retained for the period necessary to fulfil the intended purposes, respecting legal deadlines (e.g., tax deadlines). Whenever there is no applicable legal deadline, data will be retained only for as long as justified by the purpose for which they were collected and will then be deleted or anonymized.

10. RECIPIENTS AND DATA TRANSMISSION

ORBITUR may transmit data in the following cases:

1. e) To public entities, when legally required;
2. f) To service providers (subcontractors) acting on our behalf, subject to confidentiality agreements and GDPR compliance;
3. g) To tourism partners or booking platforms, to ensure the execution of the contracted services.
4. h) In the event of international bank transfers, we will adopt the appropriate safeguards provided for in the GDPR.

11. YOUR RIGHTS

As a data subject, you have the right to the following:

1. g) Access, rectify, and update your personal data;
2. h) Erasure ('right to be forgotten');
3. i) Limitation and object to processing of your personal data;
4. j) Data portability;
5. k) Withdraw consent, when applicable;
6. l) File a complaint with the CNPD (National Commission for Data Protection)-(www.cnpd.pt).

12. DATA SECURITY

We implemented appropriate technical and organisational measures (encryption, pseudonymisation, backup systems, restricted access policies) to protect your personal data against destruction, loss, alteration, or unauthorized access.

13. COOKIE POLICY

Our website uses cookies to the following purposes:

1. d) Ensure the essential functioning of the website (necessary cookies);
2. e) Analyse statistics and traffic (analytical cookies – e.g., Google Analytics);
3. f) Save browsing preferences (functionality cookies);
4. g) Customise campaigns and advertisements (advertising cookies/CRM – e.g., Google Ads, Meta Pixel, HubSpot).

You can manage your preferences through the cookie banner displayed on the website or through your browser settings.

14. CONTACTS

Data Protection Officer (DPO) – ORBITUR
Email: This email address is being protected from spambots. You need JavaScript enabled to view it.

15. REVISION

ORBITUR may revise this Privacy and Cookie Policy periodically. Changes will be posted on our website and will become effective upon their availability.