1. GENERAL PART
1.1. COLLECTION AND PROCESSING OF USER DATA
Within the scope of the availability of the website hosted at www.artsoulgroup.com (“Site”), the conclusion of any contracts (namely hotel services, vouchers, Spa treatments and products), the provision of information, contents, including the newsletter, login areas or any telephone contacts (collectively the “Services”) to its users (“User”) and other related entities, the entity ART AND SOUL Group (Grupo ART AND SOUL) (hereinafter the “ART AND SOUL Group”) may request the User to provide personal data, that is, information provided by the User that allows the Lux Hotels Group to identify and/or contact you (“Personal Data”).

As a rule, Personal Data is requested when the User registers on the Site, requests a contact and/or the sending of newsletters, subscribes to a certain service, provides or requests information, acquires a product or establishes a contractual relationship with the ART AND SOUL Group.

The Personal Data collected and processed consists of the information regarding the name, gender, date of birth, telephone, mobile phone, email, address, country of residence, tax identification number and credit card data (collected only for billing purposes) although other Personal Data may be collected if necessary or convenient for the provision or billing of Services by the ART AND SOUL Group.

Upon the collection of Personal Data, the ART AND SOUL Group provides the User with detailed information on the nature of the data collected and the purpose and processing that will be carried out with respect to the Personal Data.

The ART AND SOUL Group also collects and processes information on the characteristics of your hardware device and the browser/software features, as well as information about the pages visited by the User within the Site. This information may include your browser type, domain name, access times and links through which the User has accessed the Site (“Usability Information”). We use this information only to improve the quality of your visit to our Site.

The Usability Information and the Personal Data are referred to in this Privacy Policy as “User Data”.

For the purposes of this Privacy Policy, a contractual relationship is understood as any contract entered into between the ART AND SOUL Group and any entities related to it, regardless of their object.

1.2. SUBCONTRACTED ENTITIES
Within the scope of the processing of User Data, the ART AND SOUL Group may use or may resort to third parties subcontracted by it to process the User Data on behalf of the ART AND SOUL Group and following its instructions, under the provisions of the law and this Privacy Policy.

These subcontracted entities shall not transmit the User Data to other entities without the prior authorization of the ART AND SOUL Group, being also prevented from contracting other entities without the prior authorization of the ART AND SOUL Group.

The ART AND SOUL Group undertakes to subcontract only entities that offer maximum security in the execution of the appropriate technical and organizational measures, in order to guarantee the defense of the User’s rights. All entities subcontracted by the ART AND SOUL Group are bound to the latter a written contract which governs, in particular, the purpose and duration of the processing, the nature and purpose of the processing, the type of personal data, the categories of data holders and the rights and obligations of the parties.

After the collection of personal data, the ART AND SOUL Group shall provide the User with information on the categories of the subcontracted entities that, in this case, can process data on behalf of the Lux Hotels Group.

1.3. DATA COLLECTION CHANNELS
The ART AND SOUL Group may collect data directly (that is, directly from the User) or indirectly (that is, from partner entities or third parties). The collection can be carried out through the following channels:

• Direct collection: in person, by phone, by e-mail and through the Site;
• Indirect collection: through partners or companies of the group and official entities.

2. GENERAL PRINCIPLES APPLICABLE TO THE PROCESSING OF USER DATA
   In terms of general principles regarding the processing of personal data, the ART AND SOUL Group undertakes to ensure that the User Data processed by it shall be:

• Processed in accordance with the law and fair and transparent to the User;
• Collected for specific, objective and legitimate purposes, not being further processed in a way contrary to such purposes;
• Adequate, justified and limited to what is necessary for the purposes of the processing;
• Accurate and updated whenever necessary, taking all necessary measures to ensure that inaccurate data (regarding the purposes for which it is processed) is erased or corrected without delay;
• Preserved in a manner that allows the identification of the User only during the period necessary for the purposes for which the data is processed;
• Processed in a manner that guarantees its security, including protection against the unauthorized or illegal processing and against its loss, destruction or unforeseen damage, taking the appropriate technical or organizational measures;
• The data processing carried out by the ART AND SOUL Group is allowed and legal when at least one of the following situations occurs:
• The User has, without any doubt, given consent to the processing of the User Data for one or more specific purposes;
• Processing is necessary for the execution of a contract in which the User is a party, or for pre-contractual procedures at the request of the User;
• Processing is necessary for the fulfilment of a legal obligation to which the ART AND SOULGroup is subject;
• Processing is necessary to defend the fundamental interests of the User or another individual;
• Processing is necessary for the legal interests pursued by the ART AND SOUL Group or by third parties (except if prevailing any User’s interests or fundamental rights and freedoms that require protection of personal data).
  TheART AND SOUL Group undertakes to ensure that the processing of User Data is only carried out under the terms listed above and complying with the above mentioned principles.
  When User Data processing is carried out by the ART AND SOUL Group based on the consent of the User, the latter has the right to withdraw such consent at any time. However, the withdrawal of the consent does not compromise the legality of the processing made by the ART AND SOUL Group based on the consent previously given by the User.

The period of time during which the data is stored and kept varies according to the purpose for which the information is processed.
Effectively, there are legal requirements that require storing the data for a minimum period of time. Thus, and where there is no specific legal obligation, data shall be stored and kept only for the minimum period necessary for the purposes that motivated its collection or its subsequent processing, being the data deleted upon ending such purpose.

3. USE AND PURPOSE OF THE USER DATA PROCESSING
   In general terms, the ART AND SOUL Group uses the User Data for the following purposes:

• Provision of hotel services and associated services (restaurants, bars and SPA);
• Management of contacts with the User;
• Invoicing and billing to the User;
• Inform the User, upon request, on new products and services made available on the Website and/or at the hotel units, special offers and campaigns, updated information on the ART AND SOUL Group activity and, generally, for marketing purposes of the ART AND SOUL Group and its hotel units, by any means of communication, including electronic support;
• Ensure that the Site meets the User’s needs by developing and publishing content that is best adapted to the requests and type of User, improving the search feature capabilities and features of the Site and obtaining associated or statistical information in relation to the user’s profile type (analysis of consumption profiles);
• Provision of Services, and other services such as newsletters, opinion surveys or other information or products requested or purchased by the User;
• Sending Satisfaction Surveys;
• The ART AND SOUL Group may combine Usability Information with anonymous demographic information for research purposes, and may use the result of such combination to provide more relevant content on the Site. In specific restricted areas of the Site, the ART AND SOUL Group may combine Personal Data with Usability Information to provide a more personalized content to the User.

The User Data collected by the Lux Hotels Group is not shared with third parties without the consent of the User, except for the situations mentioned in the following paragraph. However, if the User contracts with the ART AND SOUL Group services provided by other entities responsible for the processing of personal data, the User Data may be consulted or accessed by such entities to the extent that it is necessary for the provision of said services and the User shall be informed thereof.

Under the applicable legal provisions, the ART AND SOUL Group may transmit or communicate the User Data to other entities if such transmission or communication is necessary for the execution of the contract entered between the User and the ART AND SOUL Group, or for pre-contractual procedures at the request of the User; if it is necessary for the fulfilment of a legal obligation to which the ART AND SOUL Group is subject; or in case it is necessary to defend the legitimate interests of the ART AND SOUL Group or of a third party. In the event of a transmission of User Data to third parties, reasonable efforts shall be carried out so that the receiver uses the User Data transmitted in accordance with this Privacy Policy.

4. TECHNICAL, ORGANIZATIONAL AND SECURITY MEASURES IMPLEMENTED
   In order to ensure the security of the User Data and maximum confidentiality, the ART AND SOUL Group processes the information that you provided in an absolutely confidential manner, in accordance with its internal security and confidentiality policies and procedures, updated periodically as needed, and under the terms and conditions provided by law.

Depending on the nature, scope, context and purpose of the data processing and on the risks arising from such processing regarding the User’s rights and freedoms, the ART AND SOUL Group undertakes to apply, both when defining the means and when processing, the technical and organizational measures necessary and appropriate for the protection of User Data and compliance with all legal obligations.

It also undertakes to ensure that by default only the data necessary for each specific purpose shall be processed and that such data shall not be made available to an indeterminate number of people without human intervention.

Communication between the User’s device and the ART AND SOUL Group Site is carried out through secure channels and communications using the HTTPS protocol and the SSL security standard.
Nonetheless, the ART AND SOUL Group adopts the following general measures:

• Regular audits aimed at identifying the capability of the technical and organizational measures implemented;
• Sensitization and training of personnel involved in data processing operations;
• Pseudonymization and codification of personal data;
• Mechanisms capable of ensuring the permanent confidentiality, availability and resilience of information systems;
• Mechanisms to ensure the reset of information systems and quick access to personal in the event of a physical or technical incident.

5. TRANSFER OF DATA TO COUNTRIES OUTSIDE THE EUROPEAN UNION
   The Site does not transfer your personal data to recipients located in countries outside the European Union.

6. USE OF COOKIES
   When you visit our site, a small text file (Cookie) is created and saved on your computer’s disk. Consequently, when you browse the Site you are accepting the installation of this text file on your device. This file will allow you greater ease and speed in accessing the Site, as well as customizing it according to your preferences.

If you wish to delete them or set an automatic blocking, you will find how to do it in the “Help” menu of your browser. However, if you do not allow the use of cookies, there may be some functionalities of the Site that you will not be able to use.

By browsing our Site you are allowing the collection and storage of small text files called cookies, which contain information and are downloaded to the User’s computer or other devices through a server. These text files shall allow a more personalized and efficient browsing experience. At each visit to the Site, your Internet browser sends these cookies back to the Site, allowing the recognition and memorization of the Users’ identity, as well as the respective use preferences.

I- What are Cookies?
“Cookies” are small software files that are stored on your device through the browser, retaining your information regarding the browsing status and recording the User’s browsing activity. They may also be used to recall information on the User that was previously entered on the website.

II- What are the types of Cookies used?

Cookies required to:
i) Allow browsing on the Site;
ii) Enjoy its functionalities, namely, accessing secure areas and contents of exclusive access for registered Users.

Functional cookies to:
i) Record information on our Users’ options;
ii) Allow customizing our Website to their needs, namely, memorizing the language of origin.

Performance cookies to:
i) Monitor how Users individually access our Site and how regularly.

Session cookies:
Used for the reservation process, since these types of cookies are more secure and cannot be manipulated by third parties.
We also use direct or indirect analytical services to assess the effectiveness of our content and the preferences of Users, which contribute to optimize the functioning of this Site.

We also use web beacons or tracking pixels to count the number of visitors to our Site, anonymously and without identifying any particular User.

III- Browser controls:
The vast majority of browsers allow users to view hosted cookies as well as delete or block them.

Whenever there is a deletion of cookies, some features of the Site may be affected.

If you want to know more about how Cookies work, you can consult the Sites AboutCookies.org or Cookiecentral.com.

IV- Cookies Security:
Since Cookies can be intercepted or changed, the following security actions are taken:
Sensitive information such as passwords or personal data such as the customer’s address or telephone number is not stored;
There shall be no sending of non-secure (HTTP) requests where cookies are sent to the browser in plain text and can be intercepted.

7. TOOLS USED BY THE WEBSITE FOR STATISTICAL AND BEHAVIOUR READING OF THE USER
   Google Analytics

The Site uses Google Analytics, a network analysis service provided by Google. Cookies that provide information on the use and browsing on the Site will be stored. This data, including the User’s IP address, is transmitted to Google’s servers but is not related with any other data held by Google.

You can disable the tool by downloading and installing a browser add-on available in Google: https://tools.google.com/dlpage/gaoptout?hl=en

Facebook and Instagram

The Site interacts with Facebook and Instagram through a connection to the servers of these social networks. This will allow to identify the website that the user is visiting and possibly store other data, such as the IP address. If you have your Facebook and/or Instagram session open, data shall be associated to your accounts. To prevent this, the User must logout on Facebook and Instagram before visiting the page.

The information regarding the processing of data carried out by these social networks is available at:
https://www.facebook.com/about/privacy/ https://help.instagram.com/519522125107875

8. USERS’ RIGHTS (DATA HOLDERS)
   8.1. RIGHT TO INFORMATION
   8.1.1. Information provided to the User by the ART AND SOUL Group (when data is collected directly from the User):

• The identity and contacts of the ART AND SOUL Group and the person in charge of the processing;
• The contacts of the Data Protection Officer;
• The purposes of the personal data processing, as well as, if applicable, the legal reasons for the processing;
• If the data processing is based on the legitimate interests of the ART AND SOUL Group or of a third party, the indication of such interests;
• Where applicable, the recipients or categories of recipients of the personal data;
• Where applicable, indication that personal data shall be transferred to a third country or an international organization, and whether there is a compliance decision adopted by the Commission or any reference to suitable or appropriate transfer guarantees;
• The deadline for retaining the personal data;
• The right to request the ART AND SOUL Group to allow [N.T. Necessita esclarecimento. Possível lapso no original, na palavra “permissão”] personal data, as well as its correction, elimination or limitation, the right to object to the processing and the right to access the data;
• If the data processing is based on the consent of the User, the right to withdraw it at any time without compromising the legality of the processing carried out based on the consent previously given;
• The right to file a complaint with the CNPD or other supervisory authority;
• Indication whether the disclosure of personal data constitutes a legal or contractual obligation, or a requirement to conclude a contract, as well as whether the holder is required to provide the personal data and the possible consequences of not providing such data;
• Where applicable, the existence of automated decisions, including profile definition, and information regarding the basic concept, as well as the importance and expected consequences of such processing for the data holder.

Is the User Data is not collected directly by the ART AND SOUL Group from the User, in addition to the information referred to above, the User shall also be informed on the categories of the personal data being processed, as well as the origin of the data and if it comes from sources accessible to the public.

In case the ART AND SOUL Group intends to proceed with the further processing of the User
Data for a purpose other than that for which the data was collected prior to such processing, the ART AND SOUL Group shall provide the User with information on such purpose and any other information of interest, in the terms referred to above.

8.2. Procedures and measures implemented to fulfil the right to information.
The information referred to in 8.1. is provided in writing (including by electronic means) by the ART AND SOUL Group to the User prior to the processing of the relevant personal data. In accordance with the applicable law, the ART AND SOUL Group is under no obligation to provide the User with the information mentioned in 8.1 when and to the extent that the User is already aware of it.

The information is provided by the Art and Soul group at no cost.

9. RIGHT TO ACCESS THE PERSONAL DATA
   The ART AND SOUL Group guarantees the means by which the User can consult his Personal Data. The User has the right to obtain from the ART AND SOUL Group the confirmation whether the personal data is being processed or not and, if applicable, the right to access the respective personal data and the following information:

• The purposes of the data processing;
• The categories of the relevant personal data;
• The recipients or categories of recipients to whom the personal data has been or will be disclosed, in particular to recipients in third countries or belonging to international organizations;
• The term to retain the personal data;
• The right to request the ART AND SOUL Group to rectify, delete or limit the processing of personal data, or the right to prevent such processing;
• The right to file a complaint with the CNPD or other supervisory authority;
• If the data has not been collected from the User, the available information on the origin of such data;
• The existence of automated decisions, including the profile definition, and information on the underlying logic, as well as the importance and expected consequences of such processing for the data holder;
• The right to be informed on the appropriate guarantees associated with the transfer of data to third countries or international organizations.

Upon request, the ART AND SOUL Group shall provide the User, free of charge, with a copy of the User Data that is being processed. The provision of other copies requested by the User may entail administrative costs.

10. RIGHT TO RECTIFY THE PERSONAL DATA
    The User has the right to request at any time the rectification of the respective Personal Data, as well as the right to have completed any incomplete personal data, including by means of an additional declaration.