Privacy and Data Policy

1. Entity Responsible for Processing
This website is operated by Letras e Borboletas - Ecoturismo, Lda., with headquarters at Rua Dom Fuas Roupinho,
194, 2480-032 Alvados, legal entity no. 508 905 311, hereinafter referred to as “Cooking Hotel”.
Cooking Hotel is responsible for processing personal data collected through this website.

2. Data Collected
Cooking Hotel may collect the following types of personal data:
- Reservation and stay: name, email, telephone number, address, NIF, credit/debit card details, dates
of stay and preferences;
- Online payments: billing and transaction data;
- Communication: information provided when filling out contact forms or subscribing to newsletters;
- Recruitment: identification data, contact details, qualifications, professional experience and other elements
CV constants;
- Website navigation: cookies and anonymous statistical data (see Cookie Policy).

3. Purposes of Processing
The personal data collected is intended for:
- Management of reservations, stays and associated services;
- Payment processing and billing;
- Compliance with legal obligations (tax, accounting and security);
- Management of contacts, information requests and complaints;
- Sending promotional communications, with express consent;
- Recruitment and selection processes for job candidates.

4. Legality Grounds
The processing of personal data by the Hotel is based on:
- Execution of contract (e.g. accommodation reservation);
- Compliance with legal obligations (e.g. tax and authority communications);
- Legitimate interest (e.g., service improvement, network security);
- Consent of the holder (e.g. sending newsletters or spontaneous applications).

5. Data Retention
- Reservations and billing: kept for the legally required period (10 years for tax purposes and
accounting);
- Job applications: up to 2 years after receipt, unless consent is given for longer retention;
- Marketing: until consent is revoked;
- Other cases: only for the time strictly necessary for the purpose for which they were collected.

6. Data Sharing
The Hotel may share personal data only with:
- Service providers acting as subcontractors, namely Guestcentric Systems SA,
responsible for managing the booking platform and website.

- Guestcentric processes personal data exclusively on behalf of and on behalf of the Hotel, and is
contractually obliged to guarantee confidentiality, security and compliance with the GDPR.
- Other service providers (e.g. payment processors, hotel management software) also
subject to data protection obligations;
- Public authorities, when legally required.
- Data will never be transferred to third parties for commercial purposes without the consent of the holder.

7. International Transfers
We do not transfer data outside the European Economic Area.

8. Data Subject Rights
The user has the right to:
- Access, rectify or delete your personal data;
- Limit or oppose processing;
- Request portability of your data;
- Withdraw consent, where applicable;
- File a complaint with the National Data Protection Commission (CNPD).

The exercise of these rights can be done by sending a request to the email rita.anastacio@cookinghotel.com or by
mail to the address of the Cooking Hotel.

9. Data Security
The Hotel and its subcontractors, including Guestcentric, adopt appropriate technical and organizational measures
to protect personal data against loss, alteration, unauthorized access or improper disclosure.

10. Changes to the Policy
The Hotel may update this Privacy Policy at any time. Changes will be published on
website indicating the date of the last update.