Last update: October 20, 2020
Scope of application
Personal data means information of any nature and support, including sound and image, related to an identified or identifiable natural person. An identifiable person is a person who can identify herself, directly or indirectly, that is, by reference to an identification number or to one or more specific elements of her physical, physiological, psychological, economic, cultural or social identity.
2. Data controller
The entity responsible for the collection and processing of users’ personal data, namely for the categories of data collected, their treatment and the purposes for which they are used is Cosy Inside, Lda., taxpayer number 515.805.700, with its headquarters at Rua Frei Leão de Santo Tomás, nr 468-B, Ervosa, 4785-154 Trofa, Portugal, telephone number +351916999435 and email: email@example.com
3. Types of personal data and purposes of processing
3.1 Access to the website and navigation: with access to the website, a set of data is automatically collected from the computer, which are temporarily recorded in its own files, and are also automatically deleted after a certain period. The collection of this data has purely technical objectives, such as connection setup, system security, technical network administration and website optimization. The personal data collected for this purpose are the following:
- IP address of the requesting processor;
- Date and time of access;
- Name and URL of the downloaded file;
- Volume of data transmitted;
- Indication of whether the transfer was successful;
- Data that identifies the browser software and the operating system;
- Website from which you accessed our website;
- Name of the Internet service provider.
3.2 Contact form: if you want to contact Cosy Inside directly through the website, you shall complete the form provided for that purpose, which can be found on the menu “contacts”. Some personal information of yours will be requested, such as name and email address, location and contact. If you are an owner and wish to submit your property(ies) to Cosy Inside, you must fill in the form provided for this purpose, which can be found in the menu “owners”. You will be asked for some personal data, such as name, e-mail address, telephone number, location of the property and typology.
The collection of this data is only intended to make it possible to respond to your contact and provide you with the information you need. The legal basis applicable to the collection and use of your personal data for these purposes is your consent.
3.3 The user has the right to withdraw their consent at any time, although this right does not compromise the lawfulness of the treatment carried out on the basis of the consent previously granted nor the subsequent processing of the same data, on the basis of another legal basis.
3.4 In the course of its business, Cosy Inside processes personal data of Clients necessary for contractual execution and/or for compliance with legal obligations, with a view to managing the contractual relationship, including, but not limited to, registering as a new Client, sending communications for the purposes of contractual execution and management and/or marketing campaigns, when this is consented to by the Client, responding to any communications sent by mail, telephone, email or by other means, and also managing and collecting applicable payments, fees and/or charges.
3.5 Bookings: the data generally collected from the user are, among others, the name, email address, telephone number, address, nationality, gender, date of birth, country of residence, civil identification number or passport, tax identification number, IBAN and bank card data, for the purpose of finalising and managing online bookings. The legal basis applicable to the collection and use of your personal data for these purposes is the conclusion and execution of the contract and the fulfilment of a legal obligation to which Cosy Inside is subjected.
3.6 Check-in: the service provider has the right to know customer identification data and also other data regarding payment for the services to be contracted, for reasons of legal, accounting and tax security. Under this assumption, Cosy Inside has the right to require identification of the Client, namely through the exhibition of identification documents, which may be used for the performance of the contract and, where required, for the fulfilment of a legal obligation, namely the communication of registration forms if it is concluded that the guest is a foreigner. The purposes are the control of foreign citizens on national territory and the performance of contracts. Thus, for the purposes of control of foreign citizens, including citizens of other Member States of the European Union, they must personally complete and sign a registration form. The obligation to ensure that the registration forms are completed and communicated lies with Cosy Inside. The communication of its data is made to Serviço de Estrangeiros e Fronteiras (SEF), the public security authority responsible for the stay and activities of foreign citizens on national territory. If the guest is travelling with family or in a travel group, a registration form must be completed by each foreign citizen, including citizens of other Member States of the European Union. It is not compulsory for both spouses and minors accompanying them to fill in the forms and for all members of a travel group to sign them personally. Cosy Inside has the right to require the identification of the accompanying person(s), under the same terms as the Client.
3.7 The provision of data is mandatory, without which it is not possible to proceed with said purposes.
3.8 The user warrants that the personal data provided to Cosy Inside is accurate and is responsible for communicating any changes thereto.
4. Retention period of your data
The user’s personal data will be kept for the necessary period to comply with legal obligations. In the absence of a specific legal requirement, the user’s personal data will be stored after the collection of their consent and if, within this period, they have not withdrawn their consent.
5. Provision of data to third parties
5.1 Unless otherwise stated, your personal data will not be disclosed to third parties without your explicit consent.
5.2 Your personal data may be disclosed, in particular, to the following entities:
- Professional advisers (including, but not limited to, legal advisers and financial advisers), insurers, banks and auditors;
- Providers of certain services that assist Cosy Inside in the exercise of its activity, such as IT and systems administration services, cloud hosting and storage services and other software used to meet the needs and management of data within the scope of its activity.
Only the personal data necessary for the provision of the service in question are provided to these companies, and these entities undertake to process said personal data solely and exclusively for the fulfillment of the purposes indicated above.
5.3 In addition, your personal data may be disclosed to third parties to:
- Comply with the requirements imposed by law or by the competent governmental or judicial authorities;
- Satisfy the requirements necessary to initiate or sustain a lawsuit or defence in a lawsuit;
- Your personal data may also be communicated to the police or judicial authorities, in accordance with applicable laws and regulations and at the formal request of the authorities, in order to prevent fraud against us (anti-fraud services).
6. Storage of your personal data
Personal data collected and processed by Cosy Inside are stored on our servers with limited access, located in controlled facilities.
7. Data transfers abroad
If the provision of certain services by Cosy Inside implies the transfer of personal data of users outside Portugal, Cosy Inside will strictly comply with the applicable legal provisions, namely with respect to determining the suitability of that country with respect to the protection of personal data and the requirements applicable to such transfers.
8. Security measures
To avoid unauthorized disclosure or access and guarantee the proper use of users’ personal data, Cosy Inside uses appropriate and reasonable physical, technical and administrative procedures to safeguard the information it collects and processes, in order to protect personal data against its unauthorized dissemination, loss, misuse, alteration, treatment or access, as well as against any other form of unlawful treatment. For this purpose, in addition to using the HTTP protocol over an additional layer of security that uses the SSL / TLS (HTTPS) protocol, your system encrypts the information to ensure that it does not intercepted when transmitted over the network and has implemented authentication/access control systems (login and password) and the use of firewalls.
10. Other data processing
If the processing of your data is necessary for a new purpose not covered by this document, Cosy Inside will send you a notification explaining the reason and the conditions of processing.
11. Rights of data subjects
In accordance with legal and regulatory requirements regarding data protection, Cosy Inside guarantees that data subjects can exercise their rights regarding the way their personal data are processed and stored.
These rights can be exercised by directly contacting Cosy Inside:
- By mail: Rua Frei Leão de Santo Tomás, nr 468-B, Ervosa, 4785-154 Trofa, Portugal;
- By email: firstname.lastname@example.org
Before processing the request, Cosy Inside may carry out a prior verification of the identity of the applicant whenever there are doubts about the identity of the person who made the request.
Requests to exercise rights shall be responded to without undue delay and at the latest within one month from the date of receipt of the request. In view of the high complexity of an application or the number of applications made, the period for reply may be extended to two months. If the period for reply is extended, Cosy Inside will inform the data subject, at the latest one month after the date of receipt of the request, of the reasons for the delay in replying to the request.
Cosy Inside seeks to respond to all requests, all of which are subject to review in order to verify that their satisfaction complies with applicable legal and regulatory requirements. Where there is a legal and/or regulatory framework that prevents the data subject from exercising a right they have invoked, Cosy Inside reserves the right to not accept the request. In such situations, Cosy Inside shall communicate to the data subject, within a maximum period of one month from the date of receipt of the request, the reasons for which the request will not be complied with and the possibility of complaining to a supervisory authority and taking legal action.
The rights that may be invoked are those set out in the following paragraphs, as defined in the applicable laws and regulations, noting their main particularities.
11.1. The right of access
At any time you may contact Cosy Inside to request confirmation as to whether personal data concerning you are being processed by Cosy Inside, and to be informed about the personal data in question, the reasons for processing such information, the recipients to whom the personal data have been or will be disclosed, the information available on the origin of the data and, if so, the storage period. If you so request, you may receive a copy of the personal data being processed.
11.2. The right to rectify and update your data
The data subject may, taking into account the purposes of the processing, rectify their personal data if they are incorrect or incomplete, as well as update them whenever they are out of date.
11.3 The right to delete data (“right to be forgotten”)
Every data subject has the right to request the erasure of personal data whenever it is established, for example, that the data are no longer necessary for the purpose for which they were collected or processed, or whenever the data subject withdraws their consent, in cases where this is applicable, provided that there are no other legal grounds for such processing, overriding legitimate interests justifying the processing or where the processing is necessary for the purposes of asserting or defending a right in judicial proceedings.
Cosy Inside will examine the request and, once considered valid in light of the applicable legal and regulatory rules, will confirm that the data have been deleted or the reason why this was not possible.
11.4. The right to limitation of processing of your data
The data subject may request that the limitation of the processing of their data, once one of the legal conditions is met:
- When the data subject disputes the accuracy of the personal data, in which case the processing must be limited for a period enabling Cosy Inside to verify their accuracy, or where the data subject has objected to the processing, until it is established that the legitimate reasons of the data controller prevail over those of the data subject;
- When the processing is unlawful and the data subject only requests the limitation of its use;
- When Cosy Inside no longer needs the personal data for processing purposes, but such data are requested by the data subject for the purposes of declaration, exercise or defence of a right in a judicial proceeding.
With the exception of storage, when the processing has been limited, the personal data will only be processed by Cosy Inside with the consent of the data subject, for the purpose of the declaration, exercise or defence of a right in a judicial proceeding to defend the rights of another natural or legal person, or for overriding reasons of public interest.
In the event of cancellation of the limitation granted to the processing of personal data, Cosy Inside shall inform the data subject in advance.
11.5. The right to object to the processing of your data
The data subject has the right to request at any time that Cosy Inside ceases the processing of their personal data. Upon receiving your request, Cosy Inside will examine the request and, if considered valid under the applicable legal and regulatory rules, will cease the processing in question. If no decision is taken on the feasibility of the request within one month at most, Cosy Inside will suspend the processing or processings in question as far as possible until the final decision is taken.
11.6. Consent and withdrawal of consent
If consent is legally required for the processing of personal data, the data subject has the right to withdraw their consent at any time, although this right does not compromise the lawfulness of the processing carried out on the basis of the consent previously given or the subsequent processing of the same data on another legal basis, such as compliance with the contract or the legal obligation to which Cosy Inside is subject.
11.7. The right to data portability
The data subject has the right to request that Cosy Inside transfers or delivers in a structured, commonly used and automatically readable format, the data subject’s personal data whenever they are held by Cosy Inside, in accordance with the applicable legal terms, and whenever the processing of data is carried out by automated means and is based on their consent or is necessary for the performance of a contract to which the data subject is a party or for pre-contractual measures at the request of the data subject.
Cosy Inside will comply with the request, as far as practicable, within one month of receiving it.
Cosy Inside shall refuse a request for portability whenever such request violates the rights and freedoms of a third party, or another limitation established in applicable laws or regulations applies.
11.8. The right to complain
If you wish to make a complaint about the way your personal data is being processed by Cosy Inside, or how your complaint has been handled, you have the right to lodge a complaint directly with the supervisory authority.
Currently, the authority with control functions for data protection purposes in Portugal is the Comissão Nacional de Proteção de Dados (“CNPD”), to whom you may ask any questions or lodge complaints if you find that personal data protection rules have not been complied with.
The CNPD may, at the moment, be contacted in the following manner:
Avenida D. Carlos I, nr 134 – 1.º, 1200-651 Lisbon, Portugal
Telephone: +351 213928400 / Fax: +351 213976832
12. Link to social networks
We allow connection to social networks, but we are not responsible for their privacy and security policies. We recommend that you review them.
These are connections to social networks external to Cosy Inside subject to their own privacy policies. These networks can record information related to the activities of users on the Internet, including on our website.
We recommend analyzing the conditions of use and the privacy policies of these social networks to know exactly how they use the personal data of users, as well as the procedure to erase or limit the processing of such data.
Cosy Inside does not knowingly collect personal data from children under the age of eighteen. If you are under eighteen, do not give us personal data. If you believe a minor gave personal data to Cosy Inside please contact us in order to do everything possible to delete those personal data from our databases.
14. Applicable law
14.2 The processing of personal data is governed by Law 58/2019 of 8 August and the General Data Protection Regulation 2016/679 (the “GDPR”), or other applicable legislation.