Politique de confidentialité

Summary

1. Definitions

2. Why does Palacio Tangara need to collect your Data?

3. What Data does Palacio Tangara collect?

3.1 Personal data that you communicate to us directly 

3.2 Personal data communicated to us

3.3 Personal data that we collect automatically

3.4 Sensitive Personal Data

4. What is the legal basis for the processing of your Data?

4.1 Execution of contractual relations with Palacio Tangara

4.2 Compliance with a legal obligation to which Palacio Tangara is subject

4.3 Your consent

4.4 Vital interest

4.5 The legitimate interests of Palacio Tangara

5. How long do we retain your Personal Data?

6. What are your rights and how to exercise your rights?

6.1 Your rights

6.2 Exercise of your rights

7. When and with whom does Palacio Tangara share your Data?

8. Are your data transferred outside the EU and EEA?

9. How does Palacio Tangara secure the processing of your Data?

10. Cookies Policy

11. Social Media

12. Privacy by Design/by Default

13. Accountability

3.4 Sensitive Personal Data

What is Sensitive Personal Data? It is information which reveals alleged racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership. It is also genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning the health, sex life or sexual orientation of a natural person.

You may provide or we may collect what is considered Sensitive Personal Data under the legislation applicable to the protection of the Personal Data. For example, you may provide your health information or dietary restrictions so that we can accommodate you during your stay.

In this case, we only process Sensitive Personal Data if and to the extent permitted and required by applicable law or with your express consent. Unless otherwise required by applicable law, you are not required to provide us with any of your Sensitive Personal Data. Should you choose not to, your decision would not prevent you from using our Services.

4.2 Compliance with a legal obligation to which Palacio Tangara is subject:

Some of your Data is processed by Palacio Tangara to comply with its legal obligations, in particular complying with legal processes, responding to requests from public and government authorities around the world, or public-sector bodies/bodies with a public-service mission, in line with applicable legislation, and pursuing available remedies or limit damage we or other third parties may sustain. Also, your Data is processed to manage your request to exercise the rights guaranteed to Data Subjects under the legislation applicable to the protection of the Personal Data.

Subject to having obtained your prior and valid consent, Palacio Tangara may process your Data to communicate (e-mail/SMS) with you during your stay, to send you promotional offers, newsletters, information on us, our Services, and other marketing communications, in accordance with your preferences. With your consent, you can participate in contests and all other promotional operations organized by us on social networks. Also, to process Sensitive Personal Data you may have provided to us in connection with your stay (example: any dietary restrictions or special accommodations for physical and medical conditions). Your consent may also be necessary when we use cookies and other tracking technologies under the conditions described in our Cookies Policy. At any time, you can change your choice and withdraw your consent, as described in section 6.2 of this Policy, without however calling into question the legality of the processing based on consent and implemented before the withdrawal.

4.4 Vital Interest:

In certain circumstances when it is not possible to obtain your consent, it may be necessary for us to process your Personal Data, including Sensitive Personal Data you provided through our Services, where it is in your vital interest or in the interest of others, for example in the event of a medical emergency.

4.5 The legitimate interests of Palacio Tangara:

We may process your Personal Data for the purposes of pursuing our legitimate business reasons, in particular, providing you with superior customer service and a personalized experience when staying with us, keeping our Services safe and secure and to protect our operations or those of any of our affiliates or other third parties, and distributing and responding to surveys regarding your experience, etc. It is also for our legitimate interest to provide you with information that you have requested and responding to your inquiries. Also, for our legitimate interest to ensure your security and the security of our Services, we adopt processes to detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, debugging and repairing errors, verify customer information. Subject to applicable law and regulations, it is our legitimate interest to adopt processes for the establishment, exercise, or defense of legal claims against the us, or in the event of a corporate event such as a sale, merger or change in control.

5. How long do we retain your Personal Data?

Your Data is kept by Palacio Tangara for the time necessary to achieve the purposes referred to in point 2 hereof, plus the statutory limitation periods.

For example (this information may be different regarding national laws and regulations):

In terms of business relationship management:

• Personal data relating to customers will not be kept beyond the period strictly necessary for the management of the commercial relationship. However, the data making it possible to establish proof of a right or a contract, or kept for compliance with a legal obligation will be kept for a period not exceeding the period necessary for the purposes for which they are kept, in accordance with the provisions in force (in particular but not exclusively those provided for by the Commercial Code, the Civil Code and the Consumer Code).
• Data relating to bank cards:

. These data will be deleted once the transaction has been carried out (upon payment), which may be deferred upon receipt of the goods, increased, if applicable, by the withdrawal period provided for the contracts concluded contracts concluded at a distance and outside the establishment. In the case of payment by bank card, the card number and its validity date may be kept for the purpose of proof in the event of a possible dispute of the transaction for the duration provided for by law (French law: thirteen months following the debit date; this period may be extended to fifteen months in order to take into account the possibility of using deferred debit payment cards). These data will be used only in the event of a dispute about the transaction.

. This data relating to bank cards may be kept longer, subject to obtaining your express consent, in particular to facilitate the payment of your next orders.

. The data relating to the visual cryptogram will not be kept beyond the time necessary for the completion of each transaction, including in the event of successive payments or retention of the card number for subsequent purchases.

. When the expiration date of the bank card is reached, the data relating to them will be deleted.

In terms of management of commercial prospection:

• Customer data used for commercial prospection purposes will be kept for a period of three years from the end of the commercial relationship (for example from a purchase, from the last contact from the customer).
• Personal data relating to non-customer prospects will be kept for a period of three years from their collection or from the last contact from the prospect (for example, a request for documentation or a click on a hypertext link contained in an email).

Regarding inquiries:

• The data will be kept for a period of one (1) year from the processing of your request for information.

In terms of management of requests to exercise the rights granted to data subjects under the regulations applicable to the processing of personal data:

• The processed data is kept while your request is being investigated, then archived in accordance with the limitation periods in force (example: 5 years);
• Data relating to identity documents will be kept for a period of one (1) year in compliance with the applicable legal deadlines;
• In the event of opposition, the data will be kept for a minimum period of three (3) years for the sole purpose of guaranteeing the effectiveness of your right of opposition.

For more information on the retention periods of your data, you can contact Palacio Tangara (see Section 6.2 of this Policy).

6.1 Your rights

Right of access: You can obtain confirmation from Palacio Tangara that your Personal Data is or is not being processed and, when it is the case, access to all Personal Data and information held by Palacio Tangara.

Right to rectification: You can obtain from Palacio Tangara, as soon as possible, the rectification of any data concerning you which may be inaccurate or erroneous. You can also request that your data be completed, if necessary.

Right to erasure: Subject to legal exceptions, you can ask Palacio Tangara to erase your Personal Data as soon as possible, if in particular you consider that the processing carried out by Palacio Tangara on your data is no longer necessary with regard to the purposes for which they are were collected.

Right to data portability: You have the option of recovering part of your Personal Data in an open and machine-readable format or of requesting Oetker Collection to transmit it to another organization. The only data affected by this right are data that you have actively and consciously provided to the Oetker Collection (for example, data that you have entered in an online form) or data generated when using a service or a device as part of the conclusion or management of your contract, and which are processed automatically, on the basis of consent or the execution of a contract.

Right to object: You can object to your data being used by an organization for a specific purpose. You must then put forward reasons relating to your particular situation, except in the case of commercial prospecting, to which you can object without reason. If your data is processed for commercial prospecting purposes, you can oppose it at any time (See point 6.2 of this Policy), just as you can oppose the deposit of cookies at any time (see Article 10 of this Policy).

Right to restriction of processing: You can ask Oetker Collection to keep your data without being able to use it, in any of the following cases: you dispute the accuracy of the data used by Oetker Collection, you object to your data being processed, in the event of illegal use but you oppose their erasure, you need it for the establishment, exercise or defense of legal claims.

Right to withdraw your consent to the processing of your data: When the processing of your personal data is based on your consent, you have the possibility to withdraw your consent at any time (See point 6.2 of this Policy).

Right to lodge a complaint with the competent supervisory authority: If you consider that your rights have not been respected or that the protection of your data is not ensured in accordance with the legislation applicable to the protection of the Personal Data, you can, at any time, lodge a complaint with a competent supervisory authority (in France, the CNIL : directly on the CNIL website or by post to: CNIL - 3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07).

6.2 Exercise of your rights

To exercise any of your rights, send your request:

By E-Mail: [email protected]

By letter: DPO - Palácio Tangará, Rua Deputado Laércio Corte, 1501 – Panamby - São Paulo - SP, 05706-290 -Brazil

Any request must specify, in subject, the reason of the request (exercise of the right of access, the right to object, etc.), the address to which the response must be sent, and the company concerned by the request (Palácio Tangará).

To exercise your rights, you must prove your identity by any means. When Palácio Tangará has reasonable doubts about your identity, you may be asked to provide additional information necessary to confirm your identity.

Palácio Tangará will send you its response within a maximum of one (1) month from the date of receipt of your request. This period may however be extended by two (2) months due to the complexity and number of requests.

If you believe, after contacting Palácio Tangará, that your rights are not respected, you can lodge a complaint with the competent supervisory authority.

Prospecting and targeted advertising:

Please note that we only send you commercial prospection when we have obtained your explicit prior consent, except where we have obtained your data during a sale or negotiations for a sale of a product or service and where the commercial prospection are only marketing similar products or services.

Once you have accepted to receive commercial offers from Palácio Tangará, you can, at any time, reconsider your choice and opt-out:

Commercial E-mails: unsubscribe link at the bottom of the email. Please note that even if you unsubscribe from commercial e-mail, we may still e-mail you non-commercial (transactional) e-mails related to your account and your transactions via the Services.

In general, for any question relating to this Privacy Policy or for any request relating to the management of your Personal Data by Palácio Tangará, you can send your request by email or by post, as indicated above.

7. When and with whom does Palácio Tangará share your Data?

Access to your Personal Data is strictly limited to entities and their members staff authorized to process it by virtue of their duties.

Palácio Tangará is also likely to transmit your Personal Data to the following entities when this is necessary to meet one of the purposes referred to in point 2 hereof:

• Affiliates: Your Personal Data you provide to us in connection with making a reservation is shared and received with and from our Affiliates you have previously visited for purposes of meeting your reservation requests and preferences in advance
• Owners: We manage hotels and other properties on behalf of third-party owners (“Owners”). If you make a reservation to stay at a property managed by us, we will share and receive Personal Data with and from the Owner of that property.
• Data Processors such as hosting and maintenance providers, payment service providers, fraud prevention and fight providers, logistics providers, marketing solution providers, commercial prospecting and communication management providers, service providers in charge of customer service management, data analysis, etc.
• We may also share your Personal Data with providers that provide services such as spa treatment, salons, and restaurants within our hotels or other properties, or event planners or organizers of any event you plan or host with us.
• We also may partner with a limited number of Internet providers to offer Internet access to our guests. Your use of Internet service is subject to the third-party Internet provider’s terms of use and privacy policy, which you can access using the links on the service sign-in page, or by visiting the Internet provider’s website.
• We may also share your Personal Data with third parties when we may help arrange rental cars and share Personal Data with them to provide those services. We also may work with third parties, such as travel agencies and airlines. This Privacy Policy does not apply to information that you provide directly to this third parties.
• We may share anonymized data with third parties’ providers in an anonymous way, which does not reveal Personal Data.
• Also, if you connect to one of our social media pages, we may disclose some of your Personal Data to your friends associated with your social medial account, to other website users, and to your social media account provider, in connection with your social sharing activities. We may make reviews, message boards, blogs and other user-generated content available to users on our Services. Any information disclosed in these areas is public information and you should accordingly exercise caution when deciding to disclose your Personal Data in this context. We are not responsible for the privacy practices of other users including web operators to whom you provide information.
• We may share your Personal Data to other partners, consultants and advisors who render services to us, including financial institutions, external auditors, lawyers, and credit card issuers.
• We may sell our business, hotels and other assets or may cease managing a hotel or property owned by an Owner. In this case, we may include Personal Data collected about you, or control of that Personal Data, as a business asset in any such transfer. Additionally, we may disclose your Personal Data to a buyer or other successor in the event of a merger, sale or other transfer event, in which Personal Data held by us about our users is among the assets transferred.
• In compliance with legal obligations, your Personal Data may be transmitted to authorized third parties, in particular to organizations, court officials and ministerial officers, as part of their debt collection mission.

Palácio Tangará does not sell, rent or share your Personal Data without your consent except in accordance with this Privacy Policy or for the purposes disclosed on any online form or location on the Services where you provide Personal Data to us. Palácio Tangará also does not engage in the sale of your Personal Data.

9. How does Palácio Tangará secure the processing of your Data?

 Palácio Tangará implements all technical, physical and organizational measures to ensure the security and confidentiality of your Personal Data during the collection, processing and transfer of your Data.

The infrastructures of Palácio Tangará are protected against malicious software (viruses, spyware, etc.). Physical and remote access to the servers hosting the Data is controlled. Penetration tests are performed, as well as regular backups with restore tests. The security of your terminal, from which you connect to our website, is your responsibility.

In the event that  is likely to call on service provide Palácio Tangará to process part of your Personal Data, it undertakes to verify that they present sufficient guarantees to ensure the protection of the Personal Data entrusted to them and to make them sign confidentiality clauses in accordance with the legislation applicable to the Protection of the Personal Data.

In case of a Personal Data Breach, that is to say in the event of a security incident, whether malicious or not and occurring intentionally or not, resulting in compromising the integrity, the confidentiality, or the availability of your Personal Data, we undertake to comply with the obligations with the legislation applicable to the Protection of the Personal Data.

10. Cookies Policy

To know more about Cookies and how to manage them, please access our Cookies Policy.

11. Social Media

Palácio Tangará is present on Social Media, in particular via Instagram, Facebook, YouTube, WeChat, SINA Weibo, etc.

Access to these Social Media implies your prior acceptance of their contractual conditions, including their commitments under the legislation applicable to the protection of the Personal Data for the processing carried out by them, regardless of our pages on said Social Media. To find out more about the Protection of your Personal Data when browsing these Social Media, Palácio Tangará invites you to consult their respective Privacy Policies:

• Facebook
• Instagram
• YouTube and YouTube - Google
• WeChat
• SINA Weibo

Palácio Tangará is able to collect some of your personal information when you browse the pages of our Social Media, when you “like” our pages, share content or follow us on Social Media.

Also, if you choose to log-in, connect with or link to Services using your Social Media account some of your Personal Data is shared with us consistent with your settings within the Social Media service, such as location, check-ins, activities, interests, photos, status updates, as well as Personal Data that may be a part of your profile or friend’s profile.

Palácio Tangará may be required, within the framework of the organization of contests, to collect your name, first name, date of birth, il necessary profile photograph, gender, networks, Social Media user ID, and any information made public and more generally Personal Data.

12. Privacy by Design/by Default

Palácio Tangará undertakes to integrate the protection of Personal Data by Design and by Default of a project, a service or any other tool related to the handling of Personal Data, in particular the minimization of Personal Data, limitation of the purposes of data collection, respect for the integrity and confidentiality of data, limitation of retention periods.

13. Accountability

In order to respect the principle of Accountability, Palácio Tangará:

• adopts internal procedures in order to ensure compliance with the legislation applicable to the protection of the Personal Data (IT charter, Personal Data protection charter, etc.);
• keeps a documentary record of any processing carried out under its responsibility or that of the processor (keeping of the processing register, confidentiality agreements for employees and service providers, company security policy, procedures for managing requests for access, rectification, opposition ...);
• carries out Privacy Impact Assessments for processing operations presenting particular risks with regard to rights and freedoms.

The aim is to provide rich documentation to demonstrate compliance with Data Protection rules at all times.

Last update: 15/03/2022