Privacy Policy

1. Identification of the data controller

Origem Ibérica, Lda, legal entity no. 508952310, with registered office at Rua de Luou, no. 242, 4990-745 Ponte de Lima, is the entity responsible for the processing of personal data related to the tourist operation of Quinta de Luou and to the website www.luou.pt

2. Legal information

Within the scope of Law No. 58/2019 of 8 August 2019 (which ensures the implementation, within the national legal order, of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016) and of the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016), hereinafter referred to as the “GDPR”, the protection of natural persons with regard to the processing of personal data and the free movement of such data is ensured.

Personal data is understood to include any information relating to an identified or identifiable natural person, regardless of its format (for example: text, photograph, video), who can be identified directly or indirectly by reference to one or more elements specific to their physical, psychological, economic, cultural or social identity.

By accepting this Privacy Policy, the user freely and knowingly consents to their personal data, provided on the website www.luou.pt , being collected in a database under the responsibility of Origem Ibérica, Lda, the processing of which complies with appropriate security measures for this purpose.

This database stores only the data provided by users at the time of account registration, which is collected and processed automatically by Origem Ibérica, Lda, in accordance with the terms approved by the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados).

3. Purposes of the processing of personal data

The personal data collected through the website www.luou.pt is processed for the following purposes and on the respective legal bases:

• Performance of a contract: reservation management, accommodation services, order processing, invoicing and payments;

• Compliance with a legal obligation: tax, accounting or reporting obligations to the competent authorities;

• Legitimate interest: improvement of the user experience, statistical analysis and fraud prevention;

• Consent: sending newsletters, promotional campaigns and collecting customer feedback (only with the data subject’s specific and informed consent).

Origem Ibérica, Lda guarantees the confidentiality of all data provided by its customers, using appropriate technical and organisational measures to collect and process such data securely, preventing its loss or manipulation.

Sensitive data (religious, philosophical or political beliefs, racial or ethnic origin, health data, sexual life or other data covered by Article 9 of the GDPR) will never be collected or processed.

However, please note that, despite all precautions, data collection over open networks allows the circulation of personal data without full security conditions, representing a risk of being viewed or used by unauthorised third parties.

4. Processing of minors’ data

We do not intentionally collect personal data from minors under the age of 16. If it is detected that we have collected data from a minor without the consent of parents or legal guardians, we will immediately delete such information from our records.

5. Data retention period

Data is retained only for the period strictly necessary to fulfil the purposes of the processing or for as long as legal obligations apply:

• Invoicing data: 10 years (tax obligations);

• Reservation data: for the applicable legal period or up to 5 years after the stay;

• Marketing data: until the data subject withdraws consent.

Once the retention period has expired, the data will be securely deleted.

6. Sharing of data with third parties

In order to fulfil the purpose of this website, Origem Ibérica, Lda may share personal data with third-party entities that provide technical, technological, reservation management or payment services.

We emphasise that access is only authorised to entities that guarantee the security of our users’ data and adopt appropriate measures to ensure compliance with all data protection obligations.

International transfers

Where it is necessary to transfer data outside the European Economic Area, this will only take place using appropriate safeguards, such as adequacy decisions of the European Commission or standard contractual clauses.

7. Data security

Origem Ibérica, Lda adopts stringent security measures to ensure the protection of the personal data entrusted to it and to minimise the risks to which it may be exposed, preventing unauthorised manipulation, loss or access.

We undertake to:

• Store personal data in compliance with all legally required security measures, minimising potential risks;

• Ensure that data is used exclusively for the purposes previously defined;

• To ensure that data are processed exclusively by authorised personnel, who are subject to obligations of secrecy and confidentiality;

• Where disclosure of such data to third parties is required, ensure that they are bound by confidentiality obligations, as provided for in this document.

8. Personal data breach

In the event of a personal data breach that may result in a high risk to the rights and freedoms of data subjects, we will notify those affected as soon as possible, in accordance with the GDPR.

9. Cookies

The website www.luou.pt uses different types of cookies. Please consult www.luou.pt/cookies .

10. Links to third-party websites

Our website may contain links to other websites that are not owned or controlled by us.

We recommend that you pay attention when leaving our website and read the privacy policies of the website to which you are redirected.

11. Exercise of data subject rights

Under the General Data Protection Regulation (GDPR) and Law no. 58/2019, the data subject has the right to exercise, at any time, their rights as a personal data holder. These rights may be exercised by submitting a request to the email address geral@luou.pt , and sufficient information must be provided to identify the applicant.

12. Updates to the privacy policy

Origem Ibérica, Lda may update this Privacy Policy whenever necessary, without prior notice