Privacy Policy

1. Introduction

Quinta de Cypriano – Wine & Nature, run by LIMANOVA – Agricultura e Turismo, Lda. (“Quinta de Cypriano” or “we”) is firmly committed to the privacy and rights of data subjects and operates in accordance with the provisions of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“General Data Protection Regulation (“GDPR”)) and other applicable legislation.
Quinta de Cypriano will use the personal data inserted on this site responsibly, fairly and transparently, in compliance with the GDPR. When personal data is collected, stored, used, transferred or excluded by other entities that process it under our direction (subprocessors), we require them to also provide an equal level of protection and security.
This privacy policy (“Privacy Policy”) concerns the processing of the data subject’s personal data which Quinta de Cypriano, as data controller, collects in the course of its activity. A data subject is the natural person to whom the data belongs (“Data Subject” or “you”).
Providing your personal data to Quinta de Cypriano implies that you know and accept the conditions contained in this Privacy Policy.
You can find detailed information about Quinta de Cypriano’s Privacy Policy in the following sections:

2. Personal data collection and processing

Personal data is any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an electronic identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Quinta de Cypriano may process the following categories of personal data:
a) identification details (e.g. name, date of birth, gender, address, contact details, ID card, passport, tax number and nationality);
b) data relating to education and professional experience (e.g. education, qualifications, certifications, languages, CVs, information from former employers);
c) professional details (e.g. job title, position, job description, company, office address);
d) invoicing and expenses data; 
e) image and sound recording data (e.g. photo and video images).
The personal data categories listed above may belong to different categories of Data Subject, such as Quinta de Cypriano guests, employees of guests (companies), counterparties, or applicants.
Quinta de Cypriano collects personal data through various means and at various times, including when you send an email or respond to an invitation, present your personal card, sign up for our information or events, send a job application, or engage our services.
Accessing and using the Quinta de Cypriano website does not necessarily mean that you are providing your personal data. However, the use of certain functionalities of the site may mean that personal data is provided, especially in the case of requests for contact or sending applications.

3. Purposes and legal basis for processing personal data

Quinta de Cypriano may process personal data for the following purposes and on the following legal bases:
a) to provide accommodation services, which may include opening a guest file; recording service proposals submitted, correspondence with guests, other parties and/or public entities, and archiving documentation in digital and physical format.
Legal basis ► performance of contract and legitimate interest:
• Quinta de Cypriano’s interest in processing its guests’ information in a sustainable and efficient manner, ensuring its quality and integrity and enabling Quinta de Cypriano to provide excellent services;
b) For correspondence and sending information, including promotional information.
Legal basis ► legitimate interest:
• replying to requests from persons that fill in the forms on the Quinta de Cypriano website and adapting the respective correspondence;
• greater dissemination of Quinta de Cypriano.
c) For event management, which includes sending event invitations and registering event participants and publicising events internally and externally.
Legal basis ► legitimate interest and consent (*):
• replying to requests from persons that fill in the forms on the Quinta de Cypriano website and adapting the respective correspondence;
• publicising the events that are promoted by Quinta de Cypriano.
(*) Your prior consent will be requested in cases where the event is recorded, either in sound or image, or if photographs are taken.
d) For invoicing and accounting management, which includes expense accounting, controlling costs and refunds (e.g. travel expenses and mobile communications to be borne by the guests), invoicing and managing current accounts, and keeping a file of accounting records and supporting documentation.
Legal basis ► performance of contract, legitimate interest and compliance with a legal obligation:
• efficient management control;
• invoicing the provided services in a timely manner; and
• ensuring compliance with the applicable legal obligations.
e) For recruitment and selection, which includes analysing applications and CVs, as well as the internal process of selecting lawyers and staff as needed.
Legal basis ► pre-contractual diligence at the data subject’s request and legitimate interest.
Quinta de Cypriano’s interest in analysing applications and subjecting applicants to an internal selection process, in line with pre-established criteria.

4. Personal data storage period

Quinta de Cypriano will store personal data for the period needed to fulfil the purposes established in this Policy or for the period required by applicable legal or regulatory provisions.
The storage periods for personal data, depending on each processing purpose, are as follows:
• provision of accommodation services = Until you exercise your right to object.
• correspondence and sending information = Until you exercise your right to object.
• event management = 2 years from the time of contact or participation in the event (as the case may be) if you have not contacted us or participated in another event.
• invoicing and accounts management = 10 years.
• recruitment and selection = 2 years from the time the application or CV is submitted if the applicant is not selected; and
• other cases = for as long as the professional relationship with Quinta de Cypriano continues.

5. Personal data transfers

Quinta de Cypriano does not transfer your personal data to third parties, unless it is necessary to provide the contracted services or to comply with Quinta de Cypriano’s legal obligations.
The transfer of data to third parties is carried out in accordance with the applicable data protection legislation and in line with the purposes and legal bases established in this Policy.
Quinta de Cypriano may share the personal data with the following entities:
• relevant parties for the provision of services;
• public authorities, in the context of compliance with legal obligations;
• service providers that provide services to Quinta de Cypriano for the purposes described above, such as providers of IT services, communications services, translation services, and digital and physical archiving services.
In cases where the transfer of personal data to the above-mentioned entities involves an international transfer of personal data (i.e. outside the European Union), Quinta de Cypriano will:
• carry out that transfer based on a European Commission adequacy decision, according to which the country or international organisation concerned guarantees a level of data protection equivalent to that required under European Union law; or,
• ensure, in the absence of a European Commission adequacy decision, that these data transfers are carried out in strict compliance with legal provisions and that adequate guarantees are implemented to ensure the protection of the personal data.

6. Personal data security

Quinta de Cypriano uses its best efforts to protect personal data, including by adopting the appropriate technical and organisational measures to prevent destruction, loss, alteration, disclosure or unauthorised access, and any other form of unlawful or abusive processing.
The technical and organisational security measures created and implemented by Quinta de Cypriano are also required of the service providers that may process personal data on its behalf.
When using the Quinta de Cypriano website, it is your responsibility to ensure that the devices and equipment you use to access the website are adequately protected against harmful software, computer viruses and worms that could jeopardise the security of the personal data provided through the website.

7. Your rights

You have the following rights:
– Right of access
You may, at any time, request (i) confirmation about whether Quinta de Cypriano processes your personal data, (ii) access to your personal data, and (iii) information on the processing of your personal data. You may also obtain a copy of the personal data being processed.
– Right to rectification
If your personal data is incorrect or incomplete, you may ask for it to be corrected or completed.
– Right to erasure (“right to be forgotten”)
In certain situations, you have the right to request the erasure of your personal data. This right may be limited in certain situations, such as when the processing of the data is necessary for compliance with legal obligations to which Quinta de Cypriano is subject, or when this processing is necessary for the purposes of declaring, exercising or defending a right in legal proceedings.
– Right to restriction of processing
In certain situations, you may ask Quinta de Cypriano to restrict access to your personal data or to suspend processing activities. This will happen, for example, in cases where you dispute the accuracy of your personal data, for a period of time that allows Quinta de Cypriano to verify its accuracy, or in cases where you have objected to the processing, until it is verified whether the legitimate interests of Quinta de Cypriano or a third party prevail over yours.
– Right to data portability
In cases where the processing of data is based on a contract to which you are a party or on your consent, you may ask Quinta de Cypriano to provide you with the data you have provided in a structured, commonly used and machine-readable format. You may also ask Quinta de Cypriano, as far as this is technically possible, to transmit this data to other data controllers.
– Right to object
When data is processed based on Quinta de Cypriano’s legitimate interest or when it is processed for purposes other than those for which the data was collected but which are compatible with these purposes, you are entitled to object to the processing of your personal data for reasons related to your particular situation. In such cases, Quinta de Cypriano will stop processing your personal data unless it has legitimate reasons for doing so and these reasons must prevail over your interests.
– Right not to be subject to automated individual decision-making
Quinta de Cypriano does not make automated individual decisions, including profiling, which produce legal effects that concern you or significantly affect you.
– Right to withdraw consent
In cases where data is processed on the basis of your consent, you may withdraw your consent at any time. If you withdraw your consent, your personal data will no longer be processed unless there is another legal basis for doing so.
– Right to lodge complaints with the supervisory authority
You are entitled to lodge complaints with the relevant supervisory authority for matters related to the processing of your personal data. In Portugal, the competent supervisory authority is the National Data Protection Commission (Comissão Nacional de Protecção de Dados).

8. Exercising your rights, asking questions and making suggestions

To exercise any of the above rights, as well as to obtain clarification or make suggestions regarding the data processing, you must send a written request to the addresses below:
Email: quintadecypriano@gmail.com
Address: Rua de Quintela de Baixo, n.º 95, Vila Nova de Muía, 4980-830 Ponte da Barca, Portugal
There is no charge for this request to exercise your rights.

9. Changes to the Privacy Policy

Quinta de Cypriano reserves the right to change and update this Privacy Policy from time to time and you are therefore advised to consult it regularly.