A. General Part
1.1. Collection and Processing of User Data

This Privacy Policy aims to provide Users of the website hosted at www.rossiogardensuites.com (hereinafter referred to as the “Site”) with detailed information on how Rossio Garden Suites / Plataforma Investimentos Imobiliários, Lda., headquartered at Rua Luciano Cordeiro, nº123 R/C Esq, 1300 – 314 Lisbon, registered with the Lisbon Commercial Registry under the unique company and corporate identification number 503144797 (hereinafter “Rossio Garden Suites”), as data controllers or processors, handle their personal data.

As a rule, Personal Data is requested when the User registers or browses the Site, requests contact and/or newsletters, subscribes to a product or service, provides or requests information, purchases a product, or establishes a contractual relationship with Rossio Garden Suites through a stay reservation at one of our establishments.

The Personal Data collected and processed essentially consists of information relating to name, gender, date of birth, telephone, mobile phone, email, address, tax identification number, credit card details (collected solely for payment purposes), although other Personal Data may be collected if necessary or convenient for the provision or billing of services by Rossio Garden Suites.

Rossio Garden Suites may also collect and process information about the pages visited by the User within the Site. This information may include browser type, domain name, access times, and hyperlinks through which the User accessed the Site (“Usability Information”). This information is collected ensuring user anonymity, used in aggregate form and based on statistics. We use this statistical information to improve the quality of visits by potential clients to our Site, analyze browsing habits, and measure advertising conversion.

The Rossio Garden Suites Site does not use cookies of any kind.

Usability Information and Personal Data are referred to in this Privacy Policy as “User Data.”
For the purposes of this Privacy Policy, a contractual relationship means any contract established between Rossio Garden Suites and the entities with which it interacts, regardless of its subject matter.

1.2. Data Recipients

User Data collected by Rossio Garden Suites is not shared with third parties without the User’s consent, except in the situations described below. However, if the User contracts services from Rossio Garden Suites that are provided by other entities responsible for processing personal data, the User Data may be transmitted to and/or accessed by those entities, insofar as necessary for the provision of such services.

Under applicable law, Rossio Garden Suites may transmit or disclose User Data to other entities if such transmission or disclosure is necessary for the execution of the contract established between the User and Rossio Garden Suites, or for pre‑contractual measures at the User’s request, if required to comply with a legal obligation to which Rossio Garden Suites is subject, or if necessary to safeguard the legitimate interests of Rossio Garden Suites or a third party. In the event of a transmission of User Data to third parties, reasonable efforts will be made to ensure that the recipient uses the transmitted User Data appropriately and in accordance with this Privacy Policy.

I) Subcontracted Entities

In the context of processing User Data, Rossio Garden Suites may engage third‑party entities, subcontracted by it, to process User Data on its behalf and in accordance with its instructions, in compliance with applicable law and this Privacy Policy.

These subcontracted entities may not transmit User Data to other entities without prior written authorization from Rossio Garden Suites.

Rossio Garden Suites undertakes to subcontract only entities that provide maximum security in implementing appropriate technical and organizational measures to safeguard User rights.

In compliance with the duty of information to which Rossio Garden Suites is bound, the following categories of subcontractors to whom personal data of website users and clients of Rossio Garden Suites may be communicated are presented:

a) Categories of subcontracted entities: Licensing, maintenance, support, and technical assistance companies for software and systems

Purpose of personal data processing: Management / maintenance / support of systems and software supporting Rossio Garden Suites’ activity

b) Categories of subcontracted entities: Payment processing companies, EDI and electronic invoicing services, accounting, tax and administrative management, and supporting software

Purpose of personal data processing: Economic and accounting management of invoicing for clients, suppliers, and service providers

c) Categories of subcontracted entities: Digital marketing partners

Purpose of personal data processing: Performance and user profile analysis, advertising impact and dissemination

d) Categories of subcontracted entities: Security/surveillance companies and companies providing preventive and corrective maintenance of security systems

Purpose of personal data processing: Video surveillance and monitoring for the safety of people and property

II) Third Parties

Rossio Garden Suites may also disclose data to other third parties not qualified as subcontractors under Article 4(8) of the GDPR. These entities are subject to confidentiality and have all provided assurances that they process personal data in accordance with the GDPR.

Rossio Garden Suites communicates data to other recipients, as detailed below:

a) Category of recipients: Temporary employment agencies (this item applies only to the personal data of our employees. All others are excluded).

Purpose of personal data processing: Temporary assignment of workers.

b) Category of recipients: Consultants and Lawyers

Purpose of personal data processing: Provision of consultancy and legal services.

c) Category of recipients: Various companies providing additional services requested by clients

Purpose of personal data processing: Taxi/transfer services, parking, car rental, restaurant reservations, and other activities requested by the client.

1.3. Data Collection Channels

Rossio Garden Suites may collect data directly (i.e., directly from the User) or indirectly (i.e., through partner entities or third parties). Data collection may occur through the following channels:

• Direct collection: in person, by telephone, by email, and through the Site;
• Indirect collection: through partners, group companies, and official entities.

2. General Principles Applicable to the Processing of User Data

In terms of general principles relating to the processing of personal data, Rossio Garden Suites undertakes to ensure that the User Data it processes is:

• Processed lawfully, fairly, and transparently in relation to the User;
• Collected for specific, objective, and legitimate purposes, and not further processed in a manner incompatible with those purposes;
• Adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed;
• Accurate and kept up to date whenever necessary, with all reasonable measures taken to ensure that inaccurate data, considering the purposes for which it is processed, is erased or corrected without delay;
• Retained in a form that permits identification of the User only for the period necessary for the purposes for which the data is processed;
• Processed in a manner that ensures its security, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, with appropriate technical or organizational measures adopted.

The processing of data carried out by Rossio Garden Suites is permitted and lawful when at least one of the following conditions applies:

• The User has given free, positive, explicit, and unequivocal consent for the processing of their data for one or more specific purposes;
• Processing is necessary for the performance of a contract to which the User is a party, or for pre‑contractual measures at the User’s request;
• Processing is necessary for compliance with a legal obligation to which Rossio Garden Suites is subject;
• Processing is necessary to protect the vital interests of the User or another natural person;
• Processing is necessary for the purposes of the legitimate interests pursued by Rossio Garden Suites or by third parties (except where such interests are overridden by the User’s fundamental rights and freedoms requiring the protection of personal data).

Rossio Garden Suites undertakes to ensure that the processing of User Data is carried out only under the conditions listed above and in compliance with the principles mentioned.

Where the processing of User Data is based on the User’s consent, the User has the right to withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out by Rossio Garden Suites based on consent previously given by the User.

The period of time during which data is stored and retained varies according to the purpose for which the information is processed, and data is archived only for the time necessary to fulfill the purposes for which it was collected or subsequently processed.

There are, in fact, legal requirements that oblige data to be retained for a minimum period. Thus, whenever no specific legal obligation exists, data will be stored and retained only for the minimum period necessary for the purposes that motivated its collection or subsequent processing, after which it will be deleted.

3. Use and Purposes of User Data Processing

In general terms, Rossio Garden Suites uses User Data for the following purposes:

• Provision of hotel services and associated services;
• Acquisition and management of Vouchers;
• Management of contacts with the User and response to budget requests;
• Billing and collection from the User;
• Ensuring that the Site meets the User’s needs, through the development and publication of content as tailored as possible to requests and user type, improving the Site’s search capabilities and functionalities, and obtaining associated or statistical information regarding the typical User profile (analysis of consumption and browsing profiles).

Rossio Garden Suites may combine Usability Information with anonymous demographic information for research purposes and may use the result of this combination to provide more relevant content on the Site. With the User’s consent, in certain restricted areas of the Site, Rossio Garden Suites may combine Personal Data with Usability Information to provide more personalized content.

4. Legal Basis for Data Processing

The processing of your personal data has the following purposes:

Processing Activity: Contractual Relationship Management

• Purposes of Processing:
  • Reservation and provision of hotel services and associated services
  • Budget requests, information, and reservation confirmations
  • Registration of preferences (mobility, bed type, preferred room, etc.)
  • Recording of electronic communications within the contractual relationship
  • Acquisition of Vouchers

• Legal Basis:
  • Pre‑contractual measures or performance of the contract (for reservation and provision of hotel services)
  • Legitimate interest if the data subject is not a party to the contract (for reservation and provision of hotel services)
  • Performance of contract (for acquisition of vouchers)

Processing Activity: Compliance with Legal Obligations

•  Purpose of Processing:
  • Billing
  • Complaint management
  • Communications

• Legal Basis:
  • Legal or regulatory obligation

Processing Activity: Profile Analysis and Site Navigation

• Purposes of Processing:
  • User profile analysis
  • Analysis of user conversions
  • Implementation of improvements and site development

• Legal Basis:
  • Legitimate interest (for improvements and development)

5. Technical, Organizational, and Security Measures Implemented

To ensure the security of User Data and maximum confidentiality, Rossio Garden Suites processes the information you provide in absolute confidentiality, in accordance with its internal security and confidentiality policies and procedures, which are periodically updated as needed, as well as in compliance with legally established terms and conditions.
Depending on the nature, scope, context, and purposes of data processing, as well as the risks arising from processing for the rights and freedoms of the User, Rossio Garden Suites undertakes to apply, both at the time of defining the means of processing and during the processing itself, the necessary and appropriate technical and organizational measures to protect User Data and comply with legal requirements.

Rossio Garden Suites further undertakes to ensure that, by default, only the data necessary for each specific purpose of processing is processed and that such data is not made available, without human intervention, to an indeterminate number of people.

B. User Rights (Data Subjects)

Under the Personal Data Protection Law, we guarantee you the right to access, update, rectify, erase, portability, and deletion of your personal data. You may also lodge complaints with the National Data Protection Commission.

The exercise of these rights must be carried out through the following email address: ask@rossiogardensuites.com or by mail to: Rossio Garden Suites, Rua do Jardim do Regedor, nº 2, 1150‑194 Lisbon, Portugal.
If any client or citizen wishes to report the occurrence of any situation of personal data breach that causes, accidentally or unlawfully, the destruction, loss, alteration, disclosure, or unauthorized access to personal data transmitted, stored, or otherwise processed, they may contact us through the following email address: ask@rossiogardensuites.com or by mail to: Rossio Garden Suites, Rua do Jardim do Regedor, nº 2, 1150‑194 Lisbon, Portugal.

C. Final Part

6. Changes to the Privacy Policy

Rossio Garden Suites reserves the right to amend this Privacy Policy at any time. We recommend regular reading of this document.

7. Right to Lodge a Complaint with a Supervisory Authority

You may always lodge your complaint with the competent Supervisory Authority for personal data protection. In Portugal, the Supervisory Authority is the National Data Protection Commission, located at Av. D. Carlos I, 134 – 1st floor, 1200‑651 Lisbon, telephone (+351) 213928400, email: geral@cnpd.pt.

Update date: December 13, 2025