PRIVACY POLICY FOR THE WEBSITE www.portuscalehotel.com

IDENTIFICATION OF THE DATA CONTROLLER

Name: ZH Hotel S.A.

Registered office: Avenida da Boavista, 1060, 4100-113 Porto

VAT number (NIPC): 513 911 391

Telephone: +351 226 083 900 (call to the national fixed network)

E-mail: reservas@portuscalehotel.com

INFORMATION OBLIGATION

The protection of personal data of natural persons in Portugal is governed by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (“GDPR”) and by Law No. 58/2019 of 8 August, which ensure the protection of natural persons with regard to the processing of personal data and the free movement of such data.

“Personal data” means any information, of any nature and regardless of its medium, including sound and image, relating to an identified or identifiable natural person. Therefore, this protection does not apply to data relating to legal entities.

An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his or her physical, physiological, mental, economic, cultural or social identity (for example, name associated with a telephone number or email address).

By reading this Privacy Policy, the User is informed about the processing of their personal data carried out by ZH Hotel S.A. through the ZH Hotel S.A. website.

PURPOSES OF PERSONAL DATA PROCESSING

The personal data collected and processed through the above-mentioned Website will only be used for the following purposes:

1. To manage the provision of services requested through the Website, such as contact requests or booking management;
2. To periodically send communications with news related to the activity of ZH Hotel S.A. and the sector in which it operates;
3. Anonymous and aggregated analysis of service usage, in order to identify user habits and trends, to improve the services offered and meet specific user needs;
4. In the case of contracting, the data collected through this Website, together with other data obtained within the contractual relationship, will be used for human resources management, to ensure compliance with legal obligations, and to provide employees with the necessary means to carry out their professional activity;
5. Compliance with national and international legal provisions, or execution of an order from competent judicial authorities;
6. Compliance with legal obligations arising from applicable data protection legislation, as well as for the exercise of data subjects’ rights, in particular the defence of a right in legal proceedings.

ZH Hotel S.A. guarantees the confidentiality of all data provided. Notwithstanding that ZH Hotel S.A. processes personal data securely and takes appropriate measures to prevent loss or misuse, using the most suitable techniques for this purpose, users should be aware that data transmission over open networks does not allow absolute security, and there is a risk that data may be accessed or used by unauthorised third parties.

Failure to provide mandatory data may make it impossible to respond to the data subject’s request.

LEGAL BASIS FOR DATA PROCESSING

ZH Hotel S.A. processes users’ data:

1. when users give their free, specific, informed and unambiguous consent for the processing of their personal data for specific purposes; and/or
2. when necessary for the performance of a contract to which the user is a party, or for pre-contractual steps at the user’s request; and/or
3. for compliance with legal obligations to which ZH Hotel S.A. is subject; and/or
4. for the purposes of legitimate interests pursued by ZH Hotel S.A. or by third parties, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject requiring protection of personal data.

The User guarantees that the information provided is true, accurate, complete and up to date, and is responsible for any direct or indirect damage or loss that may result from failure to comply with this obligation.

If the data provided belongs to a third party, the User guarantees that they have informed said third party of the aspects contained in this document and obtained their authorisation to provide their data to ZH Hotel S.A. for the stated purposes.

RETENTION PERIOD

ZH Hotel S.A. retains and processes personal data only for the period necessary or legally required to fulfil the purposes described above, applying appropriate retention criteria for each processing activity in line with applicable legal and regulatory obligations.

ZH Hotel S.A. keeps personal data in its systems in a way that allows data subjects to be identified according to the following criteria:

• for no longer than is necessary for the purposes for which they were collected, unless legal or contractual obligations require otherwise;
• to comply with specific legal or contractual obligations;
• where applicable and lawful, until any objection or deletion request by the data subject.

DATA DISCLOSURE

In addition to disclosures made in compliance with legal obligations, personal data of the data subject may be accessed, in addition to ZH Hotel S.A., by:

• external service providers of ZH Hotel S.A., acting as processors;
• national and international companies belonging to the same group as ZH Hotel S.A.;
• authorities in general, administrations, public bodies and entities, both national and international;
• ZH Hotel S.A.

INTERNATIONAL DATA TRANSFERS

Personal data collected will be processed within the European Economic Area, with no international transfers of data to third countries or international organisations.

In the event of any processing of personal data outside the European Economic Area, it will only take place with appropriate safeguards and the required level of protection, in accordance with applicable data protection legislation.

INFORMATION SECURITY

ZH Hotel S.A. has implemented appropriate technical and organisational security measures to ensure the security of personal data provided by the User, in order to prevent alteration, loss, unauthorised processing and/or access, taking into account the state of technology, the nature of the data stored and the risks to which they are exposed.

Personal data is processed with the level of protection legally required to ensure its security and to prevent alteration, loss, processing or unauthorised access, taking into account the state of the art. The User acknowledges and accepts that internet security measures are not infallible.

If ZH Hotel S.A. outsources services involving the processing of personal data, such entities will be required to adopt the necessary technical and organisational measures to protect personal data against destruction, loss, alteration, disclosure, unauthorised access or any other form of unlawful processing.

EXERCISE OF RIGHTS

In accordance with the GDPR, the User may exercise their rights of access, rectification and, where applicable, restriction of processing, erasure, data portability, objection and withdrawal of consent, under the GDPR, by submitting a written request through any of the following means, specifying the right(s) they wish to exercise:

• E-mail: reservas@portuscalehotel.com ;
• Postal address: Avenida da Boavista, 1060, 4100-113 Porto

SUPERVISORY AUTHORITY

The User also has the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD) regarding matters related to the exercise of their rights and the protection of their personal data, if they consider that their data protection rights have been violated.

THIRD-PARTY WEBSITES

The Website may contain advertising, links or other content that link or redirect to pages and services of suppliers, advertisers, affiliates or sponsors of ZH Hotel S.A. and other third parties.

However, ZH Hotel S.A. does not control the content or links appearing on those pages and is not responsible for the practices used by those websites. ZH Hotel S.A. advises Users to review the privacy policies of such websites, as well as their terms and conditions.

Browsing or interacting with any other website, including those that contain external links to this Website, is subject to the terms and conditions of that website, and in no case shall ZH Hotel S.A. be responsible for such access or use.

DATA PROCESSING CARRIED OUT BY THE COMPANY DEVELOPING AND MANAGING THE WEBSITE AS AN INDEPENDENT DATA CONTROLLER

Without prejudice to the data processing carried out by ZH Hotel S.A. as identified above in Section 1 of this Privacy Policy, the User is informed that MIRAIFUTURE PORTUGAL, LDA., with registered office at Buganvília Plaza 1, Quinta do Lago, 8153-013 Almancil and VAT number 515 139 092, may act, in specific situations, as an independent Data Controller, determining autonomously the purposes and means of processing.

This applies, in particular, to data processed to ensure the operation, maintenance and security of the booking engine.

In such cases, the User’s data will be processed as follows:

• Purpose: to ensure the operability, security and continuous improvement of the Website;
• Legal basis: legitimate interest;
• Retention period: for the period strictly necessary to fulfil these purposes.

Mirai ensures that, even in these cases, only the strictly necessary data is processed, adopting appropriate technical and organisational measures to guarantee its security and confidentiality.

The User may exercise the rights referred to in Section 9 by submitting a written request through any of the following means, specifying the right(s) they wish to exercise:

• E-mail: portugal@mirai.com;
• Postal address: Buganvília Plaza 1, Quinta do Lago, 8153-013 Almancil

The User may also exercise the rights set out in Section 10.

CHANGES TO THE PRIVACY POLICY

In order to ensure the adequacy of this document, ZH Hotel S.A. reserves the right to review this Policy at any time it deems appropriate. Users are therefore advised to review this Privacy Policy regularly and/or each time they access the Website.

Updated on 23/04/2026.