Privacy Policy

A. GENERAL PART

A.1. Collection And Processing Of User Data

As part of the provision of the website hosted at www.pestanaportocovobeach.com (“Site”) and the information and means of contact included therein, Pestana Properties – SIC Imobiliária Fechada S.A., headquartered in Av. Duque de Ávila, 185, 4º D, 1050 – 082 Lisboa, Portugal and NIPC 517235722, as the person responsible for the processing of personal data (hereinafter referred to as “Pestana Properties”), may request and process certain personal data from the user.

Personal data is any information of any nature and regardless of its support, including sound and image, relating to an identified or identifiable natural person (“Data Subject” or “User”). A person who can be identified directly or indirectly is considered identifiable, namely by reference to an identification number or to more specific elements of their physical, physiological, psychological, economic, cultural or social identity.

A.2. Personal Data Collected

• Through this Privacy Policy, Pestana Properties provides the User with detailed information about the nature of the data collected and about the purpose and treatment that will be carried out in relation to their data.
• The personal data collected and processed include information regarding the name, e-mail address and telephone number, and there is also an open field in which the User is allowed to enter the information he wishes
• Pestana Properties also collects and processes information about its hardware and software, as well as information about the pages visited by the User within the Site. This information may include: your browser type, domain name, access times and the links through which the User accessed the Site (“Usability Information”). We only use this information to improve the quality of your visit to our Site.
• Pestana Properties may collect your personal data through cookies and other tracking technologies. The use of cookies by Pestana Properties is regulated in our Cookies Policy.

A.3. Subcontracted Entities And Data Sharing With Third Parties

• As part of the processing of the User’s personal data, Pestana Properties uses or may use third parties, subcontracted by it, so that, on behalf of Pestana Properties, and in accordance with the instructions given by it, they process the User’s data. User, in strict compliance with the provisions of the General Regulation on Data Protection (hereinafter, “RGPD”) and the GDPR Enforcement Law (Law No. 58/2019 8th of August), as well as this Privacy Policy.
• Any subcontracted entity in this scope may not transmit the Data Subject’s data to other entities without Pestana Properties having previously given written authorization to do so, being also prevented from contracting other entities without prior authorization from Pestana Properties.
• Pestana Properties undertakes to subcontract only entities that present sufficient guarantees for the execution of the appropriate technical and organizational measures, in order to ensure the defense of the User’s rights. All entities subcontracted by Pestana Properties are bound by the latter through a written contract which regulates, in particular, the object and duration of the treatment, the nature and purpose of the treatment, the type of personal data, the categories of data subjects. and the rights and obligations of the Parties.
• Under the applicable legal terms, Pestana Properties may transmit or communicate the user’s personal data to other entities in the event that such transmission or communication is necessary for the performance of the contract established between the Data Subject and Pestana Properties, or for pre- contractual obligations at the User’s request, in case it is necessary for the fulfillment of a legal obligation to which Pestana Properties is subject or in case it is necessary for the purpose of pursuing the legitimate interests of Pestana Properties or a third party. This may include communicating your personal data to the Pestana Group companies, when this communication is legally permissible.
• In case the User contracts with Pestana Properties services that are provided by other entities responsible for the processing of personal data, the User’s personal data may be consulted or accessed by these entities, insofar as this is necessary for the provision of said services.

A.4. Data Collection Channels

Pestana Properties may collect data directly, that is, directly from the Data Subject.

---

B. GENERAL PRINCIPLES APPLICABLE TO THE PROCESSING OF DATA HOLDER’S DATA

• In terms of general principles regarding the processing of your personal data, Pestana Properties undertakes to ensure that the User’s data processed by it is:

• • Object of a lawful, fair and transparent treatment in relation to the User;
  • Collected for specific, explicit and legitimate purposes, not being further processed in a way that is incompatible with those purposes;
  • Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
  • Accurate and updated whenever necessary, with all appropriate measures being taken so that inaccurate data, taking into account the purposes for which they are processed, are erased or rectified without delay;
  • Kept in a way that allows the identification of the User only for the period necessary for the purposes for which the data are processed;
  • Treated in a way that guarantees their safety, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, with appropriate technical or organizational measures being adopted.
• The data processing carried out by Pestana Properties is carried out in this case based on your consent to contact and to collect cookies.

• Pestana Properties undertakes to ensure that the processing of the User’s data is only carried out under the conditions listed above and with respect for the aforementioned principles.

• The period of time during which the data are stored and kept varies according to the purpose for which the information is processed. There are legal requirements that oblige you to keep data for a minimum period of time. Thus, and whenever there is no specific legal requirement, the data will be stored and kept only for the minimum period necessary for the purposes that motivated their collection or subsequent processing, after which they will be deleted.

• Specifically, when you contact us expressing interest in Pestana Porto Covo, your data will be processed as long as necessary to respond to your requests and to comply with our legal data retention obligations.

B.1. Use And Purposes Of User Data Processing

• In general terms, Pestana Properties uses User data for the following purposes:

• • Provide information to the User about the ongoing project;
  • Management of contacts with the User;

• Ensuring that the Site meets the User’s needs, through the development and publication of content as adapted as possible to the requests and type of User, by improving the Site’s search capabilities and functionalities and by obtaining aggregated or statistical information in relation to the User’s standard profile.

• In addition, Pestana Properties may also contact representatives of business customers, for the purpose of presenting Pestana Properties’ projects, translating into a legitimate interest of Pestana Properties to do so, without prejudice to the right to oppose this treatment at any time.

• In addition to the purposes above, where the User consents, Pestana Properties may process their data to send marketing communications, namely information, newsletters and invitations about the Pestana Porto Covo Beach Residences project and, where applicable, about other projects of the Pestana Group. The legal basis is the User’s consent, which may be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal. If the recipient is a representative of a business customer, Pestana Properties may rely on its legitimate interest, while always ensuring the right to object at any time, easily and free of charge. The User may exercise the opt-out via the “unsubscribe” links included in the communications or by contacting us through the channels indicated in this Policy.

B.2. Technical, Organizational And Safety Measures Implemented

• To ensure the security of the User’s data and maximum confidentiality, Pestana Properties treats the information provided to us in an absolutely confidential manner, in accordance with its internal security and confidentiality policies and procedures, which are periodically updated according to needs, as well as, in accordance with the legally prescribed terms and conditions.

• Depending on the nature, scope, context and purposes of data processing, as well as the risks arising from the processing to the User’s rights and freedoms, Pestana Properties undertakes to apply, both when defining the means of processing and at the time of processing itself, the necessary and appropriate technical and organizational measures for the protection of the User’s data and compliance with legal requirements.

• It also undertakes to ensure that, by default, only the data necessary for each specific purpose of the treatment are processed and that such data are not made available without human intervention to an indefinite number of people.

• In terms of general measures, the Pestana Properties adopts the following:
  • Regular audits in order to assess the effectiveness of the technical and organizational measures implemented;
  • Sensitization and training of personnel involved in data processing operations;
  • Pseudonymization and encryption of Personal Data;
  • Mechanisms capable of ensuring the permanent confidentiality, availability and resilience of information systems;
  • Mechanisms that ensure the restoration of information systems and access to Personal Data in a timely manner in the event of a physical or technical incident.

B.3. Data Transfers To Third Countries

• In principle, the processing operations associated with the Data Subject’s interaction with the Website will not imply the transfer of data or the processing of the same outside the European Economic Area.

• However, if it becomes necessary to transfer your data outside the European Economic Area, for example in the context of the use of certain providers of IT systems support services, the Pestana Properties will implement the necessary measures to ensure that these transfers comply applicable legislation, namely Chapter V of the GDPR, and that a level of protection essentially equivalent to the personal data of Data Subjects is guaranteed. This can be achieved, for example, by ensuring the existence of a European Commission Adequacy Decision in relation to the country of destination or by entering into Standard Contractual Clauses and, if necessary, implementing additional measures.

---

C. RIGHTS OF USERS (DATA OWNERS)

C.1. Procedures For The Exercise Of Rights By The User

• The right of access, the right of rectification, the right of erasure, the right of limitation, the right of portability and the right of opposition can be exercised by the User by contacting Pestana Properties, through the platform made available for this purpose, available at https://pestanahotelgroup.atlassian.net/servicedesk/customer/portal/5.

• When the processing of the User’s personal data is carried out by Pestana Properties based on the User’s consent, the User has the right to withdraw his consent at any time. The withdrawal of consent, however, does not compromise the lawfulness of the treatment carried out by Pestana Properties based on the consent previously given by the User.

• The table below contains a brief summary of the rights of Holders, as referred to in the paragraphs above.

Right of access	You will be able to obtain confirmation that the personal data concerning you are being processed, as well as access to them, being made available, if you require, and there are no legal restrictions, a copy of the personal data being processed.
Right of rectification	You may request the rectification of your personal data that are inaccurate as well as that your incomplete personal data be completed.
Right to erasure	Under the terms of the law, you can also, at any time, request the deletion of your personal data. Pestana Properties may refuse to grant your request in certain situations, namely when the data is still necessary for the purpose that motivated the collection or the processing is required to fulfill a legal obligation.
Right to limitation of treatment	The Data Subject may obtain the limitation of treatment when: a) contest the accuracy of the personal data; b) the treatment is unlawful and the holder requests the limitation as an alternative to erasure; c) the Pestana Properties no longer needs the data for the original purpose, these being required by the holder for the purposes of declaring, exercising or defending a right in a judicial process and; d) when the Data Subject has opposed the processing, until it is ascertained whether the legitimate interests of the person in charge prevail over those of the data subject.
Right to data portability	When the basis for the treatment is the consent or the execution of the contract and there is treatment by automated means, the Data Subject has the right to request the portability of his data. This right cannot, however, prejudice the rights and freedoms of third parties.
Right of opposition	When the data are processed on the basis of legitimate interests or public interest, or when the data are processed for the purpose of direct marketing, the data subject has the right to object to the treatment.
Right to withdraw consent	When consent is the legal basis for the processing of data, you are guaranteed the right to withdraw your consent at any time. This does not, however, invalidate the lawfulness of the processing carried out until that date based on the consent previously given.

• Pestana Properties will respond in writing (including by electronic means) to the User’s request without undue delay and, in any case, within a maximum period of one month from the receipt of the request, except in cases of special complexity or due to number of requests, where this period can be extended by up to two more months.
• If the requests made by the User are manifestly unfounded or excessive, namely due to their repetitive nature, Pestana Properties reserves the right to charge administrative costs or refuse to comply with the request.
• Without prejudice to any other administrative or judicial remedy, the Data Subject has the right to submit a complaint to the National Data Protection Commission or to another competent control authority under the law, if he considers that his data are not subject to lawful treatment by the Pestana Properties, under the terms of applicable legislation and this Policy.

C.2. Personal Data Violations

• In the event of a data breach (data breach) and to the extent that such breach is likely to entail a high risk for the User’s rights and freedoms, Pestana Properties undertakes to report the breach of personal data to the Control Authority within 72 hours of becoming aware of the incident, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.

• Additionally, Pestana Properties will notify the User of the personal data breach where it is likely to result in a high risk to his or her rights and freedoms, which it shall do without undue delay, or when Pestana Properties deems it relevant. Under legal terms, communication to the User is not required in the following cases:
  • If the Pestana Properties has applied adequate protection measures, both technical and organizational, and these measures have been applied to the personal data affected by the personal data breach, especially measures that make the personal data incomprehensible to any person not authorized to access such data, such as encryption;
  • If the Pestana Properties has taken subsequent measures to ensure that the high risk to the User’s rights and freedoms is no longer likely to materialise; or
  • If the communication to the User implies a disproportionate effort for the Pestana Properties. In this case, Pestana Properties will make a public communication or take a similar measure through which the User will be informed.

---

D. FINAL PART

D.1. Questions

• In case of doubts or questions regarding the way in which Pestana Properties treats your personal data, please contact your Data Protection Officer at dpo@pestana.com.
• You can also contact Pestana Properties directly through the forms available on the website.

D.2. Applicable Law And Jurisdiction

• The Privacy Policy, as well as the collection, processing or transmission of User data, are governed by the provisions of the RGPD and by the legislation and regulations applicable in Portugal, in particular the RGPD Enforcement Law.
• Any disputes arising from the validity, interpretation or execution of the Privacy Policy, or that are related to the collection, processing or transmission of User data, must be submitted exclusively to the jurisdiction of the judicial courts of the jurisdiction of the district where the Pestana Properties headquarters are located. (Judicial Court of the District of Lisbon), without prejudice to the mandatory legal rules applicable.

D.3. Changes To The Privacy Policy

Pestana Properties reserves the right to change this Privacy Policy at any time. In case of modification of the Privacy Policy, the date of the last modification, available at the top of this page, is also updated. If the change is substantial, a notice will be posted on the Site.

Date of the last update: 23 February 2026