Privacy and Data Policy

1. Legal Framework

Lunatejo - Gestão de Hotéis e Museus, SA , a public limited company with registered office at Praça Duque de Saldanha, no. 1, 11.o, in Lisbon, NIPC/registration at the Commercial Registry Office under no. 501691189 (hereinafter referred to as "Lunatejo"), as the managing entity of MACAM – Museu de Arte Contemporânea Armando Martins and MACAM Hotel (jointly referred to as "MACAM"), undertakes to protect the privacy and personal data of all people with whom it interacts, namely guests, visitors, website users, employees, job applicants, collaborators, suppliers and other partners.

This Privacy Policy describes the data processing practices adopted by Lunatejo , in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016 (General Data Protection Regulation - GDPR), and Law No. 58/2019 , of August 8, which ensures its execution in the Portuguese legal system.

2. Data Controller

The entity responsible for processing personal data is:

Lunatejo – Hotel and Museum Management, SA
NIPC : 501691189
Headquarters : Duque de Saldanha Square, No. 1, 11th, 1050-094 Lisbon
Email : lunatejo@fibeira.pt
Telephone : 351 218 727 400

3. Scope of Application

This policy applies to the processing of personal data within the scope of MACAM 's activity, including, in particular:

• Accommodation and hotel reservations;
• Visits to the museum, ticket office and participation in events;
• Interactions through the website and other digital platforms;
• Video surveillance systems;
• Recruitment processes and human resources management;
• Marketing and institutional communication actions.

4. Categories of Personal Data Processed

Depending on the purpose and context of the processing, the following categories of personal data may be collected and processed:

a) Customers and Visitors
• Identification: full name, date of birth, nationality, identification document, identification document;
• Contacts: email, telephone number, address;
• Financial data: NIF, billing data, payment method and information;
• Stay or visit preferences;
• Reservation and service consumption data;
• Data collected by cookies and online browsing tools;
• Images captured by video surveillance at the facilities.

b) Workers, Collaborators and Candidates
• Personal and identification data;
• Academic and professional data;
• Contractual and employment information;
• Health data, when legally required;
• Bank details for remuneration purposes;
• Attendance and performance records.

5. Purposes and Legal Basis for Processing

Lunatejo only processes personal data when there is a lawful basis provided for in the GDPR. The main purposes and respective grounds are:

Purpose

• Management of reservations and stays
• Ticket and entry processing Contract execution
• Sending newsletters and campaigns Consent of the holder
• Video surveillance
• Recruitment of workers and collaborators
• Contractual management of workers and collaborators
• Compliance with legal obligations

Legal Basis

• Execution of contract or pre-contractual due diligence
• Contract execution
• Consent of the holder
• Legitimate interest in the safety and protection of people and property
• Pre-contractual due diligence / Consent
• Contract performance / Legal obligation
• Legal obligation (e.g. tax, labor, judicial)

6. Collection of Personal Data

Data may be collected:

• Directly with the holders (forms, face-to-face, telephone or digital interactions);
• Automatically, through the website and cookies;
• Through third parties, such as booking platforms, through legitimate sharing of data within the scope of contractual execution.

Lunatejo undertakes to provide all legally required information at the time of collection.

7. Video surveillance

MACAM has video surveillance systems in the common areas of its facilities, which are duly signposted and in compliance with applicable legislation. The images are kept for the maximum legal period (30 days) and are only accessible by authorized personnel, and may be provided to the competent authorities upon legally justified request.

8. Communication and Data Sharing

Lunatejo may share personal data with:

• Online booking platforms (acting as joint controllers or subcontractors);
• Subcontracted service providers (e.g. information technology, marketing, cleaning, security);
• Public and judicial authorities, when legally required;
• Financial institutions and insurance companies, where applicable.

All subcontractors are contractually bound to guarantee data security and confidentiality.

9. International Data Transfers

Lunatejo does not, as a rule, transfer personal data outside the European Economic Area. If this occurs, all measures provided for in the GDPR will be adopted to ensure an adequate level of protection.

10. Data Retention Periods

Personal data will only be retained for the period necessary to fulfill the purposes for which it was collected and processed, or as required by legal obligations. After this period, the data will be deleted or anonymized.

11. Data Subject Rights

Under applicable legislation, data subjects may exercise the following rights:

• Access to your personal data;
• Rectification of inaccurate or incomplete data;
• Erasure of data ("right to be forgotten");
• Limitation of treatment;
• Opposition to treatment;
• Data portability;
• Withdrawal of consent, where applicable;
• Right to file a complaint with the National Data Protection Commission (CNPD) .

The exercise of these rights can be requested through:

Email: lunatejo@fibeira.pt
Address: Duque de Saldanha Square, no. 1, 11th, 1050-094 Lisbon
Telephone: 351 218 727 400

12. Data Security

Lunatejo adopts appropriate technical and organizational measures to protect personal data, ensuring its confidentiality, integrity and availability, preventing its loss, unauthorized access or undue disclosure.

13. Cookies and Similar Technologies

The MACAM website uses cookies and similar technologies to improve the browsing experience, personalize content, collect statistics and provide essential features. The use of cookies is governed by a specific Cookies Policy , which should be consulted separately.

14. Changes to the Privacy Policy

This Privacy Policy may be updated periodically, and any changes will be published on the official MACAM website. We recommend that you read the policy regularly to stay informed about how your data is processed.