MACAM

1. Legal Framework

Lunatejo - Gestão de Hotéis e Museus, S.A. , a public limited company with headquarters at Praça Duque de Saldanha, no. 1, 11th floor, in Lisbon, NIPC/registered at the Commercial Registry Office under no. 501691189 (hereinafter referred to as ‘Lunatejo’) as the managing entity of MACAM - Armando Martins Museum of Contemporary Art and MACAM Hotel (jointly referred to as ‘MACAM’), is committed to protecting the privacy and personal data of all persons with whom it interacts, namely guests, visitors, website users, employees, job applicants, collaborators, suppliers and other partners.

This Privacy Policy describes the data processing practices adopted by Lunatejo, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation - GDPR) and Law No. 58/2019 of 8 August, which ensures its implementation in the Portuguese legal system.

2. Data Controller

The entity responsible for processing personal data is:

Lunatejo – Gestão de Hotéis e Museus, S.A.

NIPC: 501691189

Headquarters: Praça Duque de Saldanha, n.º 1, 11.º, 1050-094 Lisbon

Email: lunatejo@fibeira.pt

Telephone: +351 218 727 400

3. Scope of Application

This policy applies to the processing of personal data within the scope of MACAM's activities, including, in particular:

Accommodation and hotel reservations;
Visits to the museum, ticket office and participation in events;
Interactions through the website and other digital platforms;
Video surveillance systems;
Recruitment and human resources management processes;
Marketing and institutional communication activities.

4. Categories of Personal Data Processed

Depending on the purpose and context of the processing, the following categories of personal data may be collected and processed:

a) Customers and Visitors

Identification: full name, date of birth, nationality, identification document, identification document;
Contact details: email, telephone number, address;
Financial data: tax identification number, billing data, payment method and information;
Preferences for stay or visit;
Reservation data and consumption of services;
Data collected by cookies and online browsing tools;
Images captured by video surveillance on the premises.

b) Employees, Collaborators and Candidates

Personal and identification data;
Academic and professional data;
Contractual and employment information;
Health data, when legally required;
Bank details for remuneration purposes;
Attendance and performance records.

5. Purposes and Legal Basis for Processing

Lunatejo only processes personal data when there is a legal basis provided for in the GDPR. The main purposes and respective bases are:

Purpose	Legal basis
Reservation and stay management	Contract performance or pre-contractual steps
Ticket and admission processing	Contract performance
Sending newsletters and campaigns	Data subject consent
Video surveillance	Legitimate interest in the security and protection of persons and property
Recruitment of employees and collaborators	Pre-contractual procedures / Consent
Contractual management of employees and collaborators	Contract execution / Legal obligation
Compliance with legal obligations	Legal obligation (e.g. tax, labour, judicial)

6. Collection of Personal Data

Data may be collected:

Directly from data subjects (forms, face-to-face, telephone or digital interactions);
Automatically, through the website and cookies;
Through third parties, such as booking platforms, through legitimate data sharing within the scope of contract execution.

Lunatejo undertakes to provide all information required by law at the time of collection.

7. Video surveillance

MACAM has video surveillance systems in the common areas of its facilities, which are properly signposted and comply with applicable legislation. The images are kept for the maximum legal period (30 days) and are only accessible by authorised personnel. They may be provided to the competent authorities upon legally justified request.

8. Communication and Data Sharing

Lunatejo may share personal data with:

Online booking platforms (acting as joint controllers or subcontractors);
Subcontracted service providers (e.g. information technology, marketing, cleaning, security);
Public and judicial authorities, when legally required;
Financial institutions and insurance companies, when applicable.

All subcontractors are contractually bound to guarantee the security and confidentiality of data.

9. International Data Transfers

Lunatejo does not, as a rule, transfer personal data outside the European Economic Area. If this occurs, all measures provided for in the GDPR will be taken to ensure an adequate level of protection.

10. Data Retention Periods

Personal data will only be retained for as long as necessary to fulfil the purposes for which it was collected and processed, or as required by legal obligations. After this period, the data will be deleted or anonymised.

11. Data Subject Rights

Under applicable law, data subjects may exercise the following rights:

Access to their personal data;
Rectification of inaccurate or incomplete data;
Erasure of data (‘right to be forgotten’);
Restriction of processing;
Objection to processing;
Data portability;
Withdrawal of consent, where applicable;
Right to lodge a complaint with the National Data Protection Commission (CNPD).

The exercise of these rights can be requested through:

Email: lunatejo@fibeira.pt

Address: Praça Duque de Saldanha, nº. 1, 11º, 1050-094 Lisbon

Telephone: +351 218 727 400

12. Data Security

Lunatejo adopts appropriate technical and organisational measures to protect personal data, ensuring its confidentiality, integrity and availability, preventing its loss, unauthorised access or improper disclosure.

13. Cookies and Similar Technologies

The MACAM website uses cookies and similar technologies to improve the browsing experience, personalise content, collect statistics and provide essential features. The use of cookies is governed by a separate Cookies Policy, which should be consulted separately.

14. Changes to the Privacy Policy

This Privacy Policy may be updated periodically, with any changes published on the official MACAM website. We recommend that you read the policy regularly to stay informed about how your data is processed.