Privacy & Data Protection Policy

Last updated: 1 January 2026

Hotel Portinari respects your privacy and handles personal data with care, transparency and appropriate security.

This Privacy & Data Protection Policy explains how we collect, use, store and protect personal data when you visit our website, make a reservation, stay at Hotel Portinari, visit our premises, contact us or otherwise use our services.

It also explains our use of CCTV surveillance and electronic access and door logs.

1. Who is responsible for your personal data?

The controller responsible for the processing of personal data is:

NV Zandhotel
trading as Hotel Portinari
Enterprise number: BE 0423.614.935
’t Zand 15
8000 Brugge
Belgium

Telephone: +32 (0)50 34 10 34
Email: info@portinari.be
Privacy and security enquiries: manager@portinari.be
Website: www.portinari.be

In this policy, “Hotel Portinari”, “we”, “us” and “our” refer to NV Zandhotel.

2. To whom does this policy apply?

This policy applies to personal data relating to, among others:

• hotel guests and accompanying guests;
• persons making or requesting a reservation;
• visitors to our hotel, restaurant, bar or event spaces;
• website visitors;
• persons contacting us by telephone, email, social media or another communication channel;
• persons subscribing to our newsletter or marketing communications;
• suppliers, business contacts and representatives of companies;
• participants in meetings, groups and events organised at our premises.

Separate privacy information may apply to employees, job applicants and other specific categories of persons where required.

3. What personal data do we process?

Depending on your relationship with Hotel Portinari, we may process the following categories of personal data.

Identification and contact information

This may include:

• first and last name;
• postal address;
• email address;
• telephone number;
• nationality;
• date of birth, where required;
• identity document information where required by law;
• company name and VAT or invoicing details.

Reservation and stay information

This may include:

• arrival and departure dates;
• room type and room number;
• number and identity of guests where applicable;
• booking history;
• requests and preferences communicated to us;
• correspondence concerning your reservation or stay;
• information regarding services ordered during your stay;
• complaints, incidents and guest service records.

Where you voluntarily provide information concerning allergies, accessibility requirements or other particular needs, we process this information only insofar as necessary to provide the requested service.

Payment and invoicing information

We may process:

• payment method;
• payment status;
• transaction references;
• amounts paid or outstanding;
• billing details;
• deposit or guarantee information.

Payment card data may be processed through specialised payment service providers. Hotel Portinari does not necessarily receive or store the complete card details itself.

Online and technical information

When you visit our website or use online services, we may process technical information such as:

• IP address;
• browser and device information;
• date and time of access;
• pages visited;
• referrer information;
• technical logs;
• cookie identifiers and similar technologies where applicable.

Communications

We may retain communications with you, including emails, messages, telephone notes and correspondence through reservation platforms or other communication services, where necessary for guest service, reservation management, dispute resolution, security or legal purposes.

CCTV images

Certain areas of Hotel Portinari are protected by CCTV surveillance.

Further information is provided in section 10 below.

Electronic access and door logs

Our electronic access control systems may record information concerning the use of electronic keys, key cards, credentials or other access methods.

Further information is provided in section 11 below.

4. Why do we process personal data?

We process personal data only where we have a legitimate and defined purpose.

These purposes include:

• processing enquiries and reservation requests;
• managing and performing hotel reservations;
• identifying and welcoming guests;
• providing hotel, restaurant, event and other requested services;
• processing payments, deposits and invoices;
• communicating with guests before, during and after their stay;
• handling requests, complaints and disputes;
• fulfilling accounting, fiscal, registration and other legal obligations;
• securing our buildings, guests, staff and property;
• preventing and investigating theft, fraud, unauthorised access and other incidents;
• managing electronic access to rooms and restricted areas;
• maintaining and improving our website and IT systems;
• protecting our IT infrastructure against abuse and security incidents;
• analysing our activities and improving our services;
• sending marketing communications where legally permitted;
• establishing, exercising or defending legal claims.

We do not use personal data for purposes that are incompatible with the purposes for which the information was originally collected.

5. Legal grounds for processing

Depending on the processing activity, Hotel Portinari relies on one or more of the following legal grounds under the General Data Protection Regulation.

Performance of a contract

We process personal data where necessary to process a reservation, provide accommodation or another requested service, or take steps at your request before entering into a contract.

Legal obligation

Certain information must be processed or retained because Belgian or European legislation requires us to do so, including accounting, tax and other statutory obligations.

Legitimate interests

We may process personal data where necessary for our legitimate interests or those of a third party, provided that these interests are not overridden by your fundamental rights and freedoms.

Such legitimate interests may include:

• protecting guests, employees and property;
• fraud and incident prevention;
• access control;
• network and IT security;
• handling and defending complaints or claims;
• maintaining appropriate business records;
• improving our services and operations.

Consent

Where required, we ask for your consent, for example for certain marketing activities or non-essential cookies.

You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing that took place before withdrawal.

Vital interests

In exceptional circumstances, personal data may be processed where necessary to protect the life or physical safety of you or another person.

6. Reservations through third parties

When you book Hotel Portinari through a third party such as an online travel agency, travel agent, tour operator or corporate booking partner, that party may provide us with the personal data required to manage your reservation.

The third party may independently determine how it processes your information before transmitting it to us. Its own privacy policy therefore also applies to that processing.

Once Hotel Portinari receives your reservation information, we process it in accordance with this policy.

7. Who receives your personal data?

We limit access to personal data to persons and organisations that require it for a legitimate purpose.

Depending on the service concerned, information may be shared with:

• authorised Hotel Portinari employees and management;
• reservation and property-management system providers;
• website and booking-engine providers;
• payment service providers;
• banks and financial institutions;
• accountants and financial service providers;
• IT, hosting, cloud and cybersecurity providers;
• email and communication service providers;
• customer-service and guest communication platforms;
• electronic access-control providers;
• CCTV and security system providers;
• professional advisers such as lawyers, auditors and insurers;
• public authorities, police, courts or supervisory authorities where required or permitted by law;
• other parties where necessary for the establishment, exercise or defence of legal claims.

Our processors may process personal data only within the framework of their contractual instructions and applicable data protection legislation.

We do not sell personal data to advertisers or data brokers.

8. International data transfers

Some of our technology and service providers may process or store data outside the European Economic Area.

Where this occurs, Hotel Portinari requires appropriate safeguards in accordance with the GDPR, such as an adequacy decision, approved contractual safeguards or other legally recognised transfer mechanisms.

9. How long do we retain personal data?

We do not retain personal data for longer than necessary for the purpose for which it was collected, unless a longer retention period is required by law or justified by an ongoing dispute, investigation or legal claim.

Retention periods may therefore differ according to the type of information.

In determining the appropriate period, we consider:

• statutory accounting and tax obligations;
• contractual obligations;
• limitation periods for legal claims;
• the purpose for which information was collected;
• security requirements;
• the principle of data minimisation.

Once personal data is no longer required, it is deleted, anonymised or otherwise securely disposed of.

Specific retention periods for CCTV images and access logs are set out below.

10. CCTV surveillance

Hotel Portinari uses CCTV surveillance for security purposes.

Cameras may operate 24 hours a day in designated areas of the hotel, including, where applicable:

• entrance areas;
• lobby and reception areas;
• circulation and passage areas;
• office or operational areas;
• other areas requiring security monitoring.

Cameras are not intended to monitor private guest activities and are not installed in guest bedrooms, bathrooms or other areas where guests may reasonably expect a high degree of privacy.

The presence of CCTV is indicated by the legally required signage.

Purpose of CCTV

CCTV is used for purposes including:

• protecting guests, visitors and employees;
• protecting buildings, equipment and other property;
• preventing, establishing or investigating theft, vandalism, violence or other security incidents;
• controlling unauthorised access;
• documenting incidents where necessary.

CCTV is not used for commercial profiling or marketing purposes.

Legal basis

CCTV processing is based primarily on Hotel Portinari’s legitimate interest in protecting persons and property and on the applicable Belgian legislation governing surveillance cameras.

Storage

Recorded CCTV images are in principle retained for no longer than 30 days.

Images may be retained for a longer period where they are relevant to:

• an identified security incident;
• suspected criminal activity;
• a complaint;
• an insurance claim;
• a legal dispute;
• an investigation by police or another competent authority.

In such cases, only the relevant images will be retained for as long as reasonably necessary for the relevant purpose or legal procedure.

Recorded images are stored on secured infrastructure, including secured cloud infrastructure where applicable.

Access to images

Access to CCTV footage is strictly limited to authorised persons who require access for security, technical, legal or management purposes.

Hotel Portinari does not provide CCTV footage to guests, employees or third parties merely upon informal request.

Where a request relates to an incident, access will be assessed in accordance with the GDPR, Belgian camera legislation and the rights and privacy of other persons appearing in the images.

CCTV footage may be provided to police, judicial authorities, insurers or other competent or authorised parties where legally permitted or required.

11. Electronic access control and door logs

For security and access-management purposes, Hotel Portinari uses electronic access-control systems.

Depending on the system and access point, these systems may record:

• the date and time of an access attempt;
• the relevant room, door or access point;
• the key card, electronic key, credential or identifier used;
• whether access was granted or refused;
• where applicable, the user, room or authorisation associated with the credential.

Door and access logs can therefore constitute personal data.

Purpose

Electronic access logs are used exclusively for legitimate operational and security purposes, including:

• providing and managing access to hotel rooms;
• restricting access to staff-only or secured areas;
• investigating security incidents;
• investigating reported unauthorised entry;
• troubleshooting electronic locks and access-control systems;
• protecting guests, staff and property;
• establishing facts in the event of a complaint, incident or legal dispute.

Access logs are not used for advertising or commercial profiling.

Retention period

Electronic door and access logs are normally retained for a maximum period of 90 days, unless a shorter retention period is technically configured.

Where a log is relevant to a security incident, complaint, police investigation, insurance matter or legal dispute, the relevant data may be retained for longer for the duration necessary to investigate or handle that matter.

Access to door logs

Access to electronic door logs is restricted to authorised management, designated technical personnel and authorised service providers where required.

Door logs may be disclosed to police, judicial authorities or other competent persons where required or permitted by law.

When a guest requests access to door-log information concerning his or her room, Hotel Portinari will assess that request under applicable data protection legislation and will also take into account the privacy and security rights of other individuals.

12. Security of personal data

Hotel Portinari applies appropriate technical and organisational safeguards designed to protect personal data against:

• unauthorised access;
• accidental loss;
• unlawful disclosure;
• alteration;
• destruction;
• misuse.

Measures may include access restrictions, user authentication, logging, encryption, secure cloud infrastructure, backups, staff instructions and contractual security obligations imposed on service providers.

Access to personal data is granted according to function and necessity.

No information system can nevertheless provide an absolute guarantee against every possible security incident.

13. Cookies and website technologies

Our website may use cookies and similar technologies.

Cookies that are strictly necessary for the operation and security of the website may be used without consent where legally permitted.

Analytics, advertising or other non-essential cookies are used only where an appropriate legal basis exists and, where required, after you have provided consent through our cookie-management system.

You can change or withdraw your cookie preferences at any time through the cookie settings available on our website.

Further details concerning the cookies currently in use, their providers, purposes and retention periods should be available through our cookie settings or cookie notice.

14. Marketing and newsletters

We may send newsletters, offers or other commercial communications where you have consented to receive them or where another lawful basis permits us to do so.

You may unsubscribe at any time by:

• using the unsubscribe function in the communication; or
• contacting us at info@portinari.be.

Withdrawing from marketing communications does not affect operational communications relating to an existing reservation, payment, stay, complaint or other service.

15. Children

Personal data relating to children may be processed where necessary for a family reservation, accommodation, safety or another requested hotel service.

We seek to limit such processing to what is reasonably necessary.

Parents or legal guardians may contact us concerning personal data relating to their children where applicable.

16. Your data protection rights

Subject to the conditions and limitations of the GDPR, you may have the right to:

• obtain information about how we process your personal data;
• obtain access to your personal data;
• request correction of inaccurate or incomplete data;
• request deletion of personal data;
• request restriction of processing;
• object to certain processing based on legitimate interests;
• object to direct marketing;
• receive certain personal data in a portable format;
• withdraw consent where processing is based on consent;
• lodge a complaint with a competent supervisory authority.

These rights are not absolute. For example, certain personal data cannot be deleted where we have a statutory obligation to retain it or where it is necessary for the establishment, exercise or defence of legal claims.

To exercise your rights, contact:

manager@portinari.be

or:

Hotel Portinari
NV Zandhotel
’t Zand 15
8000 Brugge
Belgium

We may request reasonable information to verify your identity before granting access to personal data.

17. Complaints

If you believe that Hotel Portinari has processed your personal data unlawfully, we encourage you to contact us first so that we can investigate your concern.

You also have the right to lodge a complaint with the Belgian Data Protection Authority:

Gegevensbeschermingsautoriteit / Autorité de protection des données
Brussels, Belgium
www.gegevensbeschermingsautoriteit.be

18. Police, judicial and other official requests

Personal data, CCTV images, access-control information or other records may be disclosed to police, judicial authorities or another legally competent authority where disclosure is required or authorised under applicable law.

Hotel Portinari does not provide unrestricted access to such information.

Requests are assessed according to the requesting party’s authority, the purpose of the request and applicable legal requirements.

Where appropriate, relevant CCTV footage, electronic door logs and other records may be preserved to prevent their automatic deletion while a legitimate investigation or legal procedure is ongoing.

19. Automated decision-making

Hotel Portinari does not currently make decisions producing legal or similarly significant effects on guests solely by means of automated processing or profiling.

Where this changes, this policy will be updated accordingly.

20. Changes to this Privacy Policy

Hotel Portinari may amend this Privacy & Data Protection Policy from time to time, for example following changes to our services, technology, suppliers or applicable legislation.

The most recent version is published on our website and contains the date of the latest update.

For significant changes, additional notice may be provided where appropriate.

21. Contact

Questions concerning privacy, CCTV surveillance, electronic access logs or the processing of your personal data can be addressed to:

Hotel Portinari
NV Zandhotel
’t Zand 15
8000 Brugge
Belgium

General enquiries: info@portinari.be
Privacy and security enquiries: manager@portinari.be
Telephone: +32 (0)50 34 10 34