General Personal Data Protection Policy (B&B HOTELS mobile app and website www.hotel-bb.com)

Date of update: 20/07/2026

Preamble

As part of its business, B&B HOTELS collects and processes the personal data of its contacts, customers, potential customers, suppliers and partners. The main purpose of this document is to inform its recipients of the conditions under which their data will be processed.

This policy is aimed at users (hereinafter, “Users”) of the B&B HOTELS website https://www.hotel-bb.com/en/pt (hereinafter, the “Website”) and the B&B HOTELS mobile application (hereinafter, the “App”) through which the B&B HOTELS online booking platform (hereinafter, the “Platform”) operates.

Our aim is to inform all Users, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, the “Regulation” or “GDPR”), about how their personal data collected through our Website and App will be processed in the context of room reservations in the countries where B&B HOTELS has hotel establishments, as well as the free B&me and B&me Club payment plan.

Ensuring adequate protection of personal data is a priority for B&B HOTELS, which is why we are committed to doing so in strict compliance with applicable laws and regulations.

1. Definitions

Application: B&B HOTELS mobile application available for iOS and Android devices.

Platform: central online booking system provided by the B&B HOTELS Group on its website and app.

Data controller: The company CBBHP-Hotels in Portugal, S.A., Corporate Tax ID (NIPC) 514820705 with registered office at Rua Vasco de Gama, n.5, 2685-244 Portela (hereinafter, B&B HOTELS), in its capacity as data controller, manages the data processing operations carried out through the Website or Application in Portugal.

Services: all the services offered by B&B HOTELS through its Platform. All the services available are detailed in the General Conditions of Use (GCU), which can be accessed via the following link General Conditions of Use

Website: B&B HOTELS website, available via the following link https://www.hotel-bb.com/en/pt

User: Any person accessing or browsing the Website or the Application, regardless of whether they are a customer, operator or any Internet user with or without a personal user account.

2. Data controllers

B&B HOTELS operates through a central online booking system shared by the hotels listed at the following link Hotels in Portugal - B&B HOTELS

As part of the booking process carried out via the Website or Application, B&B HOTELS is jointly responsible for processing personal data with the companies that operate the hotels where the bookings are made. You can consult the list of hotels at the following link: Hotels in Portugal - B&B HOTELS

2.1. Joint Controllers.

Other companies within the B&B HOTELS Group intervene as joint controllers for the processing of personal data for the following purposes:

1. Management of the Platform and processing of bookings made through it;

2. Direct marketing management;

3. Management of the centralised booking system;

4. Management of the free B&me loyalty program and the B&me Club program;

5. Management of the whistleblowing channel;

6. Management of website cookies.

The companies on the list accessible here act as joint controllers for:

Management of the Platform and the processing of bookings made through it;
Direct marketing management;
Management of the centralised booking system.

The companies on the list accessible here act as joint controllers for the management of the free B&me loyalty program and the B&me Club program.

B&B HOTELS has signed joint responsibility agreements with the data controllers, which establish their respective obligations. The general lines of which are available upon request by email to the B&B HOTELS at the following address: prt-privacy@hotelbb.com.

3. Transparent and legal collection of personal data

In order to respect the principles of loyalty and transparency, B&B HOTELS guarantees that data subjects are duly informed about the processing operations being carried out when their personal data is collected.

All data is obtained lawfully. No data is collected without the data subject’s knowledge or consent.

4. Legitimate and proportionate use of personal data

When B&B HOTELS processes your personal data, it does so for specific purposes: each data processing operation therefore fulfils a legitimate, specific and explicit purpose.

For each of the operations carried out, B&B HOTELS undertakes to collect and use only the pertinent, relevant and strictly necessary data in relation to the purposes for which they are processed.

B&B HOTELS guarantees that the data will be kept up to date and will apply procedures that allow incorrect data to be deleted or rectified.

5. Data processed

B&B HOTELS collects and processes the following categories of personal data for the purposes indicated in the following section:

Identification data: name, surname, address, telephone number, e-mail address, date of birth, age and customer code.
Professional details: the company where you work and its address.
Browsing data: logs and connection data, computer hardware identification data, language preferences, geographical location data, data relating to the use of the Platform and the Services, including data provided in requests (done by Users) and data collected through cookies or other similar technologies.
Booking details: arrival and departure dates, details of the other people who will be occupying the room booked (name and age, preferences such as whether they want a smoking room, floor, etc.). If the invoice is requested in the name of a company with an address other than the personal address, the name, registered office, VAT number, etc. must be indicated. This also includes data related to fraud prevention: phone number, first name, last name, and email address associated with bookings where signs of fraudulent activity have been detected through the call center service.
Transactional data: transaction number, data relating to the means of payment, details of the purchase, subscription or service subscribed to, data relating to the payment of invoices, payment terms, discounts granted, receipts, balances and unpaid invoices. The bank card number, expiry date and encrypted code are exclusively used for payment.
Video surveillance data: Images captured by video surveillance systems installed in common areas of B&B HOTELS hotel premises, for the purpose of ensuring the safety of individuals and property.
Wi-Fi Portal usage data: Identification data (name and email address) voluntarily provided by the User when connecting to the Wi-Fi Portal available at B&B HOTELS.

6. Purposes, legal grounds and data retention periods

Each processing operation carried out by B&B HOTELS has an express, legitimate and specific purpose, based on the performance of an agreement, the fulfilment of a legal or regulatory obligation, the User’s consent or a legitimate interest. The data will only be kept for the period strictly necessary for the purposes for which it is used.

The purposes for which Users’ personal data may be processed, their legal basis and the retention period are set out below:

PURPOSE	LEGAL BASIS	RETENTION PERIOD
Manage bookings and monitor the commercial relationship with customers in relation to these, including the management of complaints, if any.	Execution of the agreement signed with customers	Active Bases: The data required to manage customer relations will be kept for as long as necessary for the performance of the agreement. Intermediate files: For the purposes of declaring, exercising or defending rights in judicial or pre-judicial proceedings, they will be kept for as long as the limitation period for said rights has not elapsed and until the precautionary measure has been concluded, and/or for the duration of the proceedings until ordinary and extraordinary remedies have been exhausted. Data relating to payments made by bank card will be kept for 13 months from the date of payment, extended to 15 months in the case of deferred debit cards, without prejudice to being kept for the purposes of defence, exercise or defence of rights for as long as the limitation period for said rights has not elapsed.
Creation and management of user accounts on the website	Execution of the agreement signed with customers	Active bases: The data required to manage the relationship with the customer will be kept for as long as necessary for the performance of the agreement. Intermediate files: For the purposes of declaring, exercising or defending rights in judicial or pre-judicial proceedings, they will be kept for as long as the limitation period for said rights has not elapsed and until the precautionary measure has been concluded, and/or for the duration of the proceedings until ordinary and extraordinary remedies have been exhausted.
Improving the services offered by B&B HOTELS, namely: - Satisfaction surveys - Management of comments received about the services provided.	Legitimate interests of B&B HOTELS Guest's prior consent, given in the context of the satisfaction survey itself, for the sharing of reviews with TrustYou.	The time needed to carry out satisfaction surveys or manage customer feedback, but not exceeding a maximum of one year.
Collection of commercial statistics	Legitimate interests of B&B HOTELS	The time necessary to analyse the statistics that are compiled, without however exceeding the maximum period of one year or until the User exercises their right to object, whichever occurs first.
Keeping records and tax obligations	Compliance with legal obligations	Provisional archives: To be kept for the period legally prescribed for each of the obligations (for example, accounting data is kept for a period of 10 years).
Marketing: - Sending a newsletter. - Customer acquisition campaigns (email, telephone and mail). - Invitations to events - Organisation of competitions	- User consent for operations carried out by electronic means (e-mails, text messages, etc.). - B&B HOTELS’ legitimate interests for operations carried out by post or where personal intervention is required (i.e. non-automated operations).	The data will be kept until the data subject revokes their consent or for a period of 3 years from the data subject’s last communication [MG1] with B&B HOTELS.
Administration and management of subscriptions to the B&B HOTELS Club loyalty programme.	The execution of the agreement signed with B&B HOTELS and the other subsidiaries of the B&B HOTELS Group.	Active bases: They will be kept for the duration of the programme. Intermediate files: For the purposes of declaring, exercising or defending rights in judicial or pre-judicial proceedings, they will be kept for as long as the limitation period for said rights has not elapsed and until the precautionary measure has been concluded, and/or for the duration of the proceedings until ordinary and extraordinary remedies have been exhausted.
The management of requests from Users to exercise their rights in relation to their personal data	Compliance with the obligation imposed in Article 12 et seq. of the GDPR	During the time necessary to process the request and prove fulfilment of the legal obligation, as long as the limitation period for the corresponding rights has not elapsed.
The proper functioning and improvement of the Platform and its features, including the measurement of web audience	- B&B HOTELS’ legitimate interest in guaranteeing the proper functioning and security of the website. - The User’s consent to cookies that are not strictly necessary.	The duration of the cookie or similar technology will not exceed 6 months. The data collected by cookies and similar technologies will be kept for a maximum period of 25 months.
Management of the B&me loyalty programme (awarding benefits and loyalty points)	Execution of the agreement signed with B&B HOTELS and the other subsidiaries of the B&B HOTELS Group.	Active bases: For as long as you remain loyal to the B&me programme. Intermediate files: For the purposes of declaring, exercising or defending rights in judicial or pre-judicial proceedings, they will be kept for as long as the limitation period for said rights has not elapsed and until the precautionary measure expires, and/or for the duration of the proceedings, until ordinary and extraordinary appeals have been exhausted.
Management of requests for assistance and contact via the form provided for this purpose on the website	User consent	The data will be retained until the owner revokes their consent or for a period of 3 years from the last communication of the owner with B&B HOTELS
Prevention and detection of fraud in the booking process	Legitimate interest of B&B HOTELS in protecting its booking systems and preventing financial loss	Data will be retained for a maximum period of 6 months from the date of registration
Management of in-person guest check-in at hotel receptions, including guest identity verification, scanning of respective identification documents, and completion of the official accommodation form for foreign guests	Execution of the contract concluded with B&B HOTELS and other subsidiaries of the B&B HOTELS Group. Compliance with legal obligations, pursuant to Article 6(1)(c) of the GDPR, in conjunction with Articles 15 and 16 of Law No. 23/2007 of July 4.	Active databases: Check-in data is retained during the execution of the accommodation contract. Intermediate archives: Accommodation forms are retained for 1 (one) year following the notification of the guest's departure, pursuant to Article 15(5) of Law No. 23/2007. For the purpose of establishing, exercising, or defending rights in legal or pre-litigation proceedings, the data will be retained until the statute of limitations for said rights has expired, and until the conclusion of any interim measures, and/or for the duration of the proceedings until all ordinary and extraordinary appeals have been exhausted. Identification data collected for the purpose of accessing the Wi-Fi Portal is retained for the duration of the guest's stay at the hotel.
Management of the Wi-Fi Portal at B&B HOTELS	User consent	Identification data collected for the purpose of accessing the Wi-Fi Portal is retained for the duration of the guest's stay at the hotel
Video surveillance at the premises	Legitimate interest of B&B HOTELS in protecting its hotel premises, guests, employees, and other individuals present at B&B HOTELS hotel establishments.	Images are automatically deleted after 1 (one) month from the respective date of capture, unless they are required for the purpose of establishing, exercising, or defending rights in legal or pre-litigation proceedings.
Profiling When you have agreed to receive marketing communications from B&B HOTELS, we may personalise their content to offer you promotions, advantages, or information tailored to your preferences. This profiling may be based on data related to your relationship with B&B HOTELS and the B&Me loyalty program, such as your booking history, loyalty level, declared preferences, interactions with our services and communications, and, where applicable and subject to your consent, your browsing habits on our website or application. By way of example, this data may be used to send you offers related to destinations you have already booked or viewed, advantages corresponding to your loyalty level, or communications adapted to your preferences and previous interactions with B&B HOTELS.	User consent	The data will be retained until the owner revokes their consent or for a periodof three (3) years .
Management of the right of admission: documentation of security and public order incidents in the establishment, and defense against potential claims	Legitimate interest of B&B HOTELS in the security of the facilities, staff, and customers, and in the defense against potential claims. In Autonomous Communities whose tourism regulations expressly require the maintenance of an incident registry, the legal basis will additionally be compliance with a legal obligation.	Active bases: 1 year from the date of the incident. Intermediate files: if judicial or administrative proceedings or a claim have been initiated, the data will be retained until a final resolution is reached. Any consequence of the incident in other establishments within the network will never be applied automatically and will require an individualized review by a responsible person.

Whenever personal data is required for the performance of an agreement or pre-contractual steps at your request, as well as for the fulfilment of legal obligations to which B&B HOTELS is subject, the provision of personal data is mandatory, otherwise we will not be able to respond to your request or conclude the agreement with you or provide you with the requested service. When the processing of data is based on your consent (for example, for marketing purposes) the provision of data is optional and failure to provide it will not affect the pre-contractual or contractual relationship we have with you.

7. Data recipients

Within the limits of their respective responsibilities and for the purposes mentioned in paragraph 6 of this Policy, the following persons may have access to your personal data:

Authorised B&B HOTELS staff from the reservations, marketing, sales, administration, logistics and IT departments, including call center service personnel with booking management and fraud prevention functions, responsible for improving our Services, relations with customers and potential customers and quality controls.
Authorised management and reception staff of each establishment, within the framework of managing the right of admission and security and public order incidents, and, solely when the severity of the facts justifies it and by means of an individualized decision reviewed by a responsible person, authorized staff from other establishments within the B&B HOTELS network.
Authorised personnel of B&B HOTELS’ subcontractors and service providers, including, in particular, providers of hosting and cloud storage services, payment services, identity document control software and online identity verification via facial recognition, courier services, IT support services and, lastly, market research.
Authorised personnel of the companies jointly responsible for processing them.
Competent authorities, upon request or in fulfilment of legal obligations, in particular public bodies, courts, as well as mediators, accountants, auditors, lawyers, court officials, police officers and debt collection agencies. They will have access exclusively for the fulfilment of legal obligations, as well as for the investigation of perpetrators of offences committed on the Internet.
Third parties who may place cookies, with your consent, on your devices. For more information, please consult our Cookie Policy.
TrustYou, as a data processor responsible for the aggregation and centralisation of reviews from external platforms (including Google, Booking.com and Expedia) and for the management of direct guest satisfaction surveys sent following each stay, with a view to improving B&B HOTELS' services and contributing to the GRI (Global Rate Indicator) index, subject to the guest's prior consent.

8. Transfer of data outside the European Union

B&B HOTELS belongs to the B&B HOTELS Group, which offers its services in many countries.

In this regard, and for the purposes set out in point 6 of this Policy, personal data may be transferred to entities belonging or not to the Group that are located outside the European Union.

In the absence of an adequacy decision, B&B HOTELS will only transfer data outside the European Economic Area (EEA) if the appropriate guarantees are met, i.e. by entering into agreements with the entities importing data setting up the standard contractual clauses defined by the European Commission.

In particular, personal data related to commercial communications, the B&me Program, and the B&me Club Program are transferred to the Salesforce Marketing Cloud platform, hosted in the United Kingdom. This transfer is carried out pursuant to Commission Implementing Decision (EU) 2021/1772 of 28 June 2021, which recognizes the adequate level of protection of personal data ensured by the United Kingdom of Great Britain and Northern Northern Ireland (EU-UK Adequacy Decision).

You may obtain more information regarding the safeguards applicable to each transfer and review the relevant documents by contacting our data protection point of contact via the email address prt-privacy@hotelbb.com or by postal mail to B&B HOTELS, Rua Vasco de Gama, No. 5, 2685-244 Portela.

9. Security of personal data

B&B HOTELS pays special attention to security when processing personal data. Consequently, it has implemented the necessary protection measures, both technical and organisational, taking into account the degree of sensitivity of the data collected, in order to guarantee its integrity and confidentiality and protect it against malicious interference, loss, alteration or disclosure to unauthorised third parties.

However, data security and confidentiality depend on the good practices of each individual. Data subjects are therefore encouraged to stay informed about best practices in security.

10. Subcontracting companies

When B&B HOTELS works with service providers, it only transfers personal data when it has obtained from them the commitment and guarantees that they fulfil the confidentiality and security requirements required for this purpose as well as other contractual obligations arising from Article 28 of the GDPR.

In fulfilment of its legal obligations, the agreements signed between B&B HOTELS and the subcontracting companies include, in particular, the terms and conditions for data processing in accordance with the applicable legislation.

11. Cookies

The information about the use of cookies can be found in the Cookie Policy.

12. Social networks

Our X, Facebook, Instagram, TikTok and YouTube accounts can be accessed by clicking on the corresponding icon for each of them via our Website or App.

Social networks help to improve the use of the Website and our Application, as well as to promote them when they are shared.

By clicking on the aforementioned icons, B&B HOTELS can access the personal information that the User has indicated as public and accessible from their profiles on X, Facebook, Instagram, TikTok and YouTube. However, B&B HOTELS does not create or use any database independent of X, Facebook, Instagram, TikTok and YouTube, or data relating to your private life.

To limit third-party access to your personal information on Facebook, X, Instagram, TikTok or YouTube, it is advisable to change the settings of your user profiles and/or the nature of your publications to restrict who can access them.

B&B HOTELS periodically organizes sweepstakes and promotional campaigns on its social media pages, namely Facebook and Instagram. Participation in these sweepstakes is always voluntary and involves the collection and processing of participants' personal data (name, public social media profile, and, if applicable, contact details for prize delivery) based on the consent provided at the time of participation.

Participants' data will be shared with the social media platforms (Meta Platforms, Inc.) in accordance with their respective privacy policies, to which reference is made. When applicable, winners' data may be processed for the purpose of complying with fiscal and legal obligations arising from the delivery of the prize.

The specific terms and conditions of each sweepstakes or promotional campaign will be available in the respective publication and will outline the applicable rules, data retention periods, and participants' rights

13. Exercising data protection rights

B&B HOTELS is particularly committed to respecting the rights of Users in the context of data processing, and its intention is to ensure fair and transparent processing of data, considering the specific circumstances and context in which it is processed.

13.1 Right of access

In this regard, the User has the right to obtain confirmation as to whether or not their personal data is being processed. If so, you will have the right to access the data being processed and the following information:

The purposes of the processing.
The categories of personal data concerned.
The recipients or categories of recipients to whom the data is communicated, particularly if they are located in third countries or are international organisations.
If possible, the expected data retention period. If not, the criteria used to determine this period.
The existence of the right to ask the data controller to rectify or erase personal data, to restrict processing or to object to it.
The right to lodge a complaint with the competent authorities.
Information on the origin of the data obtained, when it has not been obtained directly from the data subject.
The existence of automated decisions, including profiling and useful information about the underlying logic, as well as the importance and expected consequences of this processing for the data subjects.

13.2 Right to rectification

Users have the right to ask B&B HOTELS to rectify inaccurate, ambiguous or obsolete personal data concerning them. Furthermore, the data subject has the right to have their personal data completed when they consider it to be incomplete.

13.3 Right to erasure

Users have the right to ask B&B HOTELS to delete their personal data when the requirements of the legislation in force are met.

It should be noted that the right to erasure of data is not an absolute right and can only be invoked if any of the grounds laid down in the applicable regulations are met.

In particular, this right may be exercised when the User objects, on grounds relating to their particular situation, to the processing of their data based on the legitimate interest pursued by the Controller, including profiling based on such legitimate interest, provided that there are no compelling legitimate grounds to continue the processing, as well as when the User objects to the processing of their data for direct marketing purposes.

13.4 Right to restriction of processing

The User has the right to obtain from the Data Controller the restriction of data processing when the conditions laid down in the applicable regulations for this purpose are met.

13.5 Right to object

The User has the right to object at any time, on grounds relating to their particular situation, to the processing of their personal data, when the legal basis for such processing is the legitimate interest pursued by the Data Controller.

If the User exercises their right to object, B&B HOTELS will cease processing their personal data, unless it has compelling legitimate reasons to continue processing it. These reasons must prevail over the interests, rights and freedoms of the User or be justified for the purposes of declaring, exercising or defending a right in legal proceedings.

The User also has the right to object, at any time and without the need to provide any reason, to the processing of their personal data for direct marketing purposes, including profiling related to such marketing. Upon exercising this right, their personal data will immediately cease to be processed for this purpose.

13.6 Right to data portability

The data subject has the right to data portability. However, this is not an absolute right and can only be invoked when the data has been processed by automated means, excluding cases where the data has been processed manually or on paper.

Furthermore, this right is limited to cases where the processing of data is based on the User’s consent or on an agreement.

This right does not apply when the data is derived or inferred, i.e. in relation to personal data created by B&B HOTELS.

13.7 Right to withdraw consent

Where the processing of data by B&B HOTELS is based on the User's consent, the User has the right to withdraw their consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. Upon exercising this right, B&B HOTELS will cease to process the User's personal data for the purpose in question.

13.8 Automated Decisions and Profiling

B&B HOTELS carries out the following automated processing operations that may affect Users:

B&B HOTELS may perform analyses of Users' browsing behavior and preferences to personalize the commercial offers and communications sent. This activity constitutes profiling within the meaning of Article 4(4) of the Regulation, but it does not produce any legal effects or significantly affect Users, as it is exclusively intended to adapt content to identified preferences, without any impact on the conditions of access to the Services.

The User has the right not to be subject to any decision based solely on automated processing that produces legal effects in their sphere or significantly affects them in a similar manner. For further information or to exercise this right, the User may contact our Data Protection Officer through the contact details provided in section 2.2 of this Policy.

13.9 Right to complain

The User has the right to file a complaint with the competent authorities, without prejudice to the exercise of other judicial or administrative actions that he/she deems necessary, at the following address: National Data Protection Commission, https://www.cnpd.pt/

The User can submit a complaint using the following standardised form standardised form

13.10 The right to establish advance directives

The User has the right to define instructions regarding the retention, erasure, and communication of their personal data after their death, particularly concerning data that falls within special categories of data or relates to the intimacy of private life, image, or communications. The User also has the right to designate a trusted person to ensure the execution of these directives, as well as the right to request the Data Controller to comply with what has been determined.

The User may exercise their data protection rights in relation to the data processed by B&B HOTELS, in the manner described above, including determining that such rights shall not be exercised, and the aforementioned directives may be modified or revoked at any time.

13.11 How can you exercise your rights?

All the rights described in the previous paragraphs can be exercised as follows:

Through the e-mail address prt-privacy@hotelbb.com. Through the web form, selecting ‘Personal data’. If you have a digital account on the B&B HOTELS Website https://www.hotel-bb.com/en/pt, you can access ‘My personal and connection settings’ and delete your personal data from the account. To do this via the B&B HOTELS App, you can go to ‘My profile information’ and click on the option ‘Delete Account’.

By post to Rua Vasco de Gama, n.5, 2685-244 Portela.

In order to respond to your request, whenever we have reasonable doubts as to the identity of the person making the request, we may request, by any means, additional information that is necessary to confirm their identity by any means.

[MG1]Ultima interacción con B&B HOTELS en la que el cliente otorga su consentimiento (normalmente con ocasión de una reserva hotelera).