For the Madeira Promotion Bureau (APMadeira), the privacy and security of personal data of online service users, customers, job seekers, associates, and other partners are crucially important aspects.
The Board of Directors of APMadeira has undertaken a commitment to guarantee personal data security, which extends to all the organisation’s employees. APMadeira promotes information security and protection in the processing of personal data kept by the institution and collected either through personal contacts or electronically, namely through its websites, mobile apps, social media, events, trade fairs or sharing by partners or other stakeholders.
In processing personal data, we respect your privacy, we reiterate our commitment to implementing compliance measures, in particular to ensure:
- a lawful processing supported by a legal basis, legitimate interest or the data subject’s consent;
- that the processing is limited to the purpose for which the data was made available;
- that there are mechanisms in place to ensure the accuracy and completeness of the data it makes available;
- the minimisation of the data required, requesting only those suitable for the intended purpose;
- the limitation on data storage, in accordance with the established retention periods;
- the implementation of measures to ensure information integrity and confidentiality.
APMadeira has outlined procedures to ensure the company complies with the principles described above and the requirements of the new General Data Protection Regulation (GDPR), for existing information systems and to carry out the prior impact assessment and implementation of privacy measures for new data processing to be carried out in the future.
To find out more details about how we collect, use, share and protect the personal data we obtain, please read the following sections of this Privacy Policy.
1. The Association for Promotion of the Autonomous Region of Madeira (APMadeira)
The Association for Promotion of the Autonomous Region of Madeira (APMadeira) is a non-profit association, founded in August 2004 by a public and a private entity – the Regional Tourist Board and the Funchal Trade and Industrial Association. Its purpose is to carry out actions to promote Madeira as a destination, always seeking to develop a set of initiatives which encourage the diversification of the offer presented by Madeira as a tourist destination.
The Madeira Promotion Bureau (APMadeira), with registered address at Rua dos Aranhas, 2426 9000-044 Funchal, legal person no. 511236077 is the entity responsible for processing personal data for the purposes set forth in paragraph 2.
APMadeira may be contacted by post at its registered address, by telephone (+351) 291 203 420 or by e-mail at [email protected].
2. Categories of Personal Data processed by APMadeira
In order to carry out its duties, in compliance with its articles of association and with the aim of promoting and publicising the Autonomous Region of Madeira as a tourist destination, APMadeira may process the following categories of personal data regarding its members, partners, visitors and users of its websites, apps and social media:
- Identification data (e.g. name, passport number, citizen card number, photo);
- Demographic data (e.g., gender, date of birth, nationality, and country of residence);
- Contact details (e.g. address, mobile, e-mail, and social media profiles);
- Sensitive data, at the discretion of the user or visitor (e.g. dietary restrictions, personal preferences, family information, health history); e) Financial details (e.g. IBAN);
- Professional data (e.g. employer, position, workplace)
- Electronic identification data (e.g. Session ID, IP address used to identify a device over the Internet);
- Personal data made public by the data subject, (e.g. content created and shared publicly with APMadeira on third-party social media or by uploading to one of our websites, apps and other online and offline services, including: Facebook, Instagram, Issuu, Flickr and similar).
3. Purposes, grounds for processing and time limits for storing personal data
3.1. Members of APMadeira
In the performance of its duties, by virtue of a contractual relationship, legal obligation and/or legitimate interest, APMadeira may process personal data of employees of its members, for the purposes described in the table below.
| Purpose of processing | Data category | Basis of lawfulness | Retention period |
| Management of the admission process and the relationships between members and APMadeira | Identification data; Contact details; Professional data | Pre-contractual proceedings, execution of an agreement and post-contractual proceedings arising from the relationship with the associate. | Throughout the duration of the agreement or until the exercise of the right of rectification and erasure by the data subject. The period may be longer to secure rights or duties related to the agreement or if there is a legal process or legal obligation to comply with. |
| Sending information, publications of interest or requests for visitors to APMadeira members | Identification data; Contact details; Professional data | Contractual relationship. Legitimate interest in pursuing APMadeira’s activities with its members. | Throughout the duration of the agreement or until the exercise of the right of rectification and erasure by the data subject. The period may be longer to secure rights or duties related to the agreement or if there is a legal process or legal obligation to comply with. |
| Establishing partnerships and promoting members’ activities among partners or interest groups. | Identification data; Contact details; Professional data | Contractual relationship. Legitimate interest in pursuing APMadeira’s activities with its members. | Throughout the duration of the agreement or until the exercise of the right of rectification and erasure by the data subject. The period may be longer to secure rights or duties |
| Purpose of processing | Data category | Basis of lawfulness | Retention period |
| related to the agreement or if there is a legal process or legal obligation to comply with. | |||
| Compliance with legal obligations, namely to supervisory, tax, judicial and police authorities, among others. | Identification data; Contact details; Professional data | Legal obligation. For the declaration, exercise or defence of rights in legal proceedings. | Legal deadline applicable at any given moment for each legal and judicial obligation to be fulfilled. Until the expiry of the limitation period or the deadline for exercising rights. |
| User Registration and access to statistical data and online information on Madeira as a tourist destination (PRISMA Platform) | Identification data; Electronic identification data | Unequivocal consent. | Until withdrawal of consent or termination of the contractual relationship. |
3.2. Visitors and users of websites, apps and social media
In order to promote and publicise the Autonomous Region of Madeira as a tourist destination, APMadeira uses various interaction channels, in person and online, through its promotional websites, apps and social media.
APMadeira may process your personal data as a visitor or someone interested in visiting Madeira, in order to personalise and improve your experience with our services, communicate news and promotional material about Madeira and to provide you with exclusive advertisements and content, by e-mail, mobile phone, websites, mobile device Apps or via in-person communication at events, trade fairs or workshops. Thus, APMadeira, by means of unequivocal consent, contractual relationship or legitimate interest, may process your personal data for the purposes described in the table below.
| Purpose of processing | Data category | Basis of lawfulness | Retention period |
| Answering questions and requesting information about Madeira and its members, by e-mail, through the APMadeira websites or apps. | Identification data; Contact details; Electronic identification data | Legitimate interest of APMadeira in promoting and publicising Madeira as a destination. | Permanent conservation, unless the data subject objects to this or when the need for conservation by APMadeira has ceased. |
| Newsletter subscription and sending promotional information via direct marketing (web channels) | Contact details (e-mail) | Unequivocal consent. | Until withdrawal of consent by the holder, including the opt-out option included in the footer of the messages that are sent. |
| Management of publications, answering messages, requests for information and shares on APMadeira’s social media | Identification data; Contact details; Electronic identification data | Legitimate interest of APMadeira in promoting and publicising Madeira as a destination. | Permanent conservation, unless the data subject objects to this or when the need for conservation by APMadeira has ceased. |
The processing of personal data of children under the age of 13 is only carried out with the consent of their parents or legal guardians.
3.3. Partners and influencers
In order to promote and publicise the Autonomous Region of Madeira as a tourist destination, APMadeira develops a network of contacts with national and international partners, communication professionals (e.g. journalists, bloggers) and other influencers and/or celebrities in social media and electronic media.
APMadeira may process your personal data as a partner or influencer, for the purposes described in the table below.
| Purpose of processing | Data category | Basis of lawfulness | Retention period |
| Answering questions and requesting information about Madeira and its members, by e-mail, through the APMadeira websites or apps. | Identification data; Contact details; Electronic identification data | Legitimate interest of APMadeira in promoting and publicising Madeira as a destination. | Permanent conservation, unless the data subject objects to this or when the need for conservation by APMadeira has ceased. |
| Management of publications, answering messages, requests for information and shares on APMadeira’s social media | Identification data; Contact details; Electronic identification data | Legitimate interest of APMadeira in promoting and publicising Madeira as a destination. | Permanent conservation, unless the data subject objects to this or when the need for conservation by APMadeira has ceased. |
| Communication, marketing and promotion of Madeira as a tourist destination to potential interest groups and national or international partners (B2B) | Identification data; Contact details; Professional data | Pre-contractual proceedings, execution of an agreement and postcontractual proceedings arising from the provision of the service. | Throughout the duration of the agreement. The period may be longer to secure rights or duties related to the agreement or if there is a legal process or legal obligation to comply with. |
| Image capture, processing and/or dissemination (audio, photos, videos) in APMadeira promotional content | Identification data; Contact details; Professional data | Pre-contractual proceedings, execution of an agreement and postcontractual proceedings arising from the provision of the service. | Throughout the duration of the agreement. The period may be longer to secure rights or duties related to the agreement or if there is a legal process or legal obligation to comply with. |
| Organisation of events involving partners and influencers to promote Madeira as a tourist destination. | Identification data; Demographic data; Contact details; Professional data | Pre-contractual proceedings, execution of an agreement and postcontractual proceedings arising | Throughout the duration of the agreement. The period may be longer to secure rights or duties related to the agreement or if there is a legal |
| Purpose of processing | Data category | Basis of lawfulness | Retention period |
| from the provision of the service. | process or legal obligation to comply with. |
The processing of personal data of children under the age of 13 is only carried out with the consent of their parents or legal guardians.
3.4. Job Seekers
APMadeira may process your personal data as an applicant for a job or internship, for the purposes described in the table below.
| Purpose of processing | Data category | Basis of lawfulness | Retention period |
| Recruitment process (collection of curricula vitae and spontaneous applications) | Identification data; Demographic data; Contact details | Consent of the data subject for the evaluation of their profile and skills and conservation for future job offers. | Up to 1 year from the date of data collection. |
4. Personal Data Sources
We process your Personal Data through the following sources:
APMadeira websites: All our websites may be used to collect personal data. Our websites are housed in domains and IP addresses managed by APMadeira or institutional partners to which we are linked.
Social Media: We process personal data shared with APMadeira via social media such as Facebook, Instagram and specialist image and video websites such as Issuu, Flickr, Youtube, and other third party websites that offer this type of service.
E-mail and instant messaging systems: Services used to maintain electronic communications between the data subject and APMadeira, including those provided directly by us, or thirdparty services such as WhatsApp, SMS (short message service) and similar.
APMadeira mobile applications: Mobile applications provided directly by APMadeira and its platforms or via third-party services such as Google or Apple.
Service: communications with members, partners, influencers, visitors or interested parties by telephone or face-to-face contact, e.g. trade fairs, events.
Promotional information and online forms: Interactions with any type of promotional advertisements and online forms promoted by APMadeira.
Hard-copy records: Records filled out on paper, distributed during events and other interactions with APMadeira;
Data received from third parties: Including, but not limited to, APMadeira members, partners, influencers, public sources and data received under contractual relationships with other entities.
5. Cookies Policy
To ensure normal operation and customisation, APMadeira’s websites and apps for mobile devices may use cookies.
A Cookies Policy will be displayed on each website, detailing the cookies used on that website, namely:
- Types of cookies;
- Purpose of using cookies;
- The retention period of the collected data;
- How consent can be withdrawn.
For all cookies that require consent, the user’s consent to apply the cookies will be obtained in advance.
The method for withdrawing consent to cookies by the user will be as easy as giving consent.
We use our own and third-party cookies to optimise your visit and improve our services by customising our content and advertising based on your location and analysing your browsing habits. If you continue browsing without changing your browser settings, we consider that you accept their use.
Our websites use cookies, i.e. small files stored on your computer that monitor your activity while using our website, providing essential data to make your browsing on the website easier. When stored on your computer, cookies mean that you do not have to enter all the data each time you use the website. These data allow us to customise the website according to your preferences so you can browse according to your needs.
If you do not want cookies to be stored on your computer, you can oppose cookies from our website via your browser settings. To find out how to configure your browser settings to manage your cookies, please browse the Help section of the browser you are using. You can delete the cookies already stored on your device at any time, but be aware that disabling cookies may restrict certain functions and prevent you from browsing according to your preferences.
Several types of cookies are used, including:
- ‘Necessary’ cookies – Without these cookies, the intended services cannot be provided. They do not identify the user and are used to understand their interaction with the website, such as preferences and browsing flow;
- Performance cookies – These do not identify the user and only serve to anonymously understand their behaviour;
- Functional cookies – These store your preferences regarding the use of the website, so that you do not need to re-configure the website each time you visit it. It may collect data with your consent, such as your encrypted e-mail or ID;
- Advertising Cookies – These target advertising according to the interests of each user and allow identifying the user through their browser or mobile device, limiting the number of times they see the advertisement, helping to measure the effectiveness of advertising, and the success of the website’s organisation;
- Third-party cookies – These measure the effectiveness of third-party advertising and may contain personal data. Your e-mail or ID, which allow the partner to target advertising in a precise way, may be shared anonymously.
6. Transfer of personal data with other entities
In order for APMadeira to be able to fulfil its duties and to provide you with a quality service, it may need to communicate your personal data or give access to them to other entities:
In these cases, APMadeira will only pass on your personal data to the following categories of recipients:
- Entities and authorities to whom the personal data must be communicated by virtue of a legal obligation (e.g. control authorities, foreigners and borders service, and police authorities);
- Entities associated with APMadeira, ACIF – Association of Commerce and Industry of
Funchal and the Regional Directorate for Tourism;
- Partner entities (national and international) and APMadeira members, with the purpose of promoting and publicising the Autonomous Region of Madeira;
- Other entities necessary as part of management and operation, namely: accounting, IT assistance, IT security, data protection officer, legal services, communications and IT and cloud hosting companies;
- In case of reorganisation, restructuring or merger, we may transfer the information collected to the third parties involved;
7. Data Subjects’ Rights
Customers, as data subjects, enjoy the following rights:
7.1. Access right
Whenever you request it, you can obtain information about which of your personal data are processed by APMadeira. You can also access your personal data and obtain the following information:
- The purposes for which your personal data are processed;
- The type of personal data that are processed;
- The entities to whom your personal data may be disclosed, including entities in the European Union or international organisations;
- The period for which your data will be stored, or, where that is not possible, the criteria for setting that period;
- The rights you enjoy in relation to the processing of your personal data;
- If you were not the source of your personal data, information on their origin and the type of data concerned.
7.2. Right of rectification
Whenever you consider that your personal data (provided by you) are incomplete, you may ask for them to be completed, or you may request their rectification if they are found to be incorrect.
(e.g. address, citizen card, passport, contacts, personal preferences).
7.3. Right to erasure
Under certain circumstances, the data subject may request the erasure of their personal data. APMadeira will inform you whether or not it is possible to satisfy this right in view of existing retention obligations imposed by law or legitimate interest.
7.4. Right to restriction of processing
The right to limit the processing of your personal data allows you to request the data controller to restrict the scope of access and processing of your personal data or to suspend processing activities. You may request the limitation of the processing of your personal data in the following cases:
- if you contest the accuracy of your personal data, for a period of time that allows APMadeira to verify their accuracy;
- if APMadeira no longer needs the personal data for processing purposes, but the data are necessary for the establishment, exercise or defence of legal claims.
7.5. Right to portability
You may request APMadeira to deliver, in a structured, commonly accepted and machine readable format, the personal data you have provided. You also have the right to request that APMadeira pass on such data to another controller, provided that this is technically possible.
The right to portability only applies in the following cases:
- where the processing is based on explicit consent or on the performance of an agreement;
- where the processing in question is carried out by automated means.
7.6. Right of opposition
You have the right to object to the processing of your personal data at any time, for reasons relating to your particular situation, and where the processing is carried out for purposes other than, but compatible with, those for which the data were collected.
In such cases, APMadeira will stop processing your personal data unless it has legitimate reasons for doing so and these override your interests.
The exercise of your right to object may result in the suspension or termination, in whole or in part, of the benefits associated with the purpose of processing the data in question.
You can also object to the processing of your data for direct marketing purposes.
7.7. Right to withdraw consent
In cases where data are processed on the basis of your consent, you may withdraw consent at any time.
If you withdraw your consent, your personal data will no longer be processed, unless there are other grounds, such as legal and regulatory obligations or the public interest of APMadeira, which justify such processing.
7.8. Right to lodge complaints with APMadeira or a supervisory authority
Exercising your rights is free of charge, unless the request is manifestly unfounded or excessive, in which case a reasonable fee may be charged considering the associated costs.
Your requests should be answered within a maximum of 30 days, unless the request is particularly complex, in which case the deadline may be longer.
APMadeira has appointed a Data Protection Officer (DPO), pursuant to Articles 37, 38 and 39 of the General Data Protection Regulation. You may contact the APMadeira DPO and exercise your rights through the following channel:
- E-mail: by e-mail, to the address [email protected];
- Post: Rua das Aranhas, n.º 24-26, 9000-044 Funchal – Portugal
Should you wish to lodge a complaint regarding matters relating to the processing of your personal data, you may do so with the Portuguese Data Protection Commission, the competent supervisory authority in Portugal (www.cnpd.pt).
8. Changes to this policy
APMadeira may change this Privacy Policy at any time to reflect current privacy practices. When we make changes to this statement, we revise the ‘update date’ at the bottom of the document. We encourage you to read this Privacy Policy periodically so that you are aware of how APMadeira protects your information.
