This Privacy Policy explains what personal information we hold about you, how we obtain or receive it, and how we use and may share information about you. It relates to any personal information:
- we collect from you
- you provide to us ; or
- is provided to us from other sources.
This Privacy Policy should be read together with our terms and conditions and our cookie policy
Our Website may contain links to websites owned and/or controlled by third parties, or third party websites may link to our Websites. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control those third party websites, are not responsible for their compliance with data protection laws, and you should carefully consider the privacy practices of these third parties.
Who we are
When you visit our Websites, use our services or products, or interact with us via our Social Media Pages or otherwise provide information to us, Espais Roca Portugal LDA (‘us’, ‘our’ and ‘we’) is a ‘data controller’ and gathers and uses certain personal information about you (known under data protection laws as ‘personal data’). When we do so we are regulated under the EU General Data Protection Regulation, and local applicable laws.
Information we collect about you
We may collect personal information from you via:
- our Website: CantoCooking.com and any other websites that are owned and operated by EspaisRoca Portugal and affiliated companies in common ownership;
- our Social Media Pages: social media pages and accounts under the name of “Canto Cooking”
- our Services: our Canto Cooking services and any other services that are described in this Privacy Policy.
Information we receive directly from you
Whenever you interact with us directly, we receive information from you, for example when you:
- book an experience online or buy our products on our Websites or by telephone.
- purchase a gift card or gift certificate for an experience or a product on our Websites or by telephone.
- attend an experience
- provide feedback to us or complete a survey
- contact us, for example via the contact form on our Websites, social media, phone, email or by letter
- sign up to receive any of our email newsletters and marketing
- submit content to us, for example if you post a selfie and use one of our hashtags on your public social media account
Information received from other sources
Sometimes we also obtain information about you from other sources, for example when you:
- purchase a voucher, cooking lesson or products on our Website – we receive information from our payment provider Stripe and from Siteground and Fareharbor B.V, which host our website and booking engines
- complete one of our surveys – we receive your answers and any personal information you provide within your answers from Tripadvisor, Viator, GetYourGuide and other Quality metrics providers.
Information we collect automatically
When you access and browse any of our Websites or use our services, we collect information about your usage, location and activity on our Websites or services using certain technologies, such as cookies and web beacons. Depending on the cookie settings in your browser and the cookie preferences you set when you first access our Websites, our third-party service providers and/or partners may also place view, edit, or set their own cookies. To find out more about cookies, including how we use them and what choices are available to you, please refer to our Cookies Policy.
Why and how we use your personal information
Generally, the reasons we use your personal information and the legal bases on which we rely in each instance where we collect and use your personal information, are:
- to fulfil and enforce our terms and conditions and any other contract we have with you.
- where you have consented to our use of your personal information, which, for newsletters and marketing you may revoke at any time by clicking the ‘Unsubscribe’ option at the bottom of our emails. Please note that it may take up to 14 days for your request to be fulfilled and you may continue to receive our emails during this period.
- as necessary for our (or others’) legitimate interests – including our interests in providing safe Websites, products and services, fraud detection, personalising your experience using our products and services, knowing how customers use our Website, services and products, keeping our Websites, products and services updated and relevant, to maintain and improve our services, products and our Websites’ infrastructure, and developing our business and informing our marketing strategy – but only if these are not overridden by your interests, rights or freedoms.
We’ve outlined this in more detail in our Cookies Policy, what categories of personal information we collect about you. We will inform you, at the point of collecting information from you, whether you are required to provide the information to us or not. We will notify you of any changes to the information we collect from you or to the purposes for which we collect and process it.
Who we share your personal information with
With other Espais Roca companies
We routinely share infrastructure, resources and technology with any member of our company group, our subsidiaries, or companies in common ownership. This means any personal information we hold about you may be shared with these companies. This helps us provide you with a relevant, and consistent experience. We may also share your personal information if we receive an enquiry from you about an additional service offered by a group company.
With third-parties
We work with vendors, suppliers and other companies who help us support our business, and help us provide and improve our products and services (including our Websites), for example, by providing technical infrastructure, assisting us to send our marketing and newsletters to customers who have consented to receive same, analysing how our Websites and services are used, providing customer service, facilitating payments, conducting surveys or providing fraud detection service. We may also need to share personal information with other parties, such as external contractors and our professional advisers and potential purchasers of some or all of our business or on a restructuring.
Usually, information will be anonymised but this may not always be possible. Sometimes, these third parties may need to have access to your personal information to provide us with services or to provide services on our behalf. We may also be required to share some personal information as required to comply with the law.
How long your personal information will be kept
We will keep your personal information while we are providing any services to you (including any marketing or newsletter services). Thereafter, we will keep your personal information for as long as is necessary:
- to respond to any questions, complaints or claims made by you or on your behalf
- to show that we treated you fairly
- to keep records required by law
We will not retain your personal information for longer than necessary for the purposes set out in this policy and we will delete or anonymise your personal information when it is no longer necessary to retain it.
Different retention periods apply to different types of personal information. If you require further details, please see below ‘How to contact us’.
Transfer of your information outside the EEA
To deliver the Websites and our Services to you, it is sometimes necessary for us to share your personal information outside the European Economic Area (EEA), eg:
- with your and our suppliers or service providers located outside the EEA
- if you are based outside the EEA
These transfers are subject to special rules under European and UK data protection laws. Prior to permitting such transfers, we ensure all personal information transferred will be kept secure. Our standard practice is to use standard data protection model contract clauses that have been approved by the European Commission (as permitted under Article 46(2) of the General Data Protection Regulation) or to only transfer your data to companies that are registered with the Privacy Shield (for transfers to the USA).
Your rights
In summary, you have the right to access your personal information, require that we rectify any errors in the data that we hold, and/or request that we erase your personal information subject to certain limitations.
In some circumstances, you can also require that we restrict the way we process your personal information, object to our processing of your personal information or request a copy of your personal information for the purposes of transmitting elsewhere.
Where we have requested and obtained your consent to process particular information, you may withdraw that consent at any time (which you may do by contacting us – see ‘How to contact us’ below). However if we do not hold all the data we need to administer contracts, or orders you entered into (situations which are set out in the table under the section ‘More about the information we collect and hold’ at the bottom of this Policy), we may not be able to provide you with these benefits any longer.
If you would like to exercise any of those rights, please send your request to us via our contact form.
- let us have enough information to identify you (e.g. your full name and contact details – including your email address); and
- let us know what right you want to exercise and the information to which your request relates (e.g. details of the specific information you require and any relevant dates).
Keeping your personal information secure
We have appropriate security measures in place to prevent personal information from being used, destroyed, lost, altered, disclosed or accessed either accidentally or without authorisation. We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner, where permitted by law and are subject to a duty of confidentiality. Our website uses HTTPS which means that all data transferred from your web browser to our servers is encrypted. Our data servers are located in the European Union. We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.
Changes to this Privacy Policy
This Privacy Policy was last updated on 24th January 2024. We may vary this Privacy Policy from time to time. If we do, we’ll post the changes on the Website. Where the changes are significant, we will inform all our customers or subscribers by email. Where required by law, will we obtain your consent to make these changes.