PRIVACY AND PERSONAL DATA PROTECTION POLICY
According to our figures, spurred on by our visionand guided by our mission, we aim to act responsibly within the community in which we operate and in our dealings with all our partners. As such, ensuring the protection of privacy and personal data, and processing such data transparently and with integrity, are essential to Inoxantuã – Instalações em Inox, Lda.
The protection of privacy and personal data is a constant concern in the relationships that Inoxantuã – Instalações em Inox, Lda. maintains with all users of its services and, for the purposes of the General Data Protection Regulation, that is, Regulation (EU) No 679/2016 of the European Parliament and of the Council of 27 April 2016, as amended by Amendment No. 00/2016 of 4 May (hereinafter referred to simply as the “GDPR”), we have adopted this Privacy and Personal Data Protection Policy, guided by the following principles:
– The processing of personal data is carried out lawfully, fairly and transparently;
– Such data is collected solely for specific, explicit and legitimate purposes, in accordance with the relevant legislation;
– The data collected is limited to what is strictly necessary and is retained only for as long as is necessary for the purposes for which it is processed;
– Only managing partners, employees, staff and partners whose roles require it have access to the personal data processed;
– Personal data is treated as confidential.
DATA CONTROLLER
The data controller for the purposes of the General Data Protection Regulation (GDPR) and other data protection regulations is Inoxantuã – Instalações em Inox, Lda., with its registered office at Rua de Canelas no. 5, Eco Parque Empresarial, 3860-529, in the parish of Beduído and Veiros, municipality of Estarreja, and email: geral@inoxantua.pt
PROCESSING OF PERSONAL DATA AND CONDITIONS FOR PROCESSING
Under the GDPR, personal data means any information, of any nature and in any medium, relating to an identified or identifiable natural person (“data subject”). A natural person is considered identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, online identifiers or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
The processing of personal data will always be carried out in accordance with the GDPR and in accordance with the specific data protection regulations in force at any given time. Furthermore, data subjects are informed, through this data protection statement, of their rights.
Inoxantuã – Instalações em Inox, Lda. will only process personal data if one of the conditions set out in the GDPR is met, namely:
– Where the data subject has given their consent to the processing of their personal data;
– Where the processing of personal data is necessary for the performance of a contract to which the data subject is a party or for pre-contractual measures taken at the data subject’s request;
– Where processing is necessary for compliance with a legal obligation to which Inoxantuã – Instalações em Inox, Lda. is subject;
– If the processing is necessary to safeguard the legitimate interests of Inoxantuã – Instalações em Inox, Lda.
Whenever the processing of personal data is necessary and there is no legal basis for such processing, we will seek the data subject’s consent.
CONSENT
Where the data subject has given their express consent (in writing, orally or by selecting an option) and where such consent is freely given, informed, specific and unambiguous. Examples include consent for Inoxantuã – Instalações em Inox, Lda. to assess job applications or verify qualifications and specific training certificates.
CONTRACT PERFORMANCE AND PRE-CONTRACTUAL PROCEDURES
Where the processing of personal data is necessary for the conclusion, performance and management of the contract entered into with Inoxantuã – Instalações em Inox, Lda., for example, for the preparation of quotations or estimates, for the management of contacts, information and orders, and for the management of invoicing, collection and payments.
COMPLIANCE AND LEGAL OBLIGATIONS
Where the processing of personal data is necessary to comply with a legal obligation to which Inoxantuã – Instalações em Inox, Lda. is subject, for example, the disclosure of identification data to police, judicial, tax or regulatory authorities.
LEGITIMATE INTEREST
Where the processing of personal data is in the legitimate interests of Inoxantuã – Instalações em Inox, Lda. or of third parties, and where Inoxantuã – Instalações em Inox, Lda.’s reasons for processing such data take precedence over your rights to the protection of personal data.
STORAGE AND RETENTION PERIOD FOR PERSONAL DATA
Personal data will be processed and stored:
– Until the data subject requests the erasure of their personal data;
– For as long as is strictly necessary for the purposes for which they were collected; These time limits are determined on the basis of defined data retention criteria appropriate to each processing operation, whilst complying with the legal and regulatory obligations incumbent upon Inoxantuã – Instalações em Inox, Lda.
– Where required by law, whenever this applies.
Requests to have personal data deleted should be sent to the following email address: geral@inoxantua.pt
RIGHTS OF DATA SUBJECTS
Inoxantuã – Instalações em Inox, Lda. ensures that data subjects can exercise the rights conferred upon them by the GDPR regarding data protection, namely:
– RIGHT of access to personal data – the data subject may obtain confirmation as to whether their personal data are being processed and access information relating to them;
– RIGHT to rectification – the data subject may request that their personal data be rectified or that it be completed;
– RIGHT to erasure – the data subject may request that their personal data be erased in the following situations:
- (a) if the personal data are no longer necessary for the purpose for which they were collected or processed;
- (b) where the consent on which the processing of personal data is based is withdrawn and there is no other legal basis for such processing;
- (c) if the data subject objects to the processing and there are no legitimate interests that override such objection;
- (d) if the personal data have been processed unlawfully;
- (e) if the personal data must be erased due to a legal obligation;
– RIGHT to restriction of processing – the data subject has the right to request that the processing of their personal data be restricted where:
- (a) the data subject disputes the accuracy of the data for a period of time sufficient to verify its accuracy;
- (b) the data subject considers that the processing is unlawful;
- (c) the personal data are no longer necessary for the purposes of processing, but are required for the purposes of establishing, exercising or defending a legal claim in legal proceedings.
– RIGHT to data portability – where the processing of personal data is based on consent or on the performance of a contract and is carried out by automated means, the data subject may request the provision, in a structured, commonly used and machine-readable format, of the personal data they have provided, as well as request that their personal data be transferred to another data controller or to another organisation, provided that this is technically feasible;
– RIGHT to object – the data subject has the right to object to the processing of their personal data at any time where:
- (a) there is no overriding legitimate interest on the part of the data controller;
- (b) the processing is carried out for purposes other than those for which the data were collected.
Inoxantuã – Instalações em Inox, Lda. shall cease processing personal data in the event of an objection, unless there are compelling and legitimate grounds for the processing that override the interests, rights and freedoms of the data subject, or to establish, exercise or defend legal claims;
– THE RIGHT not to be subject to decisions based solely on automated processing – in certain situations, the data subject has the right to request human intervention when decisions are made on the basis of fully automated processing;
– RIGHT to withdraw consent – the data subject has the right to withdraw, at any time, the consent they have given for the processing of their personal data, although this right does not affect the lawfulness of processing carried out on the basis of the consent previously given or the subsequent processing of the same data on another legal basis, such as the performance of a contract or a legal obligation to which Inoxantuã – Instalações em Inox, Lda. is subject to;
– The RIGHT to lodge a complaint with the National Data Protection Authority regarding any matters relating to the processing of your personal data.
If you wish to exercise any of the rights referred to above or to clarify any issues relating to the protection of personal data and privacy by Inoxantuã – Instalações em Inox, Lda., please contact us by post, addressing your letter to the company’s head office, or by email at: geral@inoxantua.pt
SAFETY MEASURES
Inoxantuã – Instalações em Inox, Lda. has in place security, technical and organisational measures designed to ensure the protection of personal data against personal data breaches – that is, security breaches which, whether accidental or unlawful, result in the destruction, loss, alteration, unauthorised disclosure or access to personal data that is transmitted, stored or otherwise processed, and against any other form of accidental or unlawful processing.
This commitment undertaken by Inoxantuã – Instalações em Inox, Lda. means that, whenever personal data is transferred to other organisations, those organisations are also obliged to adopt technical and organisational measures to ensure the same level of protection.
Inoxantuã – Instalações em Inox, Lda. will carry out an impact assessment whenever the processing of personal data is likely to jeopardise the fundamental rights and freedoms of natural persons. Whenever Inoxantuã – Instalações em Inox, Lda. carries out such an assessment, it undertakes to comply with the relevant EU and national guidelines.
DISCLOSURE OF PERSONAL DATA TO THIRD PARTIES
In the course of its business, Inoxantuã – Instalações em Inox, Lda. may need to disclose personal data processed under its responsibility to other entities or grant them access to such data, whilst always ensuring that these entities have technical and organisational measures in place to adequately protect personal data.
Personal data will only be accessed or shared with the following organisations:
– Subcontractors providing services to Inoxantuã – Instalações em Inox, Lda., in areas such as IT support, document management, consultancy, legal support and human resources;
– Customers of Inoxantuã – Instalações em Inox, Lda. or representatives appointed by them;
– Public authorities.
Inoxantuã – Instalações em Inox, Lda. may need to transfer personal data to a third country outside the European Union which is not included on the list of countries that the European Union has already deemed to provide an adequate level of protection for personal data. In such cases, Inoxantuã – Instalações em Inox, Lda. will ensure that data transfers are carried out in strict compliance with the applicable legal provisions.
FURTHER INFORMATION
The data subject may request information or clarification regarding the processing of their personal data by Inoxantuã – Instalações em Inox, Lda. by emailing: geral@inoxantua.pt
CHANGES TO THE PRIVACY POLICY
Inoxantuã – Instalações em Inox, Lda. reserves the right to update its Privacy and Personal Data Protection Policy at any time and will periodically review its Privacy and Personal Data Protection Policy. In such cases, any changes will be announced and publicised through the institutional communication channels currently used by Inoxantuã – Instalações em Inox, Lda.