INTRODUCTION

With this privacy policy and personal data protection, CRITEC, LDA, a limited liability company, registered at the Commercial Registry Office under the corporate number 507.596.641 with headquarters at Travessa da Gândara - Vale do Senhor, 3750 – 727 Recardães, union of parishes of Recardães and Espinhel, hereinafter referred to as "CRITEC", intends to inform Customers/Users of the policies and procedures to be taken regarding the collection, use, processing, and disclosure of any personal data transmitted directly by its Customers/Users or through third parties, through the use of the website operated by it – www.critec.pt.

CRITEC respects the privacy of its Customers/Users and is committed to protecting the information it collects, as well as complying with the legal standards in force defined by the General Data Protection Regulation (GDPR).

Access to and use of the website implies the users' agreement, acceptance, and binding to this privacy and data protection policy.

1. WHO ARE WE?

CRITEC is a limited liability company focused on the creation of multimedia content, design, and internet pages (websites).

CRITEC is committed to protecting the personal data of its Customers and Users of the products and services it offers, as well as the personal data of the respective data subjects in all situations where personal data processing occurs.

2. NECESSITY OF THIS POLICY

Through this policy, CRITEC aims to inform its Customers and Users of the general rules for processing personal data, which are collected and processed in strict compliance with the provisions of the personal data protection legislation in force at any given time, namely Regulation (EU) 2016/679 of the European Parliament and Council, of April 27, 2016 ("GDPR") as well as other applicable legislation, particularly Law No. 58/2019, of August 8.

CRITEC has taken the measures it deems appropriate to ensure the accuracy, integrity, and confidentiality of personal data, as well as all other rights afforded to the respective data subjects.

CRITEC follows best practices in the field of security and personal data protection and has adopted the technical and organizational measures necessary to comply with the GDPR, ensuring that the processing of personal data is carried out lawfully, fairly, transparently, and limited to the authorized purposes under the GDPR and other applicable legislation.

This Privacy and Data Protection Policy also aims to supplement the provisions regarding personal data protection and processing contained in contracts that Customers/Users have established or will establish with CRITEC, as well as the rules set forth in the terms and conditions that govern the offer of various services and that are duly publicized on our website.

3. PERSONAL DATA SECURITY MEASURES

CRITEC has implemented an internal security policy and compliance with rules regarding the processing of personal data.

These rules bind not only CRITEC but also all those who have access to the data, including its employees, collaborators, and service providers. These rules and security measures are technical and organizational in nature and aim to protect personal data against dissemination, loss, misuse, alteration, unauthorized processing or access, as well as any other form of unlawful processing.

Furthermore, third parties that, in the context of service provision, process personal data of the Customer/User on behalf of CRITEC (the so-called subcontractors) are also bound by and required, in writing, to implement appropriate technical and security measures that, at any given time, meet the requirements laid down in the GDPR and other applicable legislation, with the aim of safeguarding the rights of the data subject.

In the context of CRITEC's internal security policy, all online personal data collection methods are encrypted and securely stored, with physical and logistical security measures also implemented.

However, this action by CRITEC does not exempt the adoption of security measures by Customers/Users, especially regarding the use of personal online defense systems (firewall, antivirus, antispyware, website credibility verification tools, etc.).

4. WHAT IS PERSONAL DATA?

For the purposes of paragraph 1 of Article 4 of the GDPR, “Personal data means information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.”

5. PROCESSING OF PERSONAL DATA

For the purposes of paragraph 2 of Article 4 of the GDPR, “‘Processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.”

6. WHO IS RESPONSIBLE FOR THE PROCESSING?

CRITEC is responsible for processing personal data according to the purposes and means of their processing at all times.

For the purposes outlined in this policy or within the scope of the GDPR, if the personal data subject needs to contact CRITEC, they may do so via the email address dpo@critec.pt or by written communication addressed to the company’s registered office at Travessa da Gândara - Vale do Senhor, 3750 – 727 Recardães.

7. IS THERE A DATA PROTECTION OFFICER?

CRITEC has appointed a Data Protection Officer. The possibility of the existence and appointment of a Data Protection Officer is provided for in Articles 37 and following of the GDPR.

You can contact the Data Protection Officer of CRITEC, who in this case is Paulo Barrocas, through the following email address: dpo@critec.pt.

8. TYPES OF PERSONAL DATA THAT MAY BE PROCESSED

Given the activities carried out by CRITEC, this entity processes the personal data necessary for the provision of services or in its corporate social responsibility activities, processing personal data such as name, address, telephone number, email address, citizen card number, or tax identification number.

The amount of information collected may vary depending on the information provided by the Customer/User.

Except for obligations arising from legal compliance, all data will be processed exclusively by CRITEC to the extent necessary for its business, allowing the Customer/User to access specific service functionalities, suggestions, and proximity information services.

Personal, traffic, geographic location, profile, and/or consumption data may be processed for advertising purposes or to disclose offers of goods or services by CRITEC, provided that the respective personal data subject has authorized/consented to such.

If the Customer/User has previously given consent, this consent can be withdrawn at any time without affecting the lawfulness of processing based on consent before its withdrawal. To withdraw consent, you can use the following email address: dpo@critec.pt.

9. CIRCUMSTANCES OF PROCESSING BY SUBCONTRACTORS

In the course of its activities, CRITEC may need to rely on third parties to provide certain types of services that may involve these entities accessing the personal data of Customers/Users. When this happens, CRITEC ensures, with its subcontractors and/or partners, compliance with GDPR standards and other applicable legislation, as well as compliance with rules similar to our internal security policy.

In the case of communication of personal data to other entities, CRITEC remains responsible for such personal data.

10. DESTINATION OF PERSONAL DATA

Personal data is intended solely for CRITEC and may only be used by third parties for the purpose of complying with legal obligations.

11. COLLECTION OF PERSONAL DATA

CRITEC collects personal data by telephone, email, contractually, or through its website, always ensuring the prior consent of the personal data subjects.

Some personal data are indispensable for the execution of the services to be provided by CRITEC, and their absence or insufficiency may jeopardize the provision of services by CRITEC.

The rules of this policy apply to personal data subjects who are not Customers/Users of CRITEC.

Personal data collected may be processed by automated or non-automated means.

CRITEC ensures compliance with the GDPR and other applicable legislation. Personal data is stored in specific databases created for this purpose. Personal data will never be used for purposes other than those for which they were collected or for which consent was given by the data subject.

12. PURPOSES

In general, the personal data collected are intended for the management of the contractual relationship, the provision of contracted services, the adaptation of services to the needs and interests of the Customer/User, information, and advertising actions.

CRITEC may use the personal data provided by the data subject for other purposes, such as social responsibility actions, complaint and suggestion submissions, to promote campaigns, promotions, advertising, and news about products and/or services, as well as for market research or evaluation surveys, if consent has been obtained from the Customer/User.

13. RETENTION OF PERSONAL DATA

The retention and storage of personal data are necessarily related to the purpose for which the information was collected and processed.

Except where there is a legal obligation to retain personal data, such data will only be stored and retained for the minimum period necessary for the purpose for which they were collected.

14. TRANSFER OF PERSONAL DATA

CRITEC is committed not to transfer personal data, except for their provision to subcontractors/partners, as listed in this privacy policy, in which case it will do so in accordance with the GDPR and other applicable legislation.

The non-transfer of data does not prejudice the exercise of the right to portability by the data subject, if requested.

15. YOUR RIGHTS AND HOW TO EXERCISE THEM

As a personal data subject, CRITEC guarantees you, at any time, the right to access, rectify, update, limit, and delete your personal data (except for data that is indispensable for the provision of services as long as the contractual/commercial relationship lasts).

You are also guaranteed the right to object to the use of personal data for commercial purposes and to withdraw consent, as well as the right to data portability. All rights set forth in the law that the Personal Data Subject may exercise are provided by CRITEC.

Last update date: 19/08/2024.
Made by Fontes Costa - Sociedade de Advogados, SP, RL – https://fontescostaadvogados.pt/