Privacy Policy

At AVELEDA, we know that using your personal data requires your trust. We operate under the highest privacy standards, and we will only use your data for the purposes that were clearly described and according to your data protection rights. The confidentiality and integrity of your data is one of our main concerns. This Privacy Policy describes how AVELEDA uses the personal data of existing and potential customers.

1. General Provisions

1.1 Collection And Processing Of User Data

1.2 Subcontractors

Data collection channels

AVELEDA can collect data directly (i.e. with Users) or indirectly (i.e. with partner entities or third parties). Collection can be made via the channels below:

• Direct collection: in-person, by telephone, by e-mail and via the Website; or

• Indirect collection: via partners or group companies and official entities.

2. General principles applicable to the processing of user data

In terms of the general principles of personal data processing, AVELEDA undertakes to ensure that User Data processed by the company are:

• Subject to a lawful, fair, and transparent processing in relation to the User.

• Collected for defined, explicit and lawful purposes, and not subsequently processed outside the scope of such purposes.

• Adequate, relevant, and limited to the extent of what is required by processing purposes.

• Accurate and updated whenever required, with all proper measures being in place to erase or rectify any inaccurate data, considering the purposes for which they are being processed, without any delay.

• Kept in a way that allows for User identification only by the time needed for the purposes for which data are processed.

• Processed in a way that guarantees data security, including their protection against unauthorised or illegal processing and against their loss, destruction, or unforeseen damage, with the appropriate technical and organisational measures being adopted.

The processing of data made by AVELEDA are permitted and lawful in at least one of the situations below:

• The User has undoubtedly given their consent for the processing of User Data for one or more specific purposes.

• The processing is required for the execution of a contract to which the User is a party or for pre-contractual procedures requested by the User.

The processing is required for complying with a legal obligation to which AVELEDA is subject.

• The processing is required for the defence of the fundamental rights of the User or any other individual.

• The processing is required for purposes of the legal interests pursued by AVELEDA or third parties (except if the interests or fundamental rights or freedoms of the User prevail that require personal data protection).

AVELEDA undertakes to ensure that the processing of User Data is made only under the conditions above and in compliance with the aforementioned principles.

Whenever the processing of User Data is made by AVELEDA based on User consent, the User has the right to withdraw their consent at any moment. Nonetheless, withdrawal of such consent does not compromise the lawfulness of the processing made by AVELEDA based on the consent given by the User before its withdrawal.

The period during which personal data are stored and kept depends on their processing purpose.<br>In fact, there are legal provisions in place that require minimum data retention periods. This way, where no specific legal provision applies, data will be stored and kept for the minimum period required for the fulfilment of the purposes that led to their collection or subsequent processing, and they will be erased after this period.

3. Use and purposes of the processing of user data

In general, AVELEDA uses User Data for the purposes below:

• Management of contacts with User.

• Informing the User, who has requested, about new products and services available on the Website, offers and special campaigns, updated information about AVELEDA’s activity, and, in general, for marketing purposes via any communication means, including digital or social media.

• Allowing access to restricted areas of the Website, as the online shop.

• Ensure that the Website meets User’s needs by developing and posting content that most suits the requests and type of User, improving search experience and Website functionalities, and getting information associated to or statistics concerning the type of User profile (consumption profile analytics).

• Provision of Services and other utilities, such as newsletters, opinion surveys, or other information or products requested or bought by the User.

• Sending of satisfaction surveys.

AVELEDA may combine Usability information and anonymous demographic information for search purposes and can use the result to provide more relevant content on the Website. In certain restricted areas of the Website, AVELEDA may combine Personal Data and Usability Information to provide the User with more personalised content.

User Data collected by AVELEDA are not shared with third parties without User consent, except in the situations described below. However, if the User hires services from AVELEDA that are provided by other entities which are data controllers, User Data can be seen or accessed by such entities to the extent that this is required for the provision of such services and the User is informed about it.

Under the legal terms, AVELEDA may transmit or communicate User Data to other entities, if such transmission or communication is required for the execution of the contract entered into by the User and AVELEDA, for pre-contractual diligences requested by the User, for AVELEDA to comply with any legal obligation, or when pursuing the legitimate interests of AVELEDA or any third parties. Whenever User Data are transmitted to any third parties, all reasonable efforts will be endeavoured to get the recipient to use those Data according to this Privacy Policy.

4. Technical, organisational and security measures implemented

To ensure the security of the User Data collected, and keep absolute confidentiality, AVELEDA processes your information in a confidential way, according to our security and confidentiality policies and internal and confidentiality procedures, which are updated periodically as appropriate and per legal terms and conditions.

According to the nature, scope, context and purpose of the data processing, as well as to the risks to the rights and freedoms of the User, AVELEDA undertakes to apply all appropriate technical and organisational measures to protect User Data and comply with legal obligations both when defining the processing means and when processing data.

AVELEDA further undertakes to ensure that, by default, only data required for each specific processing purpose are processed and that those data are not made available without human intervention to an indefinite number of persons.

Communication between the user device and AVELEDA is made via secure communication channels that use the HTTPS protocol and the SSL security protocol.

Nevertheless, AVELEDA adopts the following general measures:

• Regular audits to identify the competence of the technical and organisational measures in place.

• Raising awareness and training the personnel involved in data processing operations.

• Anonymization and encryption of personal data.

• Mechanisms that can ensure the permanent confidentiality, availability, and resilience of information systems.

• Mechanisms that ensure that information systems are restored, and personal data can be accessed quickly in case of physical or technical incident.

5. Transfer of data to outside the european union

The Website does not transfer your personal data to recipients based in countries outside the European Union.

6. Use of cookies

When you visit our website, a small text file (Cookie) is created and stored in your hard drive. Therefore, by continuing to browse our Website, you are accepting the installation of this text file on your device. This file will allow you to access the Website more easily and quickly, as well as to personalise the Website according to your preferences.

In case you want to delete or automatically block cookies, you can use the “Help” menu to learn more about those settings. However, if you do not allow the use of cookies, you may not be able to use certain Website functionalities.

By browsing our Website, you are allowing the collection and storage of these small text files named cookies, which contain information and are downloaded into your computer or other devices via a server. These text files will allow for a more personalised, efficient browsing experience. When you visit our Website, your Internet browser sends these cookies back to the Website, allowing to recognise and remember User identity, as well as their use preferences.

For more information, please check our cookies policy here.

7. User rights (data subject’s rights)

7.1. Right to be informed

7.1.1. Information given by the User to AVELEDA (when data are collected directly with the User):

• The identity and contact details of AVELEDA and the data controller.

• The contact details of the Data Protection Officer.

• The purposes of data processing, as well as the legal grounds for processing, if applicable.

• Whether the data processing is based on the legitimate interests of AVELEDA or any third party, and the description of such interests.

• If applicable, the recipients or categories of recipients of personal data.

• If applicable, whether personal data will be transferred to a third country or international organisation, whether an adequacy decision adopted by the European Commission is in place or the reference to the appropriate adequate transfer guarantees.

• Retention period for personal data.

• The right to request AVELEDA to access personal data, the right to rectify or erase personal data or limit processing, the right to object to processing and the right to access data.

• If data processing is based on User consent, the right to withdraw consent at any time, without compromising the lawfulness of the processing made before its withdrawal.

• The right to lodge a complaint with the CNPD or any other supervisory authority.

• Whether the communication of personal data is a legal or contractual obligation or requirement, as well as whether the data subject is obliged to provide personal data and the potential consequences of not providing such data.

• If applicable, the existence of automated decisions, including profiling, and information concerning the basic concept, as well as the importance and legal consequences of such processing for the data subject.

When User Data are not collected by AVELEDA directly with the User, in addition to the information above, the User is also informed about the categories of personal data which are subject to processing, as well as the origin of data and whether these can be accessed by the public.

In case AVELEDA wants to later process User Data for a purpose that is not the purpose for which the data were collected, before such processing, AVELEDA will give the User all the information about such purpose and any other relevant information, under the terms above.

7.2. Procedures and measures implemented to comply with the right to be informed.

The information in 7.1 is given in writing (including digital media) by AVELEDA to the User prior to the processing of the personal data in question. Under the applicable law, AVELEDA is not required to provide the User with the information in 7.1 whenever and to the extent that the User already knows such information.

Information given by AVELEDA is free of charge.

8. Right of access to personal data

AVELEDA guarantees the means for the User to consult their Personal Data. The User has the right to get confirmation by AVELEDA of whether their personal data are the object of processing. If this is the case, the User has the right to access their personal data and the following information:

• The purposes of the processing.

• The categories of personal data in question.

• The recipients or categories of recipients to which personal data were or will be disclosed, namely the recipients based in third countries or belonging to international organisations.

• The retention period for personal data.

• The right to request the rectification, erasure, or limitation of processing of personal data from AVELEDA, or the right to prevent such processing.

• The right to lodge a complaint with the CNPD or any other supervisory authority.

• All information available on the origin of such data if the data were not collected directly with the User.

• The existence of automated decisions, including profiling, and information concerning the underlying logic, as well as the importance and legal consequences of such processing for the data subject.

• The right to be informed about the adequate safeguards associated to the transfer of data to third countries or international organisations.

Upon request, AVELEDA will provide the User with a free copy of the User Data that are being processed. Additional copies requested by the User may have administrative costs.

9. Right to rectify personal data

The User has the right to request, at any moment, the rectification of their Personal Data, as well as the right to see their incomplete personal data be completed, including by means of an additional declaration.

In case of data rectification, AVELEDA communicates the respective rectification to every recipient to which data has been transmitted, unless such communication is rendered impossible or involves a disproportionate effort for AVELEDA.

10. Right to erasure of personal data (“right to be forgotten”)

The User has the right to request that their data be erased by AVELEDA, when one of the reasons below is verified:

• User Data are no longer needed for the purpose for which they were collected or processed in the first place.

• The User has withdrawn the consent that justifies data processing and there is no other legal ground for such processing.

• The User opposes to processing and there is no other prevailing legitimate interests that justify such processing.

• User Data are processed unlawfully.

• User Data are deleted to comply with a legal obligation to which AVELEDA is subject.

Under the legal terms, AVELEDA is not obliged to delete User Data if their processing is required for complying with a legal obligation to which AVELEDA is subject or for purposes of establishing, exercising or defending a right in a judicial proceeding.

In case of data erasure, AVELEDA communicates the respective erasure to every recipient/entity to which the data has been transmitted, unless such communication is rendered impossible or involves a disproportionate effort for AVELEDA.

When AVELEDA makes those User Data public and is obliged to delete them under the right to erasure, the company undertakes to take all reasonable measures, including technical measures, considering the available technology and corresponding application costs, to inform the data processors of the personal data that the User has requested the erasure of those data, as well as any copies or reproductions.

11. Request the limitation of processing of personal data

The User has the right to request AVELEDA to limit the processing of User Data in one of the following situations (the limitation involves adding a mark to the personal data that are kept to limit their future processing):

• The User has contested the accuracy of personal data, for a period that allows AVELEDA to check for data accuracy.

• The processing is unlawful and the User objects to data erasure and instead requests that the use of such data be limited.

• AVELEDA no longer needs the User Data for processing purposes, but they are required by the User for purposes of establishing, exercising, or defending a right in a judicial proceeding.

• The User has opposed to processing, but the legitimate grounds of AVELEDA take precedence over the User's.

Except for retention, when User Data are subject to limitation, they can only be processed with the consent of the User or for purposes of establishing, exercising or defending a right in a judicial proceeding, defending the rights of a natural or legal person, or for purposes of public interest pursuant to the law.

The User who has seen the processing of their data limited in the cases above must be informed by AVELEDA before such limitation is annulled.

In case of limitation of processing, AVELEDA communicates the respective limitation to every recipient to which data has been transmitted, unless such communication is rendered impossible or involves a disproportionate effort for AVELEDA.

12. Right to data portability

The User has the right to receive their personal data given to AVELEDA in a structured, commonly used, and machine-readable format and have the right to transmit those data to another controller, where:

• The processing is based on consent or on a contract to which the User is a party; and

• The processing is carried out by automated means.

The right to portability does not include inferred or derived data, i.e. personal data that are generated by AVELEDA as consequence or the result of the analysis of the data subject to the processing.

The User has the right to see their personal data transmitted directly between data controllers, whenever this is technically possible.

13. Right to object

The User has the right to object to the processing of their personal data, at any moment, for reasons concerning their particular situation, based on the exercise of the legitimate interests pursued by AVELEDA, or when the processing is carried out for purposes different than those for which the data were collected in the first place, including profiling, or when data is processed for statistical purposes.

AVELEDA will stop processing User Data, unless there are urgent and legitimate reasons for such processing that take precedence over the interests, rights and freedoms of the User, or for purposes of establishing, exercising or defending a right in a judicial proceeding.

Where User Data are processed for direct marketing purposes, the User has the right to oppose to the processing of their data at any moment, which includes profiling to the extent that it is related to the direct marketing. Where the User opposes to the processing of their data for direct marketing purposes, AVELEDA will stop processing data for such purpose.

Further, the User has the right to not be subject to solely automated decisions, including profiling, which have a legal or similarly significant effect on them, unless such decision:

• Is required for entering into or executing a contract between the User and AVELEDA;

• Is authorised by the legislation that applies to AVELEDA, or

• Is based on the explicit consent of the User.

14. Procedures concerning the exercise of user rights

The right of access, right to rectification, right to erasure, right to limit processing, right to data portability, and right to object can be exercised by the User by contacting the Data Protection Officer of AVELEDA, via the email dpo@aveleda.pt.

AVELEDA will reply in writing (including digital media) to the request of the User within a maximum period of one month from receiving such request, except in cases that are particularly complex, for which this period can extend to two months.

If the requests made by the User are manifestly unjustified or excessive, namely due to their repetitive nature, AVELEDA reserves the right to charge administrative costs or refuse to handle the request.

15. Data breach

In legal terms, communication to the User is not required where:

AVELEDA has applied adequate technical and organisational measures and such measures were applied to personal data affected by the data breach,

especially those measures which make personal data unintelligible to any person who is not authorised to access those data, such as encryption.

AVELEDA has taken all subsequent measures to make sure that the high risk to the rights and freedoms of the user is not materialised; or

Communicating with the User involves a disproportionate effort for AVELEDA. In this case, AVELEDA will make a public announcement or anything like inform the User.

To exercise any of these rights, please complete the annex.

16. Final provisions

16.1. Changes to privacy policy

AVELEDA reserves the right to change this Privacy Policy at any time. In case of change, the date at the end of the page is also updated. A notice will be posted on the Website when there are substantial changes.

17. Applicable law and jurisdiction

The Privacy Policy and the collection, processing or transmission of User Data are governed by the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 and by the applicable Portuguese legislation and regulation, namely Law 58/2019.

Any disputes arising from the validity, interpretation or execution of this Privacy Policy, or that relate to the collection, processing or transmission of User Data, will be settled exclusively by the judicial courts of the district of Penafiel, without prejudice to the applicable mandatory legal standards.