Privacy Policy

Sérgio Reigoto Sousa Unipessoal Lda. respects your privacy and, therefore, the personal data you provide us as a data subject is protected in accordance with applicable data protection legislation, namely the General Data Protection Regulation (Regulation (EU) 2016/679). We work daily to ensure the highest levels of security and to provide updated information on how we process your data, in compliance with current personal data protection legislation.

1. INTRODUCTION

Our website, accessible at http://www.estofadorsr.com was developed and is operated and maintained by Sérgio Reigoto Sousa Unipessoal Lda., acting as a data controller.

Sérgio Reigoto Sousa Unipessoal Lda. is fully committed to protecting your privacy and personal data, while also providing you with the best user experience; we have a legal duty to protect the personal data we collect from users, and this duty is a priority in our activities. We comply with and enforce the terms of the General Data Protection Regulation of April 27, 2016, on the protection of individuals with regard to the processing of their personal data and the free movement of such data, which repeals Directive 95/46/EC (the GDPR).

As Data Controllers, in this document, we share information about how we process your data to manage the use and operation of this website, contractual relationships, applications, responses to information requests, and the management of routine activities, such as compliance with legal obligations and providing quality information to improve our services and meet the needs and interests of Clients/Users.

1. GENERAL PRINCIPLES OF OUR PRIVACY POLICY

Our Privacy Policy is based on the following principles:

Only authorized persons use personal data for authorized purposes.

Your privacy is very important to us in everything we do.

We understand that the security of your data is a priority, which we review periodically according to technological innovation.

III. CONCEPT AND INFORMATION FOR THE DATA SUBJECT

Who is responsible for the processing?
Sérgio Reigoto Sousa Unipessoal Lda., headquartered at Estrada Nacional 377 nº1 cave, 2825-871 Trafaria, NIPC 518068870, is responsible for the processing of personal data and can be contacted via email at geral@estofadorsr.com.

What are Personal Data?
For the purposes of this Policy, we follow the definition adopted by the GDPR: any information relating to an identified or identifiable natural person (‘data subject’); an identifiable person is one who can be identified, directly or indirectly, particularly by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

In the course of our activity, we collect and process your personal data by phone, email, through our website, or in writing, for example, in the context of a contractual or pre-contractual relationship.

The data we collect is only what is strictly necessary for the provision of our services.

We collect and process your personal data with your consent only when it reflects a free, specific, informed, and explicit expression of will.

At any time and at your discretion, you can easily withdraw this consent as provided in this policy.

What personal data do we collect?
The categories of data we collect may include:

* Identification data (e.g., name, date of birth, identification data, and nationality)

* Contact details (e.g., address and phone number)

* Professional data (e.g., position, role, company, and office address)

* Billing data (e.g., tax identification number)

* Image and sound records (e.g., photographic and video images).

The collected personal data is processed by computer and stored in databases in strict compliance with current data protection legislation and information security standards.

We will only process your personal data in accordance with a specific and legitimate purpose, determined at the time of collection, and such data will not be processed in a manner incompatible with those purposes, except for public interest archiving, scientific or historical research, or statistical purposes, in which case, under the GDPR, such incompatibility does not occur.

What principles do we respect in the processing of personal data?
In the processing of personal data, we respect the following principles:

• Principle of legality: personal data processing can only be carried out under the conditions stipulated by law;
• Principle of fairness and transparency: personal data processing must always be conducted fairly and transparently with the data subjects;
• Principle of purpose limitation: personal data must be collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes;
• Principle of data minimization: only personal data that is adequate, relevant, and necessary for processing purposes should be collected and processed;
• Principle of accuracy: data must be accurate and kept up to date. Inaccurate data must be corrected without delay;
• Principle of storage limitation: personal data must be kept in a form that permits identification of data subjects only for the period necessary for the purposes for which the data is processed;
• Principle of integrity and confidentiality: personal data must be processed in a manner that ensures their security, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organizational measures;
• Principle of accountability: the data controller must comply with all the aforementioned principles and be able to demonstrate such compliance.

For what purposes do we process personal data?
We will process your personal data for the following purposes:

• To identify you as our client;
• To provide the services or information you have requested;
• For billing and accounting management purposes;
• To communicate changes to the conditions of contracted services;
• To comply with legal obligations to which we are subject;
• When there is the data subject’s consent, to send promotional materials or special offers on our behalf or on behalf of our partners;
• To optimize navigation and user experience on our website;
• To manage the contractual relationship and its execution;
• To adapt the services we provide to the needs and interests of our clients.

How long do we keep your personal data?
The retention period for personal data will be the time necessary to fulfill the purposes for which the data is processed, plus the legally stipulated period for archiving the documents in which the data is recorded.

What are the rights of data subjects?
We facilitate the exercise of the following rights by data subjects:

• Confirmation that personal data is being processed: the right to obtain information on whether and what data is being processed;
• Right of access to personal data: to consult and obtain a copy of the processed data;
• Right to rectify data: to correct and update processed data;
• Right to restrict processing: in certain conditions, the right to limit the processing of your personal data;
• Right to lodge a complaint: you have the right to lodge a complaint with the competent supervisory authority, the National Data Protection Commission (CNPD), if you believe the processing of personal data violates your rights and/or applicable data protection laws. You can do this via the website http://www.cnpd.pt; http://www.cnpd.pt.
• Right to data erasure (“right to be forgotten”): in certain conditions, to request the deletion of your personal data. To do so, please send an email to geral@estofadorsr.com;
• Right to data portability: to obtain and transfer personal data in a structured, commonly used, and machine-readable format;
• Right to object to processing: to object at any time, for reasons related to your particular situation, to the processing of personal data;
• Right to withdraw consent: just as you provided it, you can withdraw consent without affecting the lawfulness of processing carried out before the withdrawal;

The exercise of these rights, under the terms and conditions provided by law, may vary depending on the grounds for processing the data. To obtain assistance in exercising these rights, simply contact us using the above-indicated contact details.

What measures have been implemented to ensure the security of personal data?
We adopt appropriate technical and organizational measures to ensure a level of security appropriate to the risk, which we review and improve periodically, to ensure the security and protection of your personal data in terms of availability, authenticity, integrity, and confidentiality, as well as measures to prevent loss, misuse, alteration, unauthorized access, and any other form of unlawful processing.

What do we do in the vent of a personal data breach?
If an incident occurs, either accidentally or unlawfully, that results in the destruction, loss, alteration, unauthorized disclosure, or access to personal data:

• We will notify the supervisory authority, CNPD, if the data breach is likely to result in a risk to the rights, freedoms, and guarantees of natural persons;
• We will document any personal data breaches, including the facts, effects, and remedial measures;
• We will communicate to data subjects if the breach is likely to result in a high risk to the rights, freedoms, and guarantees of natural persons.

When do we conduct data protection impact assessments and prior consultations?
If we carry out processing likely to result in high risks to the rights and freedoms of natural persons, particularly those listed by the CNPD, we will conduct a data protection impact assessment of those processing operations before proceeding. If the impact assessment indicates a high risk in the absence of measures taken, the supervisory authority will be consulted before processing.

Are personal data transmitted to third parties?
In the course of our activities, we may need to involve data processors who process your data on our behalf, which implies these entities have access to such data. When this happens, we take appropriate measures, which are contractually stipulated, to ensure that these entities provide sufficient and appropriate guarantees for the implementation of technical and organizational measures and that they act only according to our instructions.

 Do we carry out international data transfers?We may need to transfer personal data to third countries or international organizations outside the European Economic Area. In this case, we will strictly comply with the applicable legal provisions and will not transfer personal data internationally to entities that do not offer guarantees to maintain the level of protection required by the GDPR.

Review of our Privacy Policy
We reserve the right to change the content of this privacy policy without prior notice; however, we will inform you of such changes on our website.

The Head of Regulatory Affairs is responsible for ensuring that any revision

By browsing our website, you are bound by the new terms.