PRIVACY POLICY

I. OBJECTIVES AND COMMITMENT
The purpose of this Privacy Policy is to:

1. Describe how each of the entities that make up the PETALAMEL treats the personal data of natural persons who are related to PETALAMEL (be customers , partners and users of services), including those that access their facilities (headquarters building, delegations abd support centers);
2. Inform the rights enjoyed by holders of personal data in this matter, in accordance with the provisions of Regulation (EU) 2016/679, of the European Parliament and of the Council, of 27 April 2016, on the protection of individuals with regard to it concerns the processing of personal data and the free movement of such data (“General Data Protection Regulation” or “GDPR”).

PETALAMEL is strongly committed to protecting the privacy of the personal data of PETALAMEL customers ("Customers"), and Users of PETALAMEL services ("Users").

Likewise, PETALAMEL is committed to safeguarding, at all times, the rights of the holders of personal data provided for in the applicable legislation.

II. ESSENTIAL CONCEPTS: PERSONAL DATA, DATA HOLDERS, DATA PROCESSING AND RESPONSIBLE FOR TREATMENT

1. PERSONAL DATA - Personal data is any information relating to an identified or identifiable natural person. An identifiable person is a person who can be identified, directly or indirectly, in particular by reference to an identifier, for example a name, an identification number, location data, identifiers electronically or to one or more specific elements of the identity physical, physiological, genetic, mental, economic, cultural or social of that natural person.
2. PERSONAL DATA HOLDERS - Data holders are natural persons to whom personal data respect. The holders of personal data are, in this case, the Customers and Users of PETALAMEL services.
3. TREATMENT OF PERSONAL DATA - The processing of personal data consists of an operation or a set of operations carried out on personal data or on personal data sets, by automated or non-automated means, namely the collection, registration, organization, structuring, conservation, adaptation or alteration, recovery, consultation, use, dissemination by transmission, diffusion or any other form of availability, comparison or interconnection, limitation, erasure or destruction.
4. RESPONSIBLE FOR DATA PROCESSING - The controller is the natural or legal person who determines the purposes and means of processing personal data. The person responsible for the treatment of the personal data of Customers and Users is the PETALAMEL company that provides the service and decides, in particular, which personal data to collect, the purposes and means of processing and the period for the conservation of personal data . The companies that are part of PETALAMEL, for the purposes of this Privacy Policy, are PETALAMEL, UNIPESSOAL LDA.

III. PRINCIPLES TO BE OBSERVED IN THE TREATMENT OF PERSONAL DATA

When handling the personal data of Customers and Users, PETALAMEL permanently observes and respects the following fundamental principles:

1. Lawfulness of Treatment: personal data will only be processed if and to the extent that at least one of the following situations occurs: (i) the data subject has given his consent for the processing of his personal data for one or more specific purposes, (ii) processing is necessary for the performance of a contract to which the data subject is a party, or for pre-contractual steps at his request, (iii) processing is necessary to fulfill a legal obligation to which PETALAMEL is subject to or processing is necessary for the defense of vital interests of the data subject or other natural person, (iv) processing is necessary for the exercise of functions of public interest or the exercise of public authority vested in it or (v) processing is necessary for the purpose of the legitimate interests pursued by PETALAMEL or by third parties;
2. Transparency: information about the processing of personal data will be provided to their respective holders, which will be transmitted in a concise manner, with easy access and understanding, using clear and simple language;
3. Purpose: personal data will be processed for specific, explicit and legitimate purposes and will not be further processed in a way incompatible with those purposes;
4. Minimization: personal data will be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
5. Accuracy: personal data must be accurate and updated whenever necessary, adopting PETALAMEL appropriate measures so that inaccurate data, taking into account the purposes for which they are processed, are erased or rectified without delay;
6. Integrity and Confidentiality: personal data will be treated in a way that guarantees its security, including protection against its unauthorized or unlawful treatment and against its accidental loss, destruction or damage, adopting the appropriate technical or organizational measures to PETALAMEL;
7. Retention Limitation: personal data will be kept in a way that allows the identification of the data holders only for the period necessary for the purposes for which they are processed;
8. Data Protection from conception and by default: PETALAMEL will apply, both when defining the means of processing and during the processing of personal data, the appropriate technical and organizational measures designed to effectively apply the principles of protection personal data.

IV. PERSONAL DATA PROCESSED BY PETALAMEL AND HOW IT IS COLLECTED
PETALAMEL may process the following categories of personal data for Customers and Users:

The personal data of Customers and Users will be collected when they subscribe to, adhere to or use a PETALAMEL service (for example, when they subscribe to a publication or newsletters, when they register by creating a customer account, when they access a website of the PETALAMEL, when participating in contests, hobbies or promotions or when installing an application).

The collection of personal data can be done through a written document, through a PETALAMEL website, by telephone or in person.

PETALAMEL may collect personal data from sources accessible to the public or other sources, namely through third parties (in this case PETALAMEL undertakes to comply with all legal rules that apply to it and to impose compliance with statutory obligations on them, namely the obligation to obtain consent for the transmission of personal data).

V. PURPOSES FOR WHICH PETALAMEL TREATS YOUR DATA
PETALAMEL treats the personal data of its Customers and Users for the following purposes:

1. Provision of services, including subscription to services, content management, billing, contacts, information or requests and recording of calls for proof of commercial transactions and any other communications regarding the contractual relationship;
2. Marketing, including sale or marketing of services, analysis of profiles and preferences for use of services, improvement and development of services and user experience, content offering, content management provided by advertisers;
3. Administrative, accounting and tax management, including billing and accounting and collection;
4. Extrajudicial and judicial collection and payments;
5. Complaints management;
6. Compliance with legal obligations, including tax obligations and responding to requests from judicial authorities or other public authorities, under legal terms;
7. Security control, which may include physical and logical access control and video surveillance.

VI. LEGAL GROUNDS FOR THE PROCESSING OF PERSONAL DATA
PETALAMEL will only process personal data provided that any of the following grounds are verified:

1. Consent: cases in which the Client or User has given their free, specific, informed, explicit and unequivocal consent, either verbally, in writing, in person or by filling and validating a form or selection option. In the event that personal data of minors are processed and it is necessary to obtain consent, PETALAMEL will obtain the consent of the holders of parental responsibilities. 
   For example, PETALAMEL will process your personal data, if you have given your consent, to record the calls you make to our call centers.
2. Execution of a contract or for pre-contractual procedures: cases in which the processing of personal data is necessary for the adhesion or subscription of a PETALAMEL service or for its respective provision or execution, for example for the management of contact billing information or orders;
3. Compliance with a legal obligation: cases in which the processing of personal data is necessary in order for PETALAMEL to fulfill a legal obligation to which it is bound, for example compliance with tax obligations and response to requests from judicial authorities;
4. Legitimate Interest: cases in which the processing of personal data is necessary so that PETALAMEL can exercise its own legitimate interest or that of a third party, for example, improvement and development of services.

VII. RIGHTS OF THE DATA HOLDER

As a holder of personal data, you have the following rights:

1. Right of access and information: you have the right to obtain confirmation as to whether your personal data is processed by PETALAMEL, as well as the right to access that data and to obtain information on the treatment of the same, including on the purposes of the treatment, the recipients or categories of recipients of the data and the respective retention periods. You also have the right to obtain a copy of the personal data being processed.
2. Right of rectification: you have the right to request the rectification of personal data that are not accurate, as well as the right to request that data that are not complete are duly completed.
3. Right to request the deletion of data (“right to be forgotten”): in certain situations, you have the right to request the deletion of personal data.
   The right to erasure may be limited in the cases provided for in the GDPR, among which, in cases where PETALAMEL is not obliged, by legal imposition, to proceed with the processing of your data, or in cases where the processing is necessary to declaration, exercise or defense of a right in a judicial proceeding.
4. Right to request to limit the processing of your personal data: in certain situations you have the right to request that the processing of your personal data be limited. This will happen, for example, in cases in which you dispute the accuracy of your personal data, for a period that allows PETALAMEL to verify its accuracy, or in cases in which it has opposed the processing of your data, until it is verified that PETALAMEL's interests prevail over yours.
   The limitation of treatment may mean the total suspension of treatment or the limitation of treatment to certain categories of data or purposes of treatment.
5. Right to portability of personal data: in cases where (i) the processing is based on your consent or the performance of a contract you have entered into with PETALAMEL and (ii) the processing is carried out by automated means, you have the right to receive personal data concerning you and which you have provided to PETALAMEL, in a structured format, in common use and automatic reading, as well as the right to transmit them to another controller.
   In such cases, you also have the right to request that PETALAMEL transmit this data to another controller, as long as this is technically possible.
6. Right to withdraw your consent: you have the right to withdraw your consent to the processing of your data at any time.
   If you withdraw your consent, your personal data will no longer be processed, unless there is a legal basis that requires such processing.
7. Right to object to the processing of your personal data: in certain situations, particularly when the processing is based on the legitimate interests of PETALAMEL, you have the right to object to such processing, for reasons related to your particular situation.
   When it opposes the processing of your data, PETALAMEL will cease such processing, unless there are overriding and legitimate reasons for such treatment that prevail over your interests, rights and freedoms, or if personal data are necessary for the purposes of declaration, exercise or defense of a right in a judicial proceeding.
   When personal data are processed for the purposes of direct marketing, which includes the definition of profiles related to such marketing, you can object to such processing at any time.
8. Right not to be subject to any automated individual decision: You have the right not to be subject to any automated individual decision, that is, taken exclusively on the basis of automated treatment, including the definition of profiles, that have an effect on your legal sphere or that affect it significantly in a similar way.
   Individual automated decisions may be taken if such decisions (i) are necessary for the conclusion or execution of a contract between the data subject, (ii) are authorized by legislation to which PETALAMEL is subject or (iii) are based on the your explicit consent.
   PETALAMEL does not take individual automated decisions, that is, with similar legal effects or significant impacts. In cases where it adopts automated individual decisions, PETALAMEL applies appropriate measures to safeguard its rights, freedoms and legitimate interests, enjoying, at least, the right to obtain human intervention by PETALAMEL, to express its point of view and to challenge the decision.
9. Right to lodge a complaint: the right to lodge a complaint with PETALAMEL or the National Data Protection Commission, which is the competent supervisory authority in Portugal.

VIII. EXERCISE OF RIGHTS BY THE HOLDER
The exercise of rights by the holders is free, unless the requests made by a data subject are manifestly unfounded or excessive, namely due to their repetitive nature, in which case PETALAMEL may demand the payment of a reasonable fee taking into account the administrative costs of providing information or communication, or taking the requested measures, or refusing to comply with the request.

You can exercise your rights through the following addresses:

• Letter: addressed to PETALAMEL and sent to the address:

  Rua António Nobre, 568
  4605-020 Vila Meã
  Ataíde
  Portugal

• Email: to the general email address This email address is being protected from spambots. You need JavaScript enabled to view it..
  

IX. TERM OF CONSERVATION OF PERSONAL DATA
PETALAMEL will only treat and retain the personal data of the Client or User, for the period of time strictly necessary for the accomplishment of the purposes indicated in this Privacy Policy or until the Client or User validly exercises the right to delete the data (“right to be forgotten ”), the right to withdraw your consent or the right to object to the processing of your personal data.

Personal data will be processed and kept (i) for the duration of the contractual relationship between PETALAMEL and Customers, (ii) for the period of time that results from the consent given by the data subject or (iii) for the period of time necessary for safeguard a legitimate interest of PETALAMEL or third party.

After the expiration of the conservation period, and as long as PETALAMEL is not obliged, by legal or administrative imposition, to proceed with its conservation, PETALAMEL will delete personal data in a safe way or proceed to its anonymization, if possible.

X. RECIPIENTS OF PERSONAL DATA
PETALAMEL does not transmit the personal data of Customers and Users to third parties, except in cases where this is necessary for the provision of the services it has contracted, for the fulfillment of legal obligations to which PETALAMEL is subject, or when it has provided the your consent to that effect.

The transmission of data to third parties is carried out in accordance with the applicable data protection legislation and within the limits of the purposes and legal bases defined in this Privacy Policy.

PETALAMEL may share personal data with the following entities:

1. Service providers providing services to PETALAMEL (for example, IT service providers);
2. Companies that are part of PETALAMEL or PETALAMEL partner entities, in cases where you have given your consent for that purpose;
3. Public authorities, in compliance with legal obligations (such as, for example, the Tax Authority or judicial authorities).

In cases where the transmission of personal data to the aforementioned entities involves an international transfer of personal data (i.e., outside the European Union), PETALAMEL:

1. Ensure that this transfer is made on the basis of a Commission adequacy decision, under which the country or international organization concerned guarantees a level of protection of personal data equivalent to that resulting from European Union legislation; or,
2. If there is no Commission adequacy decision, it will ensure that these data transfers are carried out in strict compliance with legal provisions and that adequate guarantees are implemented to ensure the protection of personal data.

You can consult existing fitness decisions at www.eur-lex.europa.eu.

XI. PETALAMEL AND COOKIES
PETALAMEL is not responsible for external or third party websites, which can be accessed through the various PETALAMEL websites, or for any content published on them by any third parties. For this reason, PETALAMEL advises that Customers and Users, whenever accessing external or third party websites, check the respective terms and conditions of use and privacy policy.

We use cookies to store information, such as your browsing data when you visit our website. This may include a simple popup or a link to the various services we provide, such as email campaigns or promotions. Cookies are important to us for statistical purposes and targeting.

As a user, you can turn off your cookies in your browser options or by making changes to the Antivirus program tools. However, this may change the way you interact with our website or other websites. The website uses the Google Analytics service, whose cookies and privacy policy can be found at: https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage#gajs and https://www.google.com/intl/pt-PT/policies/. The online store may have links to other sites, which, in our understanding, may contain information and / or useful tools for the visitor.

XII. TECHNICAL AND ORGANIZATIONAL MEASURES
PETALAMEL has adopted and implemented a set of necessary and sufficient technical and organizational measures to ensure the protection of personal data against destruction, accidental loss, loss, alteration, dissemination or unauthorized, accidental or illicit access, as well as the necessary, sufficient and adequate measures to guarantee the accuracy, integrity and confidentiality of personal data and an adequate level of technical and organizational security in relation to the risks inherent in the processing and nature of personal data.

XIII. CHANGES TO THE PRIVACY POLICY
PETALAMEL may, at any time, change this Privacy Policy, considering that such changes come into effect from the date of its communication to Customers and Users.