Under the General Data Protection Regulation (GDPR), the following definitions shall apply:
Personal data: any information relating to an identified or identifiable natural person. An identifiable person is considered to be identifiable, directly or indirectly, in particular by reference to an identifier, for example a name, identification number, location data, identifiers by electronic means or to one or more specific elements of the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Data subjects: are the natural persons to whom the personal data respect.
Processing of personal data: means any operation or set of operations which is performed on personal data or on sets personal data, whether not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
ATRAL undertakes to treat your personal data in accordance with applicable legal principles and rules and to safeguard, at all times, your rights as the data subject.
1. DATA CONTROLLER
The processing of any personal data collected by ATRAL is the responsibility of the company LABORATÓRIOS ATRAL, S.A., collective person no. 500 162 085, registered head office at Rua da Estação, 42 – Vala do Carregado, 2600 726 Castanheira do Ribatejo, (351) 263856800, e-mail: firstname.lastname@example.org, under the terms set forth in the General Data Protection Regulation.
2. RATIONALE FOR DATA PROCESSING
ATRAL will process personal data provided that one of the following grounds is verified:
a) Consent: cases in which the data subject has given his or her free, specific, informed, explicit and unambiguous consent, either verbally, in writing, in person or through the completion and validation of a form or selection option.
In the case that the personal data of minors are processed and consent is required, ATRAL will obtain the consent of the holders of parental responsibilities.
b) Execution of a contract or in order to take steps to entering into a contract.
c) Compliance with a legal obligation.
d) Legitimate Interest: cases where the processing of personal data is necessary for ATRAL to be able to exercise a legitimate interest of its own or of a third party – for example, for the improvement and development of the products or services.
e) Defense of vital interests of the data subject or another natural person.
3. PURPOSE OF DATA PROCESSING
We may use your data to:
a) Execution of contract or in order to take steps to entering into a contract.
b) Administrative, accounting and fiscal management, including billing and accounting.
c) Extrajudicial and judicial collection, payments and receipts.
d) Provision of services, contacts, information or requests and any other communications concerning or not regarding the contractual relationship.
e) Marketing, including selling or promoting products.
f) Complaints management.
g) Compliance with legal obligations to which ATRAL is subject, including tax obligations and response to requests from judicial authorities or other public authorities, under legal terms.
h) Development and maintenance of the ATRAL website.
i) Prevention and detection of fraud.
j) Ensure network and information security.
k) Security control of ATRAL installations, including control of physical and logical access and video surveillance
When you fill out the forms available on the ATRAL website, your personal data (name, e-mail address, telephone number and taxpayer’s number) are collected by ATRAL and processed to answer your questions, requests or to provide you information.
4. PERSONAL DATA COLLECTED AND PROCESSED
The data we collect and process in order to initiate or maintain a labour, commercial or institutional relationship, for the presentation of our products and / or of partners, including the management, development and monitoring of the labour, commercial or other relationship.
In order to execute the relationship wish to be establish and, as applicable, we may request all or only some of the data mentioned below, and we will always comply with the principle of data minimization, that is, we will only collect and process the personal data that is absolutely essential the purpose for which they are intended:
Company / place of work
Landline and / or mobile phone
Tax Identification Number
Identity document number and its validity
Date of birth
Literary and / or professional qualifications
The personal data that we collect are processed and stored in a database, with due respect for the data protection legislation and the information security rules.
5. HOW WE GET YOUR DATA
a) through the collection from the data subject:
– In contacts established with ATRAL, regardless of oral (telephone contact, videoconference or face-to-face), in writing (email, post, fax, etc.), for example: for the exercise of their rights as data subject.
– When filling in and submitting a form available on the ATRAL website.
– When, in any other way, the owner provides us with personal information and expressly consents to its storage and processing.
b) Other sources, namely through public sources or third parties (in this case, ATRAL undertakes to comply with all applicable legal rules and to impose on third parties transmitting the legal obligations imposed on them, namely the obligation to obtaining consent for the transmission of personal data).
6. WITH WHOM WE SHARED YOUR PERSONAL DATA
ATRAL only transmits personal data (i) to companies of the ATRAL business group; (ii) in cases where this is necessary for the provision of the services it has contracted, (iii) the fulfilment of legal obligations to which ATRAL is subject, or (iv) when it has obtained free, specific, informed and unambiguous consent of the data subject, for this purpose.
ATRAL will only send personal data collected within the European Economic Area (EEA) to foreign countries in cases where it is necessary to follow its instructions, to fulfil a legal obligation, or to work with agents and consultants who help us manage our business and services.
If ATRAL transfer personal data outside the EEA, ATRAL will ensure that they are protected in the same way as if they were being used in the EEA. For this purpose, we will use one of the following safeguards:
a) transfer to a non-EEA country whose privacy legislation ensures an adequate level of protection of personal data similar to those in the EEA;
b) Implementation of a contract with the foreign entity that obliges it to protect personal data according to the same standards used in the EEA; or
c) Transfer of personal data to organizations with specific international data transfer agreements with the European Union (eg PrivacyShield, a framework that defines privacy standards for data shared between the United States and European countries).
7. DURING HOW LONG WE STORE YOUR INFORMATION
The personal data will be processed and preserved (i) during the term of the contractual relationship between ATRAL and the data subject, (ii) for the period of time resulting from the consent of the data subject, (iii) for the period of time necessary to safeguard a legitimate interest of ATRAL or third party, or (iv) for the period of time of conservation legally imposed, if applicable.After the expiry of the retention period, without prejudice to its storage in the event of a judicial or administrative procedure or decision, ATRAL will either delete the personal data or anonymize it.
8. WHAT ARE YOUR RIGHTS?
8.1 At any time, the data subject may request from ATRAL:
i) Access to information held about you:
As the data subject, you have the right to obtain confirmation that the data concerning you are processed or not, and, if applicable, to access your personal data and information provided by law.
ii) Rectification of information if it is inaccurate or incomplete:
As the data subject, you have the right to have ATRAL, without undue delay, rectify inaccurate or incomplete data concerning you.
iii. The erasure of your personal data:
As the data subject, you have the right to request the erasure of your data, and ATRAL has the obligation to erase the personal data without undue delay.
iv.The restriction of the treatment of your personal data:
As the data subject, you have the right to obtain from ATRAL to restrict the processing of your data if one of the following applies in particular:
a) To contest the accuracy of the personal data, during a period that allows ATRAL to verify its accuracy;
b) the processing of data is unlawful and the data subject opposes the erasure of personal data and, on the other hand, requests the restriction of its use;
c). ATRAL no longer needs the personal data for processing purposes, but such data are required by the data subject for the purposes of declaration, exercise or defense of a right in a legal claim;
d). If you have objected the processing, pending the verification whether the legitimate grounds of the controller prevail over those of the data subject.
v. Object the processing of your personal data, on grounds relating to your particular situation:
In cases where the processing of data is made (I) for the purpose of the legitimate interests pursued by ATRAL; or (ii) data processing is performed for marketing direct or (III) profiling.
vi. Portability of your personal data:
Means that, you have the right to receive the personal data concerning you and that you have provided in a structured , commonly use and machine –readable format, as well as the right to transmit those data to another controller, under certain conditions.
vii. Not to be subject to decisions solely based on automated processes that produce legal effects or other significant effects.
8.2 If treatment depends on your consent, you have the right to withdraw it at all times.
If consent is legally required for the processing of personal data, the data subject has the right to withdraw consent at any time, although that right does not affect the lawfulness of the processing based on prior consent given or the subsequent processing of the same data, based on another legal ground, such as compliance with contractual or legal obligation to which ATRAL is subject.
8.3 If you consider that your personal data are not properly processed or your rights are not respected, you may lodge a complaint with the supervisory authority, ie the Comissão Nacional de Proteçao de Dados | Av. D. Carlos I, 134 – 1º 1200-651 Lisboa | Tel .: +351 213928400 | Fax: +351 213976832 | email: email@example.com.
9. IF YOU WISH TO EXERCISE ANY OF YOUR RIGHTS
If you wish to exercise any of your rights, please contact us:
Phone number: + (351) 263 856 800
Address: LABORATÓRIOS ATRAL, S.A.
to the care of the DATA PROTECTION OFFICER
Rua da Estação, 42 – Vala do Carregado, 2600 726 Castanheira do Ribatejo (Portugal)
Your requests will be treated with special care so that we can ensure the effectiveness of your rights. You may be asked to prove your identity in order to ensure that the sharing and / or modification of personal data is only done with its owner.
10. SECURITY AND CONFIDENTIALITY
We strive to keep your data safe, and we use the necessary technical and organizational measures, sufficient and adequate to ensure the protection of personal data against its destruction, accidental loss, loss, alteration, unauthorized access or unauthorized access , accidental or unlawful, and the necessary, sufficient and adequate measures to ensure the accuracy, completeness and confidentiality of personal data and an appropriate level of technical and organizational security in relation to the risks inherent in the processing and the nature of the personal data appropriate to ensure that the protection of your personal data and prevent access to unauthorized persons.
Although the transmission data over the internet or website can not guarantee complete intrusion safety, ATRAL makes every effort to implement and maintain physical, electronic and procedural safeguards designed to protect your personal data in accordance with the data protection requirements applicable.
ATRAL has imposed the same level of protection of Personal Data on all subcontractors (service providers, suppliers, partners, etc.).