EGF - Empresa Geral do Fomento, S.A. (hereinafter, EGF), and its 11 companies are committed to ensuring the security of personal data.
Consequently, EGF has prepared this Privacy Notice to inform you of the terms under which it collects and processes personal data, in accordance with Regulation (EU) 2016/769 of the European Parliament and of the Council of 27 April 2016 (hereinafter GDPR), and Law No. 58/2019 of 8 August, which ensures the implementation, in the national legal order, of Regulation (EU) 2016/679 of 27 April.
The processing of personal data described in this Notice concerns personal data of citizens who interact with EGF (all those who, in some way, interact with us).
This document describes the conditions under which EGF processes your personal data, hereinafter referred to as (“Data Subjects”). EGF respects the right to privacy of Data Subjects and declares that it complies with the applicable legal and regulatory provisions regarding privacy and personal data protection, adopting appropriate measures to guarantee the privacy and confidentiality of personal data transmitted by Data Subjects.
In order to clarify the processing of data, as well as its purpose and the rights of data subjects, we advise you to periodically read this Privacy Notice.
Who is the controller of your personal data?
Resiestrela is the entity responsible for data processing, in accordance with the GDPR, and can be contacted via email at geral@resiestrela.pt or by telephone at +351 275 779 330 / 331 (call to the national landline network) or by visiting our premises at Estrada de Peroviseu – Quinta das Areias – Apartado 1064, 6230-022 Alcaria - Fundão.
What personal data do we collect?
The personal data we collect depends on the context of your interactions with EGF, within the scope of its commercial activity and in the fulfillment of its legally assigned duties.
EGF collects and processes personal data that is voluntarily provided by the data subject through various contacts established, both in person and via the website, by telephone, by postal mail or email.
Any information provided by the data subject will only be used for the purpose described and in strict compliance with data protection legislation.
What are the purposes that precede the collection of your personal data and what is the basis for its processing?
EGF ensures that the processing of your personal data is carried out within the scope of the purpose for which it is collected, or for purposes compatible with the initial purpose for which it was collected. In addition, we process your personal data for legally foreseen purposes.
Customer support services
EGF uses the customer's Personal Data for customer support purposes, including answering customer questions. This typically requires the use of certain personal contact information and information about the reason for the customer's inquiry (e.g., information requests, service requests, complaints regarding a product or service, general questions, suggestions, compliments, environmental communication programs, etc.). In these situations, the processing of your data is necessary for the execution of the contract to be entered into between you and EGF, or for carrying out pre-contractual due diligence at your request. If you do not provide your data, we will not be able to provide you with the requested or contracted services. Your data will be kept for this purpose for the duration of the contract(s), plus 10 years after termination. Data from potential customers will be kept for 2 years. Customer personal data may be processed by EGF for the purpose of dispute management. The legal basis is the existence of a legitimate interest on the part of EGF, and the data will be kept for the period necessary for the exercise of the respective rights.
Marketing Communications
EGF, with the client's consent (when necessary), uses the client's Personal Data to provide information about new goods, products, or services (e.g., marketing communications or campaigns and promotions). This may be done via email, advertisements, SMS, telephone calls, and postal mail, to the extent permitted by applicable law. Some of EGF's campaigns and promotions are conducted on third-party websites and/or social networks. This use of the client's Personal Data is voluntary, meaning that the client may object to or withdraw their consent at any time. Their data will be kept for this purpose until the data subject exercises their right to withdraw consent.
Complaints and Contact Management
In your relationship with EGF, you may send us suggestions or complaints regarding the services provided by EGF. In these situations, your data will be collected to analyze and resolve the situation underlying your request/complaint, and will be processed based on EGF's legitimate interests.
Events
In events promoted by EGF, the processing of your personal data becomes necessary to ensure the management of your registration and participation in the aforementioned event. Images may also be collected, based on your consent. In specific situations where it is not possible to collect consent beforehand, processing may be carried out based on EGF's legitimate interest, always safeguarding your right to withdraw consent or object to processing.
Your data will be kept for this purpose until you exercise your right to withdraw consent or object to processing.
Supplier Management
The processing of your data is necessary for the execution of the contract to be entered into between you and EGF, or for carrying out pre-contractual due diligence at your request. If you do not provide your data, we will not be able to fulfill the contractual obligations assumed. Your data will be kept for this purpose for the duration of the contracts plus 10 years after termination. Data of potential clients will be kept for 2 years. The personal data of suppliers may be processed by EGF for the purpose of dispute management. The legal basis is the existence of a legitimate interest on the part of EGF, and the data will be kept for the period necessary for the exercise of the respective rights. The data of EGF's suppliers, in particular employees, may be communicated to EGF's clients for compliance with legal or contractual obligations.
Recruitment
Following an open recruitment vacancy or a spontaneous application, EGF will process your data for the purpose of selecting and recruiting candidates, as necessary for carrying out pre-contractual due diligence. The personal data collected will be kept for a maximum of 2 years in cases where your application has not been considered for any vacancy. Based on your consent, we will keep your data for a period longer than 2 years if you wish your data to be considered for a future vacancy suitable to your profile.
Video Surveillance System
EGF has a video surveillance system on its premises to ensure the safety of people and property, and based on EGF's legitimate interest, we collect your image simply by accessing our premises – however, no sound is collected. This data may be communicated to criminal police agencies or judicial authorities upon request. The collected images are kept for a maximum period of 30 days from the moment of capture (unless otherwise required by applicable law). Recording of telephone calls
As a result of your telephone contact and within the scope of EGF's activity, we may record calls, after providing prior information and based on your consent, for the management of the pre-contractual and contractual relationship, as well as for the improvement of our services and for quality control, based on EGF's legitimate interest. These call recordings will be kept for the period indicated in the CNPD (National Data Protection Commission) resolutions that regulate this processing activity, in particular Resolution No. 1039/2017.
For how long do we keep your personal data?
The personal data collected and processed is kept, fulfilling its purpose, respecting the applicable legal deadlines.
In cases where no legal time limit applies regarding the retention and storage of personal data, such data will only be stored and retained for the appropriate period and to the extent necessary, fulfilling the purposes for which it was collected, unless, at any time, the data subject, within legal limits, exercises their rights of objection or erasure, or withdraws their consent.
Once the maximum retention period has been reached, personal data will be irreversibly anonymized (the anonymized data may be retained) or securely destroyed.
For marketing and contact purposes, your personal data will be retained from the moment your consent is collected, unless you withdraw it within this period.
What are the rights of personal data subjects?
Under applicable law, you may exercise the following rights:
- Right of Access: obtain confirmation as to whether or not your personal data is being processed and, if so, access it. In this case, EGF reserves the right to charge a reasonable fee, taking into account administrative costs;
- Right to Rectification: obtain the rectification of inaccurate personal data concerning you and request that your incomplete personal data be completed;
- Right to Erasure: obtain the erasure of your personal data, except in cases where there are grounds that validate its retention;
- Right to Restriction of Processing: obtain the restriction of the processing of your personal data when it relates to certain categories of data or processing purposes;
-Right to Data Portability: receive the personal data you have provided to us, in a structured, commonly used and machine-readable format, as well as request the transmission of your personal data to another controller;
- Right to Object: to object, at any time, to certain processing of your personal data, such as, for example, in the case of processing personal data for direct marketing purposes;
- Right Not to Be Subject to Automated Individual Decisions, including Profiling: not to be subject to any decision taken solely on the basis of automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
In order to exercise your rights, you must contact us using the contact details mentioned in the chapter below, ‘Controller Contacts’.
Furthermore, you are guaranteed the right to withdraw your consent whenever you have given it, through the means indicated above. Withdrawal of consent does not, however, invalidate the processing carried out up to the date of withdrawal.
The data subject also has the right to lodge a complaint with the CNPD (National Data Protection Commission), or another competent supervisory authority, as well as to resort to any other judicial remedy, if they consider that their personal data is not being processed lawfully by EGF, in accordance with current legislation and this notice.
Data Controller Contacts
EGF is not obliged to appoint a Data Protection Officer (DPO) under current legislation; however, in order to maintain contact with data subjects, you can use the following contact to clarify any questions you deem relevant regarding the processing of your personal data and the exercise of your rights: privacy@egf.pt
What security measures are adopted?
EGF is committed to implementing appropriate technical and organizational measures to protect your personal data against accidental or unlawful destruction, accidental loss, alteration, dissemination or unauthorized access. An adequate level of security is considered to be applied in relation to the risks presented by the processing, given the nature of the data to be protected.
In fact, EGF develops all its activity using systems aimed at ensuring the security of your personal data, through the creation of procedures that prevent unauthorized access, accidental loss and/or destruction of your personal data, committing to respect and compliance with legislation relating to the protection of personal data.
Why do we share your personal data?
EGF may share your personal data with third-party entities, which will have access to it. Such third-party entities include public authorities, partners, service providers, among others. In the course of its activity, EGF may use subcontractors, who will access and process your personal data in accordance with our instructions.
To this end, we ensure that such subcontractors offer sufficient guarantees of implementing appropriate technical and organizational measures, so that the processing meets the requirements of the GDPR and other applicable legislation, as well as ensuring the protection of the rights of personal data subjects.
Thus, EGF may also share your personal data when such sharing is necessary or appropriate in light of applicable legislation, to comply with legal obligations to which it is bound, to respond to requests from public authorities, in cases where the vital interests of the personal data subject or a third party are at stake, for the protection of the rights and property of EGF, or when you have given us your prior consent.
Under what circumstances do we transfer your personal data to third countries?
EGF's activities may involve the transfer of your personal data to third countries – located outside the European Union or outside the European Economic Area – although this occurs occasionally and always in connection with other services used by EGF.
In such situations, all necessary and appropriate measures will be taken to ensure the protection of your personal data.
One such situation occurs within the context of EGF's presence on social networks, where we have limited influence over the data processing carried out by the operators of these networks (for example, member management and general information management). In situations where we have no influence, we try to ensure, as far as possible, that social network operators act in accordance with the privacy and data protection requirements of the GDPR. However, in many cases, we have no influence over this data processing carried out by the operators and we do not have clear knowledge of the data being processed on certain occasions.
Social media operators manage all the IT infrastructure of the service, applying their own privacy and data protection rules, and also maintain their own relationships with users (insofar as they are registered users of the social network). Furthermore, the operators are fully responsible for all matters relating to user profile data to which EGF does not have access.
For more information on the data processing carried out by the social media operators, please consult their respective Privacy Policies:
Facebook: https://www.facebook.com/privacy/policy/
Instagram: https://privacycenter.instagram.com/policy
YouTube: https://policies.google.com/privacy
LinkedIn: https://www.linkedin.com/legal/privacy-policy
How do we use “Cookies”?
For more information about cookies and how EGF uses them on its website, please consult our Cookie Notice.
Changes to the Privacy Notice
All updates to the ‘Privacy Notice’ will be communicated via a notice on the website's homepage: https://www.egf.pt/pt/, so that such changes can be immediately understood. By continuing to use this website following a modification to the ‘Privacy Notice’ that has been communicated through this notice, it will be presumed that the user has read and accepted its terms.