PRIVACY AND PERSONAL DATA PROTECTION POLICY
I. SCOPE
This privacy policy aims to inform you how Sociedade de Transportes Colectivos do Porto, EIM, SA (hereinafter referred to as STCP, EIM, SA) processes your personal data.
Your privacy and the protection of your personal data are a priority for STCP, EIM, SA, and therefore we recommend that you read this document. Providing your personal data implies knowledge and acceptance of the terms and conditions of this Privacy and Data Protection Policy.
STCP, EIM, SA reserves the right to modify this Privacy Policy in accordance with new legal and/or regulatory requirements, for security reasons, or to adapt the Policy to the instructions of data protection supervisory authorities.
Whenever any changes are made to the Privacy Policy, the user will be informed of the changes through the Electric Car Museum website or, if justified, through a communication, and will be asked to renew their consent regarding the text of the Privacy Policy, where applicable.
II. COMMITMENT
STCP, EIM, SA ensures proper management of personal data in accordance with applicable legislation.
Personal data is processed lawfully, fairly and transparently, being collected for specific, explicit and legitimate purposes, with STCP, EIM, SA guaranteeing that this personal data is adequate, relevant and not excessive in relation to the purposes for which it is collected.
The data collected is processed electronically and stored in specific databases, created and managed for this purpose.
The person responsible for processing personal data, as well as those who, in the course of their duties, become aware of the personal data being processed, are subject to professional secrecy and a duty of confidentiality, even after the termination of their duties.
III. RESPONSIBLE FOR TREATMENT
STCP, EIM, SA is responsible for the processing of your personal data, insofar as it determines the purposes and means of processing.
It is the responsibility of the data controller to implement the appropriate technical and organizational measures to ensure that the processing of personal data is carried out in compliance with the rules resulting from the General Data Protection Regulation and its implementing law.
IV. DATA PROTECTION OFFICER
STCP, EIM, SA has appointed a Data Protection Officer who can be contacted via email. epd@stcp.pt or by letter sent to Avenida Fernão de Magalhães, 1862, 13th Floor, 4350-158 Porto.
V. PERSONAL DATA COLLECTED
STCP, EIM, SA collects and processes personal data to carry out its duties, specifically for identification, contact, and invoicing purposes, as well as for any other data that may prove strictly necessary for the fulfillment of its legal and contractual obligations.
VI. CATEGORIES OF PERSONAL DATA PROCESSED
The data collected may include the following:
a) Identification data, such as full name, email and telephone number;
b) Full address, billing address and Tax Identification Number (NIF/NIPC);
c) Account details, such as username/email and password.
VII. FOUNDATION AND PURPOSE OF THE TREATMENT
STCP, EIM, SA collects and processes personal data for the purpose of fulfilling its obligations.
VIII. DATA SHARING AND DISSEMINATION TO THIRD PARTIES
In the course of its business, STCP, EIM, SA may use subcontractors to process personal data on its behalf, which will imply access to this data by those entities. Should this occur, STCP, EIM, SA will take appropriate measures, as contractually stipulated, to ensure that third parties provide sufficient and adequate guarantees of implementing technical and organizational measures and that they will act only in accordance with the instructions of STCP, EIM, SA.
IX. DEADLINE CONSERVADATA TRANSACTION
Personal data will be kept for the periods established by law or for the period that proves strictly necessary for the pursuit of the purposes that motivated its collection and processing, after which it will be deleted or anonymized.
X. RIGHTS OF DATA SUBJECTS WITH REGARD TO THEIR DATA
In accordance with the provisions of the General Data Protection Regulation, the rights of the data subject include, in particular:
a) Right of access: the right to obtain from the data controller confirmation of whether or not personal data concerning him or her are being processed, and, if so, the right to access the personal data and how they are being processed;
b) Right to rectification: the right to obtain from the data controller, without undue delay, the rectification of inaccurate and/or incomplete personal data concerning him or her;
(c) Right to erasure ("right to be forgotten"): the right to obtain from the data controller the erasure of your personal data without undue delay, when:
The data is no longer necessary for the purpose that motivated its collection or processing;
– The data subject has withdrawn their consent, unless there is another legal basis for the processing;
– The data subject objects to the processing, except where there are overriding legitimate interests that justify it;
– Personal data has been processed unlawfully;
– Due to a legal obligation arising from Union law or the law of a Member State to which the data controller is subject.
(d) Right to restriction of treatment: the right to obtain from the data controller the restriction of treatment if one of the following situations occurs:
– To contest the accuracy of personal data for a period that allows the data controller to verify its accuracy;
– The processing is unlawful and the data subject opposes the erasure of personal data and requests, instead, the restriction of its use;
– The data controller no longer needs the personal data for processing purposes, but the data subject requires them for the establishment, exercise or defense of legal claims;
– If you have objected to the processing of your data, until it is verified that the legitimate grounds of the data controller override those of the data subject.
(e) Right to data portability: the right to receive the personal data concerning you that you have provided to the data controller, in a structured, commonly used and machine-readable format, and the right to transmit those data to another data controller without hindrance from the controller to whom the personal data have been provided, when:
– The processing is based on consent or the performance of a contract; and
– The treatment is carried out by automated means.
f) Right to object: the right to object, at any time, to the processing of personal data concerning you, including profiling, except where compelling legitimate grounds for such processing override the interests, rights and freedoms of the data subject.
(g) Automated individual decisions, including profiling: the right not to be subject to any decision taken solely on the basis of automated processing, including profiling, unless the decision:
– Necessary for the conclusion or performance of a contract between the data subject and a data controller;
– Based on the data subject's consent;
– Authorised by Union or Member State law to which the controller is subject, and which also provides for appropriate measures to safeguard the rights and freedoms and legitimate interests of the data subject.
h) Revocation of consent: the right to withdraw your consent at any time. Withdrawal of consent does not compromise the lawfulness of processing carried out based on consent previously given or on another legal basis.
XI. DATA SECURITY
STCP, EIM, SA uses a set of technologies, tools and security procedures to protect your personal data from unauthorized access, use or disclosure.
POLICY UPDATE PRIVACY POLICY
This privacy policy will be subject to ongoing updates, with the update date being changed accordingly.