Privacy policy
This Privacy Policy describes the guidelines and principles adopted by JOSÉ COELHO ACHEGA, FILHOS, LDA, a private limited company with its registered office at Rua dos Fanqueiros, n.º 190, r/c, 1100-232 LISBOA, parish of Santa Maria Maior, municipality of Lisbon, with a fully subscribed and paid-up share capital of € 150.000.00 (one hundred and fifty thousand euros), an entity whose documents are entirely in electronic format, with the unique registration and legal person identification number 500 760 594 (hereinafter "Achega"), to ensure the protection of personal data subjects, establishing guidelines on the rights of data subjects and the processing and free movement of personal data.
In the course of its activity, Achega collects and processes the personal data of various data subjects, including:
-Natural persons who purchase our articles, in store, by email or through the website (hereinafter the "Website");
-Natural persons who subscribe to our newsletter;
-Natural persons who ask us to contact them by entering a contact request on the Website or by other means, such as e-mail (jointly referred to as "data subjects" for the purposes of this policy).
At Achega we value the protection of your personal data and are committed to respecting your privacy.
1. legal framework
Your personal data will be processed in such a way as to ensure compliance with the applicable legislation, namely Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 or General Data Protection Regulation ("GDPR"), Law no. 58/2019, of August 8, which guarantees the implementation of the GDPR in the Portuguese legal system, Law no. 41/2004, of August 18, amended by Law no. 16/2022, of August 16, which transposes the Directive on the processing of personal data and the protection of privacy in the national legal system.41/2004, of August 18, amended by Law no. 16/2022, of August 16, which transposes into national law the directive on the processing of personal data and the protection of privacy in the electronic communications sector, as well as other applicable sectoral legislation.
2. Identification of the Person Responsible for Treatment
Achega is considered, for all legal purposes, to be the "Data Controller" of all personal data it collects on its website or by other means, including e-mail.
Throughout this Policy, references to "we" or "our" mean Achega.
If you have any questions about this Privacy Policy or how we handle your data, please see Section 9 below "Contact us!".
3. What Categories of Personal Data do we collect?
Personal data is any information, of any nature and regardless of its medium, relating to an identified or identifiable natural person. According to the GDPR, an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to a name, an identification number, location data, an online identifier or to one or more factors specific to his or her physical, physiological, genetic, mental, economic, cultural or social identity.
We only collect the data we consider essential to browse our website, to provide you with the products you request, to manage your orders, to record and invoice your orders, to ensure that they are delivered to you and, if you show interest, to inform you of our news. For the purposes and grounds for processing your data, please see Section 5 "Why we process your Personal Data, for what Purposes, Legal Basis and for how long we keep it" (below).
Achega may process personal data in the following categories:
- Identification data, such as full name, age or date of birth, tax number, foreign tax number if applicable.
- Contact details, such as full address, email address, telephone and mobile contacts.
- Purchasing and billing data: billing address, payment methods and amounts.
- Connection and location data: IP address, type of device and country through which you access our website.
4. How do we collect your Personal Data?
The personal data that Achega processes is data provided by the data subjects at the time of the first contact and for as long as the data subjects maintain a contractual and/or pre-contractual relationship with Achega.
Achega collects personal data primarily through email, telephone, face-to-face contact and forms on the website.
5. Why do we process your Personal Data, for what Purposes, Legal Basis and for how long do we keep it?
Achega processes its customers' personal data on the following legal grounds:
- Fulfillment of contractual obligations or pre-contractual due diligence;
- Compliance with legal obligations;
- For some treatments we will need your consent;
- Legitimate interests, provided that the need to process personal data is balanced with your fundamental rights and freedoms.
We use the data you provide to give you the best possible experience. In general, we collect and process personal data for the following purposes:
- Customer communications;
- Clarification of doubts or requests for information;
- Communications of offers, products, commercial campaigns, satisfaction surveys and other advertising and marketing communications.
In particular, the personal data of the data subjects is kept for the duration of the relationship contractually established with Achega and up to 10 (ten) years from the end of that relationship, although in some situations the retention period may be longer, in which case this extension will be legally justified and supported. This period has been defined taking into account the applicable laws on personal data and civil and commercial contracting and in view of the eventuality of Achega needing to provide evidence in any litigation or potential litigation between itself and the data subjects.
In the case of the processing of personal data for marketing and commercial communication purposes, this processing will only be carried out with the consent of the data subject, given at the time the personal data is collected. Consent to the processing of personal data for marketing and commercial communication purposes may be withdrawn at any time, although this right to withdraw consent does not compromise the lawfulness of the processing carried out on the basis of the consent previously given or the subsequent processing of the same data based on another legal basis, such as, for example, the performance of a contract to which the data subject is a party, or for pre-contractual steps at the request of the data subject and compliance with legal obligations to which Achega is subject.
If you wish to withdraw your consent, you can contact us at the contact details indicated in this Privacy Policy.
In any case, we make it clear that your personal data will only be kept for the period necessary to fulfill the purposes for which it was collected and/or for the periods required by law.
In the table below you will find a summary of the main purposes and legal grounds for processing your personal data:
|
Purpose |
Data categories |
Legal basis
|
|
New customer registration |
Identification and contact details |
Execution of contract with client |
|
Service management |
Identification data, contact data, location data |
Execution of contract with client |
|
Management of the product supplied |
Identification data, contact data, location data |
Execution of contract with client |
|
Payment processing |
Identification data, purchase and billing data |
Execution of contract with client Legitimate interests of the controller (e.g. for debt recovery) |
|
Management of our relationship with the customer (contacts, notification of changes to our terms and conditions of sale) |
Identification and contact details |
Execution of the contract with the client; Compliance with legal obligations; Legitimate interests of the controller (e.g. to understand how we can offer better services and products to our customers) |
|
Ensure the full operation of our website |
Identification data, contact data and connection and location data |
Legitimate interests of the controller (e.g. to keep online services fully operational and secure) Compliance with legal obligations |
|
Sending newsletters and other marketing communications |
Identification and contact details |
Consent of the data subject |
Automatic decisions ("Profiling")
Achega does not use technologies to make decisions based solely on the automated processing of data subjects' data.
6. Who we share your Personal Data with: Categories of Recipients
Achega may share the personal data of data subjects with entities that provide services to Achega and that, in the context of providing these services, may process personal data on behalf of and on instructions from Achega, namely:
- Companies specializing in website hosting services, backup systems and other IT support and development services;
- Companies specializing in the provision of programming and digital marketing services, in situations where the data subject has given their consent;
- Lawyers, financial auditors and other consultants who provide consultancy services to Achega;
- Transport companies that carry out the transportation of goods purchased through the online platform.
In the transmission of personal data to its service providers, Achega guarantees that the subcontracting entity is bound by a subcontracting agreement that obliges it to process the personal data in compliance with the legislation on the protection of personal data.
Achega may also share the personal data of data subjects with third parties (i) by virtue of a requirement or judicial notice to that effect, provided that it is duly substantiated and legally supported; (ii) in the event of a request by a public authority, provided that it is duly substantiated and legally supported; (iii) following an express request by data subjects in relation to the data they hold, in the exercise of their rights, in particular the right to portability;(iv) by requirement of legal regulations.
Transfers of Personal Data to Other Countries
Achega may use service providers and intermediaries, such as companies that provide us with technological support, which must have access to part of your personal data.
However, these communications are made solely and exclusively for the fulfillment of the purposes for which they are collected and in accordance with our instructions, in strict compliance with the rules on the processing of personal data and information security. In any case, we will share with you all the information relating to that communication.
We may also communicate your personal data to third parties when:
- has expressly consented to this; or
- The communication is made as part of compliance with a legal obligation or court order.
In any case, we will only transfer your personal data outside the European Union or the European Economic Area, i.e. to a third country, ensuring strict compliance with European legislation on data transfers to third countries and we will provide all the necessary information, namely indicating the guarantees for such transfer, for example:
- Adequacy decisionsWhen the European Commission determines that a third country offers an adequate level of data protection, personal data may be sent to that country without implementing any of the other measures mentioned above;
- Standard contractual clausesWe use standard contractual clauses for the transfer of personal data to organizations outside the EEA. These contractual commitments have been adopted by the European Commission and guarantee the adequate protection of personal data transferred to countries outside the EEA, binding the recipients of the personal data to certain data protection standards, including the obligation to apply appropriate technical and security measures.
7. What are your rights?
As an expression of its commitment to guaranteeing the privacy of data subjects, Achega guarantees, in accordance with applicable national and EU legislation, a wide range of rights that can be exercised in the following terms:
- Right of access and to be informed
Data subjects may, at any time, contact Achega and request confirmation that their personal data is being processed and, if so, to be informed of: (i) the categories of personal data in question; (ii) the purposes for which their data is being processed; (iii) its storage period or the criteria used to set it; (iv) their rights and how to exercise them; (v) the origin of the data concerning them; (vi) the existence of automated decisions, including profiling.
Achega can only provide information about data subjects and not personal data about other people. In addition, if access could adversely affect the rights of another person, we may not be able to provide them.
If the data subject so requests, Achega will send them a copy of their personal data being processed, in electronic format. If other copies are requested, Achega reserves the right to demand payment of a fee equivalent to the administrative costs incurred in fulfilling the request.
- Right to erasure
Also known as "the right to be forgotten", it allows the data subject to request the deletion or removal of their personal data when there is no compelling reason for Achega to continue using it. The right to erasure is not absolute as Achega may have the right or obligation to retain the information, such as when it is subject to a legal obligation or has another valid reason for retaining it.
- Right of Rectification
Whenever data subjects find that the personal data being processed is out of date, incomplete or incorrect, they may ask Achega to rectify it as soon as possible.
- Right to Portability
Data subjects also have the right to: (i) receive personal data concerning them from Achega in a commonly used and machine-readable format; (ii) transmit such data to third parties outside Achega, under their sole responsibility; and/or (iii) request Achega to transmit such data to third parties. The right to portability only covers data for which the data subject has given consent to be processed, data relating to a contract to which the data subject is a party or if the processing is carried out by automated means.
Achega reserves the right to refuse portability requests whenever they harm the rights and freedoms of third parties, or conflict with any legal requirement.
- Right to restriction of treatment
In certain situations, the data subject has the right to "block" or suppress the continued use of the data subject's information. When processing is restricted, Achega can still store the data subject's information, but can no longer use it.
The data subject can request the limitation of the processing of their data for an indefinite period, when they wish to suspend the processing but retain their data. This situation may arise when:
(i) the data subject contests the accuracy of the data, with processing being limited for a period of time that allows Achega to verify the accuracy of the data; or
(ii) the data subject is waiting for a response to a request to object to processing.
When processing is restricted, personal data will only be processed again if the data subject gives their consent, except for specific processing provided for by law. Achega guarantees that the data subject who has requested the restriction of their data is informed before the restriction is lifted. Achega reserves the right to limit the processing of data subjects' data when it does not need it, and undertakes to keep the data for the pre-established retention period. Achega guarantees that the data subject who has requested the limitation of their data is informed before it is annulled.
- Right to oppose
Achega ensures the necessary means for the data subject to object to certain processing of personal data for certain purposes, without prejudice to directives or laws in force. In particular, data subjects have the right to object at any time to the processing of their personal data on the basis of consent previously given.
The data subject may object to processing in the following circumstances:
- for reasons relating to your particular situation, at any time, opposing the processing of any personal data relating to you based on legitimate interests. However, Achega may continue to process the data subject's data if it can demonstrate compelling legitimate grounds for processing the personal data that override the interests, rights and freedoms of the data subject, or if it needs the personal data to establish, exercise or defend itself in legal proceedings;
- You can object at any time to the use of your personal data for direct marketing purposes (including the creation of profiles related to such direct marketing) by emailing |...|[PA1].
- Right to Complain
Although Achega adopts the best practices in terms of personal data protection, data subjects have the right to submit a complaint to the National Data Protection Commission(https://www.cnpd.pt) regarding the processing of data carried out by Achega, through any of the channels permitted by the aforementioned Supervisory Authority.
The rights provided for and described in this Policy, as well as other rights legally provided for in the relevant legislation in force, may be freely exercised by contacting Achega at info@achega.com.
8. How do we respect the security of shared information?
We have implemented technical and organizational measures to ensure the confidentiality of your personal data, protecting it from accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access and against other unlawful forms of data processing.
For example, we took the following measures:
- Pseudonymization and encryption of personal data;
- The ability to ensure the permanent confidentiality, integrity, availability and resilience of treatment systems and services;
- The ability to detect a personal data breach, resolve it and report it;
- The ability to restore availability and access to personal data in a timely manner in the event of a physical or technical incident;
- A process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures to ensure the safety of treatment.
Any entity we subcontract will be bound by equivalent security measures, acting at all times under our duly documented instructions.
9. Contact us!
For any questions regarding the processing of your data or to exercise any of the rights mentioned above, please contact us at info@achega.com.
10 Changes to the Privacy Policy
Achega may change or update this Privacy Policy in the light of new legal or regulatory requirements, as well as following improvements in the quality of its services and the development of our commitment to the protection of personal data. Any changes to this Privacy Policy will be duly publicized on Achega's various communication channels.
