At VMPS
– Águas & Turismo S.A., a company of the SUPER BOCK GROUP (“SUPER
BOCK”), which markets the brand “Água das Pedras”, we recognise the importance
of the processing of your personal data, so we adopted technical and
organisational measures to ensure a high level of security in the processing of
such data. Therefore, we hereby inform you of our Privacy Policy, which
includes information concerning your rights and how we collect and use your
personal data.
We assume the responsibility of processing your personal data in a
complete and confidential manner, taking such data into consideration only for
clear and precise purposes.
1. Who is responsible for the
processing of personal data?
VMPS – ÁGUAS E TURISMO,
S.A. (“VMPS”), headquartered
at Pedras Salgadas, 5450-136, Bornes de Aguiar – Vila Pouca de Aguiar –
Portugal, is the entity responsible for the processing of personal data (“Data Controller”),
since it defines the data collected, the means of processing and the purposes
for which such data are used.
Personal data means any information relating to an identified or
identifiable natural person (‘data subject’).
2. Who are data subjects?
The customer, or potential customer, a natural person, to whom the data
relate and who uses, or intends to use, the products, services or campaigns
made available by VMPS.
The representative or point of contact in the company, in the case of
legal persons, within the scope of performance of a contract entered between
such company and VMPS or
precontractual measures.
2.1. What categories of personal data are processed by VMPS?
i) Contact
Information: name, email, telephone number, country, address.
ii) Identification data: date of birth,
age, identification number, image, voice.
iii) Data from applications, web pages
and social networks: profiles, location and behaviour.
In the case of representatives of legal
persons, we only collect the data necessary for proper contractual performance,
such as name, email, and telephone
2.2. How, when and for what purposes are your personal data collected?
Your
personal data may be collected in the following circumstances and for the
following purposes:
1. Through VMPS brand websites when you (i) make a contact request
or (ii) subscribe a newsletter.
2. For marketing campaigns, when you receive information and products,
participate in competitions or events organised by VMPS (where your
location, profile and behaviour may be collected) and make available your
personal data to us by express consent.
3. When you enter into a contract with us within the scope of our
commercial activity, through the conclusion of distribution contracts,
exclusivity contracts, among others
3. What are the legal grounds and duration of processing of personal data?
The grounds justifying the processing of your personal data by VMPS for the purposes described in section 2.2 of this policy are as follows:
Consent: your personal data may be processed by a
clear affirmative act establishing your freely given, specific, informed and
explicit indication that your personal data will be subject to processing. For
example, by consent we process the personal data of our customers and potential
customers for commercial and marketing purposes, including marketing campaigns,
events, promotions and information about new products
Precontractual
measures and/or contractual performance: your personal data
may be necessary for clarification of doubts and for the conclusion,
performance and management of a contract entered with VMPS. For example, we process personal data for the
purposes of conclusion, performance and management of the contract entered
between the customer and VMPS, in particular for
the preparation of proposals and contracts.
Compliance with legal obligation: your data may be necessary to
fulfil a legal obligation to which the controller, in this case VMPS, is
subject. For example, we are required to provide information to the Tax
Administration to comply with tax obligations
Legitimate interest: your data
may be required to perform certain tasks related to the business activity of VMPS, except in cases where your privacy and data
protection rights prevail. Examples: we process personal data based on
legitimate interest, including for business monitoring and management; in the
context of customer and consumer contact via website and social networks; when
we need to contact the representative of a legal person in relation to the
performance of a contract; when we need to contact the representative of a
legal person in relation to the performance of a contract; when we conduct
satisfaction surveys after we provide services, to evaluate the quality of
services provided.
Accordingly, VMPS will process your personal data according to
the following:
3.1. How long do we store your personal information?
VMPSstores
the personal data of data subjects only for the period strictly necessary for
the purpose for which they were collected.
In certain
cases, the law requires the storage of data for a specific period, particularly
in the case of data necessary for informing the tax authority, which will be
stored for 10 years, in accordance with current legislation.
We will
also store your data for as long as you maintain a contractual relationship
with VMPS. However, we may retain your personal data for periods longer
than the duration of the contract, based on your consent, to ensure rights and
obligations relating to the contract or in cases where there is a legitimate
interest of VMPS, always respecting the period necessary for the pursuit
of the purpose for which they were collected.
In the absence of a specific legal obligation,
your data will be processed only for the period necessary to fulfil the
purposes that led to their collection, and as long as legitimate grounds exist
that permit storage thereof by VMPS.
As a rule, when processed for the purpose of
marketing campaigns, your personal data will be stored for a maximum period of
5 years from the time of collection of your consent or the last contact made
(whichever occurs later) and if you have not withdrawn your consent within that
period.
Once the maximum storage period has elapsed,
personal data will be irrevocably anonymised (anonymised data may be stored) or
destroyed in a secure manner.
4. To whom do we transmit your personal data?
VMPStransmits your personal data only when
necessary for the purposes described above. VMPS may disclose and share your
personal data with other SUPER BOCK GROUP companies exclusively for
administrative and internal purposes
Suppliers
and/or service providers of VMPS are contractually bound by the same terms and
conditions for the processing of personal data as this privacy policy
establishes, and they are prohibited from the use, transfer, disclosure or
recording of the personal data of data subjects for any purpose other than that
for which they were specifically contracted.
VMPSmay transmit your personal data, depending on
the purpose for which it was collected, to different recipients, such as
communications agencies, event promoters, carriers and other business partners,
and only data necessary to the activity conducted by these entities within the
scope of the purposes identified in this privacy policy will be transmitted.
Identification
through social networks: in order to be able to be identified on websites and
applications of VMPS brands without filling out registration forms, VMPS has implemented the Facebook login system. If you log on through one of these
systems, you explicitly authorise VMPS to access and store public data
from your Facebook account, as well as other data mentioned while using the
Facebook login system. To this end, we remind you that you must know the
privacy policies of the social networks where you interact with us and how they
process your data.
Your personal data may also be transmitted to entities, such as the tax
authority, to which the data must be communicated under the law.
5. What are the data subjects’ rights?
VMPSguarantees the applicability and fulfilment of
all the rights of data subjects provided for in the General Data Protection
Regulation and national legislation in force.
· Right
of Access
You have the right to obtain confirmation from VMPS that personal data concerning you are processed or not processed, and,
where appropriate, the right to access your personal data and information
relating to the processing of such data, and, for example, may request an exact
copy of your compilation and request additional information about the
processing we perform.
· Right
to Rectification
You also have the right to obtain, without undue
delay on the part of VMPS, rectification of inaccurate personal data
relating to you, including the right to correct or supplement your personal
data.
· Right to
erasure of data (“right to be forgotten”)
You may exercise the right to erasure of your
personal data by VMPS without undue delay, provided that: the data are
no longer necessary for the purpose for which they were processed; when you
withdraw your consent and there are no other valid grounds for storage thereof;
when you object to processing and there are no prevailing legitimate interests
on the part of VMPS, as well as in other legally established cases.
· Right
to Data Portability
You have the right to receive personal data
relating to you and provided to VMPS in a structured, current and
machine-readable format, as well as the right to transmit this data to another
controller (if this is technically possible), without hindrance from VMPS,
where the processing is based on consent or on a contract and processing is
carried out by automated means.
· Right
to withdraw consent
You may at any time change your consent,
restrict it to certain types of processing or withdraw it. However, withdrawal
of consent does not affect the lawfulness of processing on the basis of consent
given previously.
· Right
to Object
You may also object at any time to the
processing of personal data relating to you where there are no overriding and
legitimate reasons for processing which prevail over your interests, rights and
freedoms, or for purposes of declaration, exercise or defence of a right in
judicial proceedings.
· Right
to Restriction of Processing
In certain situations you have the right to
obtain from VMPS the restriction of the processing of your data, particularly
if you dispute the accuracy of personal data during a period that allows VMPS to verify its accuracy, in cases where the data are no longer necessary for
processing purposes but which are required by the data subject in order to
declare, exercise or defend a right during the course of judicial proceedings
and when objecting to processing, pending verification whether the grounds for
legitimate interest of VMPS override yours.
· Right not to
be subject to any automated decision
You have the right not to be subject to any
decision taken solely on the basis of automated processing, including the
definition of profiles that has legal effects concerning you or that similarly
affects you.
5.1. How to
exercise your rights?
You may
exercise your rights free of charge, except in the case of a manifestly
unfounded or excessive request, in which case a reasonable fee may be charged
to account for costs.
We will
respond to your requests within a maximum of 30 days, except in cases of more
complex requests.
You can
exercise your rights through the following addresses:
Email: privacy@superbockgroup.com
Nevertheless,
and if you are not satisfied with our response after exercising any of these
rights, you have the right to file a complaint with the CNPD (Portuguese Data
Protection Authority, Rua de São Bento, n.º 148, 3º, 1200-821 Lisbon, Tel: 351
213928400, Fax: +351 213976832, email: geral@cnpd.pt).
6. Technical and organisational measures
VMPS makes use
of appropriate physical, technological, organisational and security measures to
protect its personal data in order to protect against dissemination, loss,
misuse, alteration, processing or unauthorised access relating to the personal
data that are made available to us.
7. Data
Protection Officer
VMPS has a Data Protection Officer (DPO), who (i)
supervises and advises the controller of the obligations under the rules on the
privacy and protection of personal data, (ii) cooperates with the supervisory
authority and (iii) is the point of contact with the customer, or potential
customer, in order to clarify possible questions about the data processing
carried out by VMPS.
If you wish to clarify any doubts or submit a complaint, you may do so
with the VMPS Data Protection Officer at the following email address: privacy@superbockgroup.com.
8. Privacy Policy Update
VMPS reserves
the right to update this Privacy Policy at any time. Therefore, periodic
consultation of this policy on our website is recommended in order to stay
informed about the processing of your personal data.
Without
prejudice to the consultation of this policy on our website, VMPS will
inform you of the changes made through the various communication channels used
by it.
This
Privacy Policy was last updated in May 2018.