Privacy Policy
Privacy Policy

At VMPS – Águas & Turismo S.A., a company of the SUPER BOCK GROUP (“SUPER BOCK”), which markets the brand “Água das Pedras”, we recognise the importance of the processing of your personal data, so we adopted technical and organisational measures to ensure a high level of security in the processing of such data. Therefore, we hereby inform you of our Privacy Policy, which includes information concerning your rights and how we collect and use your personal data.

We assume the responsibility of processing your personal data in a complete and confidential manner, taking such data into consideration only for clear and precise purposes.


1.    Who is responsible for the processing of personal data?


VMPS – ÁGUAS E TURISMO, S.A. (“VMPS”), headquartered at Pedras Salgadas, 5450-136, Bornes de Aguiar – Vila Pouca de Aguiar – Portugal, is the entity responsible for the processing of personal data (“Data Controller”), since it defines the data collected, the means of processing and the purposes for which such data are used.


Personal data means any information relating to an identified or identifiable natural person (‘data subject’).


2.    Who are data subjects?


The customer, or potential customer, a natural person, to whom the data relate and who uses, or intends to use, the products, services or campaigns made available by VMPS.


The representative or point of contact in the company, in the case of legal persons, within the scope of performance of a contract entered between such company and VMPS or precontractual measures.


2.1. What categories of personal data are processed by VMPS?

i)         Contact Information: name, email, telephone number, country, address.

ii)       Identification data: date of birth, age, identification number, image, voice.

iii)     Data from applications, web pages and social networks: profiles, location and behaviour.

In the case of representatives of legal persons, we only collect the data necessary for proper contractual performance, such as name, email, and telephone

2.2. How, when and for what purposes are your personal data collected?

Your personal data may be collected in the following circumstances and for the following purposes:

1.       Through VMPS brand websites when you (i) make a contact request or (ii) subscribe a newsletter.

2.       For marketing campaigns, when you receive information and products, participate in competitions or events organised by VMPS (where your location, profile and behaviour may be collected) and make available your personal data to us by express consent.

3.       When you enter into a contract with us within the scope of our commercial activity, through the conclusion of distribution contracts, exclusivity contracts, among others


3.    What are the legal grounds and duration of processing of personal data?


The grounds justifying the processing of your personal data by VMPS for the purposes described in section 2.2 of this policy are as follows:


Consent: your personal data may be processed by a clear affirmative act establishing your freely given, specific, informed and explicit indication that your personal data will be subject to processing. For example, by consent we process the personal data of our customers and potential customers for commercial and marketing purposes, including marketing campaigns, events, promotions and information about new products


Precontractual measures and/or contractual performance: your personal data may be necessary for clarification of doubts and for the conclusion, performance and management of a contract entered with VMPS. For example, we process personal data for the purposes of conclusion, performance and management of the contract entered between the customer and VMPS, in particular for the preparation of proposals and contracts.


Compliance with legal obligation: your data may be necessary to fulfil a legal obligation to which the controller, in this case VMPS, is subject. For example, we are required to provide information to the Tax Administration to comply with tax obligations


Legitimate interest: your data may be required to perform certain tasks related to the business activity of VMPS, except in cases where your privacy and data protection rights prevail. Examples: we process personal data based on legitimate interest, including for business monitoring and management; in the context of customer and consumer contact via website and social networks; when we need to contact the representative of a legal person in relation to the performance of a contract; when we need to contact the representative of a legal person in relation to the performance of a contract; when we conduct satisfaction surveys after we provide services, to evaluate the quality of services provided.


Accordingly, VMPS will process your personal data according to the following:


3.1. How long do we store your personal information?


VMPSstores the personal data of data subjects only for the period strictly necessary for the purpose for which they were collected.


In certain cases, the law requires the storage of data for a specific period, particularly in the case of data necessary for informing the tax authority, which will be stored for 10 years, in accordance with current legislation.


We will also store your data for as long as you maintain a contractual relationship with VMPS. However, we may retain your personal data for periods longer than the duration of the contract, based on your consent, to ensure rights and obligations relating to the contract or in cases where there is a legitimate interest of VMPS, always respecting the period necessary for the pursuit of the purpose for which they were collected.


In the absence of a specific legal obligation, your data will be processed only for the period necessary to fulfil the purposes that led to their collection, and as long as legitimate grounds exist that permit storage thereof by VMPS.

As a rule, when processed for the purpose of marketing campaigns, your personal data will be stored for a maximum period of 5 years from the time of collection of your consent or the last contact made (whichever occurs later) and if you have not withdrawn your consent within that period.

Once the maximum storage period has elapsed, personal data will be irrevocably anonymised (anonymised data may be stored) or destroyed in a secure manner.


4.    To whom do we transmit your personal data?


VMPStransmits your personal data only when necessary for the purposes described above. VMPS may disclose and share your personal data with other SUPER BOCK GROUP companies exclusively for administrative and internal purposes


Suppliers and/or service providers of VMPS are contractually bound by the same terms and conditions for the processing of personal data as this privacy policy establishes, and they are prohibited from the use, transfer, disclosure or recording of the personal data of data subjects for any purpose other than that for which they were specifically contracted.

VMPSmay transmit your personal data, depending on the purpose for which it was collected, to different recipients, such as communications agencies, event promoters, carriers and other business partners, and only data necessary to the activity conducted by these entities within the scope of the purposes identified in this privacy policy will be transmitted.


Identification through social networks: in order to be able to be identified on websites and applications of VMPS brands without filling out registration forms, VMPS has implemented the Facebook login system. If you log on through one of these systems, you explicitly authorise VMPS to access and store public data from your Facebook account, as well as other data mentioned while using the Facebook login system. To this end, we remind you that you must know the privacy policies of the social networks where you interact with us and how they process your data.

Your personal data may also be transmitted to entities, such as the tax authority, to which the data must be communicated under the law.


5.    What are the data subjects’ rights?


VMPSguarantees the applicability and fulfilment of all the rights of data subjects provided for in the General Data Protection Regulation and national legislation in force.



·      Right of Access


You have the right to obtain confirmation from VMPS that personal data concerning you are processed or not processed, and, where appropriate, the right to access your personal data and information relating to the processing of such data, and, for example, may request an exact copy of your compilation and request additional information about the processing we perform.


·      Right to Rectification

You also have the right to obtain, without undue delay on the part of VMPS, rectification of inaccurate personal data relating to you, including the right to correct or supplement your personal data.


·      Right to erasure of data (“right to be forgotten”)

You may exercise the right to erasure of your personal data by VMPS without undue delay, provided that: the data are no longer necessary for the purpose for which they were processed; when you withdraw your consent and there are no other valid grounds for storage thereof; when you object to processing and there are no prevailing legitimate interests on the part of VMPS, as well as in other legally established cases.


·      Right to Data Portability

You have the right to receive personal data relating to you and provided to VMPS in a structured, current and machine-readable format, as well as the right to transmit this data to another controller (if this is technically possible), without hindrance from VMPS, where the processing is based on consent or on a contract and processing is carried out by automated means.


·      Right to withdraw consent

You may at any time change your consent, restrict it to certain types of processing or withdraw it. However, withdrawal of consent does not affect the lawfulness of processing on the basis of consent given previously.


·      Right to Object

You may also object at any time to the processing of personal data relating to you where there are no overriding and legitimate reasons for processing which prevail over your interests, rights and freedoms, or for purposes of declaration, exercise or defence of a right in judicial proceedings.


·      Right to Restriction of Processing


In certain situations you have the right to obtain from VMPS the restriction of the processing of your data, particularly if you dispute the accuracy of personal data during a period that allows VMPS to verify its accuracy, in cases where the data are no longer necessary for processing purposes but which are required by the data subject in order to declare, exercise or defend a right during the course of judicial proceedings and when objecting to processing, pending verification whether the grounds for legitimate interest of VMPS override yours.



·      Right not to be subject to any automated decision

You have the right not to be subject to any decision taken solely on the basis of automated processing, including the definition of profiles that has legal effects concerning you or that similarly affects you.


5.1. How to exercise your rights?


You may exercise your rights free of charge, except in the case of a manifestly unfounded or excessive request, in which case a reasonable fee may be charged to account for costs.


We will respond to your requests within a maximum of 30 days, except in cases of more complex requests.


You can exercise your rights through the following addresses:



Nevertheless, and if you are not satisfied with our response after exercising any of these rights, you have the right to file a complaint with the CNPD (Portuguese Data Protection Authority, Rua de São Bento, n.º 148, 3º, 1200-821 Lisbon, Tel: 351 213928400, Fax: +351 213976832, email:


6.    Technical and organisational measures


VMPS makes use of appropriate physical, technological, organisational and security measures to protect its personal data in order to protect against dissemination, loss, misuse, alteration, processing or unauthorised access relating to the personal data that are made available to us.


7.    Data Protection Officer


VMPS has a Data Protection Officer (DPO), who (i) supervises and advises the controller of the obligations under the rules on the privacy and protection of personal data, (ii) cooperates with the supervisory authority and (iii) is the point of contact with the customer, or potential customer, in order to clarify possible questions about the data processing carried out by VMPS.


If you wish to clarify any doubts or submit a complaint, you may do so with the VMPS Data Protection Officer at the following email address:


8.    Privacy Policy Update

VMPS reserves the right to update this Privacy Policy at any time. Therefore, periodic consultation of this policy on our website is recommended in order to stay informed about the processing of your personal data.

Without prejudice to the consultation of this policy on our website, VMPS will inform you of the changes made through the various communication channels used by it.

This Privacy Policy was last updated in May 2018.