Privacy Policy

• PRIVACY POLICY

A. GENERAL PART

1.1. COLLECTION AND PROCESSING OF USER DATA

Within the scope of providing the website hosted at www.soldoiro.com (“Site”), entering into any contracts, and providing information and content (together, the “Services”) to its users (“User”), Nara, Projectos, Construçáo e Turismo Lda., with registered office at Rua António Pereira Carrilho, nº5 – 6º, 1000 – 046 Lisbon, registered with the Lisbon Commercial Registry Office under the single registration and corporate taxpayer number 501448985 (hereinafter “Soldoiro”), may request that the User provide personal data, that is, information provided by the User that allows Soldoiro to identify and/or contact them (“Personal Data”).

As a rule, Personal Data are requested when the User requests contact and/or when they show interest in working at Soldoiro through spontaneous applications, responses to specific opportunities that are advertised, as well as applications resulting from internship opportunities.

At the time of collecting Personal Data, Soldoiro provides the User with detailed information about the nature of the data collected and the purpose and processing that will be carried out in relation to the Personal Data, as well as the information mentioned in clause 8.

Soldoiro also collects and processes information about your hardware and software, as well as information about the pages visited by the User within the Site. This information may include: browser type, domain name, access times, and hyperlinks through which the User accessed the Site (“Usability Information”). We use this information solely to improve the quality of your visit to our Site.

Usability Information and Personal Data are referred to in this Privacy Policy as “User Data”.

1.2. SUBCONTRACTED ENTITIES

Within the scope of processing User Data, Soldoiro uses or may use third-party entities subcontracted by it to, on behalf of Soldoiro and in accordance with the instructions given by it, process User Data in strict compliance with the law and this Privacy Policy.

These subcontracted entities may not transmit User Data to other entities without Soldoiro’s prior written authorization, nor may they subcontract other entities without Soldoiro’s prior authorization.

Soldoiro undertakes to subcontract only entities that provide sufficient guarantees of implementing appropriate technical and organizational measures to ensure the protection of User rights. All entities subcontracted by Soldoiro are bound by a written contract regulating, namely, the subject and duration of processing, the nature and purpose of processing, the type of personal data, the categories of data subjects, and the rights and obligations of the parties.

At the time of collecting personal data, Soldoiro informs the User about the categories of subcontracted entities that, in the specific case, may process data on behalf of Soldoiro.

1.3. DATA COLLECTION CHANNELS

Soldoiro may collect data directly (i.e., directly from the User) or indirectly (i.e., through partner entities or third parties). Collection may take place through the following channels:

Direct collection: in person, by telephone, by email, and through the Site;

Indirect collection: through partners or group companies and official entities.

2. GENERAL PRINCIPLES APPLICABLE TO THE PROCESSING OF USER DATA

In terms of general principles relating to the processing of personal data, Soldoiro undertakes to ensure that the User Data it processes are:

• Processed lawfully, fairly, and transparently in relation to the User;
• Collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes;
• Adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed;
• Accurate and kept up to date whenever necessary, with all appropriate measures taken to ensure that inaccurate data, having regard to the purposes for which they are processed, are erased or rectified without delay;
• Kept in a form that permits identification of the User only for as long as necessary for the purposes for which the data are processed;
• Processed in a manner that ensures their security, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organizational measures.

Data processing carried out by Soldoiro is lawful when at least one of the following applies:

• The User has given explicit consent to the processing of User Data for one or more specific purposes;
• Processing is necessary for the performance of a contract to which the User is a party or for pre-contractual steps at the User’s request;
• Processing is necessary for compliance with a legal obligation to which Soldoiro is subject;
• Processing is necessary to protect the vital interests of the User or of another natural person;
• Processing is necessary for the purposes of the legitimate interests pursued by Soldoiro or by third parties (except where such interests are overridden by the interests or fundamental rights and freedoms of the User requiring protection of personal data).

Soldoiro undertakes to ensure that the processing of User Data is carried out only under the conditions listed above and in compliance with the principles mentioned above.

When processing of User Data is carried out by Soldoiro based on the User’s consent, the User has the right to withdraw their consent at any time. Withdrawal of consent, however, does not affect the lawfulness of processing carried out by Soldoiro based on consent previously given by the User.

The period for which data are stored and retained varies according to the purpose for which the information is processed.

Indeed, there are legal requirements that oblige data to be retained for a minimum period. Thus, whenever there is no specific legal requirement, data will be stored and retained only for the minimum period necessary for the purposes that motivated their collection or subsequent processing, after which they will be deleted.

3. USE AND PURPOSES OF PROCESSING USER DATA

In general terms, Soldoiro uses User Data for the following purposes:

• User contact requests;
• Selection and recruitment within the scope of advertised opportunities, spontaneous applications by Users, and internship opportunities;
• Ensuring that the Site meets User needs by developing and publishing content as adapted as possible to requests and User type, improving the Site’s search capabilities and functionalities, and obtaining aggregated or statistical information regarding the typical User profile (consumer profile analysis);

User Data collected by Soldoiro are not shared with third parties without the User’s consent, except in the situations referred to in the following paragraph. However, if the User contracts services from Soldoiro that are provided by other entities responsible for processing personal data, User Data may be consulted or accessed by those entities insofar as necessary to provide such services.

Under applicable legal terms, Soldoiro may transmit or communicate User Data to other entities if such transmission or communication is necessary for the performance of the contract established between the User and Soldoiro, or for pre-contractual steps at the User’s request, or if necessary to comply with a legal obligation to which Soldoiro is subject, or if necessary for the pursuit of legitimate interests of Soldoiro or a third party. In the event of transmission of User Data to third parties, reasonable efforts will be made to ensure that the recipient uses the transmitted User Data in accordance with this Privacy Policy.

4. TECHNICAL, ORGANIZATIONAL, AND SECURITY MEASURES IMPLEMENTED

To ensure the security of User Data and maximum confidentiality, Soldoiro treats the information you provide as strictly confidential, in accordance with its internal security and confidentiality policies and procedures, which are periodically updated as necessary and in accordance with legally established terms and conditions.

Depending on the nature, scope, context, and purposes of data processing, as well as the risks arising from processing to the rights and freedoms of the User, Soldoiro undertakes to apply, both at the time of defining processing means and at the time of processing itself, the necessary and appropriate technical and organizational measures to protect User Data and comply with legal requirements.

It also undertakes to ensure that, by default, only data necessary for each specific processing purpose are processed and that such data are not made available, without human intervention, to an indeterminate number of people.

In terms of general measures, Soldoiro adopts the following:

• Regular audits to assess the effectiveness of implemented technical and organizational measures;
• Awareness and training of staff involved in data processing operations;
• Pseudonymization and encryption of personal data;
• Mechanisms capable of ensuring the ongoing confidentiality, availability, and resilience of information systems;
• Mechanisms that ensure the timely restoration of information systems and access to personal data in the event of a physical or technical incident;

5. TRANSFER OF DATA OUTSIDE THE EUROPEAN UNION

Personal data collected and used by Soldoiro are not made available to third parties established outside the European Union. If, in the future, such a transfer occurs for the reasons mentioned above, Soldoiro undertakes to ensure that the transfer complies with applicable legal provisions, namely regarding the determination of the adequacy of such country with respect to data protection and the requirements applicable to such transfers.

6. USE OF COOKIES

Cookie Policy

By browsing our Site, you allow the collection and storage of small text files known as cookies, which contain information and are downloaded to Users’ computers or other devices via a server. These text files allow for a more personalized and efficient browsing experience.

On each visit to the Site, your internet browser sends these cookies back to the Site, enabling recognition and memorization of Users’ identities as well as their usage preferences.

• What are Cookies?

“Cookies” are small software files that are stored on your device via the browser, retaining information related to browsing status as well as recording User browsing activity. They may also be used to remember information previously entered by the User on the website.

• What types of Cookies are used?

Necessary cookies to:

• Enable navigation on the Site;
• Make use of its features, namely accessing secure areas and content restricted to registered Users.

Functional cookies to:

• Store information about our Users’ choices;
• Allow customization of our Site to their needs, namely remembering the language.

Performance cookies to:

• Monitor how individual Users access our Site and how frequently.

Session cookies to:

• Used for the booking process, as these types of cookies are more secure and cannot be manipulated by third parties.

We also use, directly or indirectly, analytics services to assess the effectiveness of our content and Users’ preferences, contributing to the optimization of this Site’s operation.

We also use web beacons or tracking pixels to anonymously count the number of visitors to our Site without identifying any particular User. However, for registered Users who are logged into the Site, we will combine this information with data collected via cookies to analyze how Users navigate this Site in more detail.

• Browser controls:

The vast majority of browsers allow Users to view stored cookies as well as delete or block them.

Whenever cookies are deleted, some Site functionalities may be affected.

If you wish to learn more about how Cookies work, you may consult the websites AboutCookies.org or Cookiecentral.com.

• Cookie Security:

As Cookies may be intercepted or altered, the following security actions are taken:

• No sensitive information such as passwords or personal data such as address or customer phone number is stored;
• Insecure requests (HTTP) are not sent where cookies are transmitted to the browser in plain text and could be intercepted.

7. TOOLS USED BY THE SITE FOR STATISTICAL READING AND USER BEHAVIOR ANALYSIS

Google Analytics

The Site uses Google Analytics, a web analytics service provided by Google. Cookies are stored that provide information about Site usage and navigability. These data, including the User’s IP address, are transmitted to Google servers; however, they are not associated with any other data held by Google.

The User may disable the tool by downloading and installing a browser add-on available from Google: https://tools.google.com/dlpage/gaoptout?hl=en

Facebook and Instagram:

The Site features interactivity with Facebook and Instagram through a connection to these social networks’ servers, which will allow identification of the website the User is visiting and may store other data such as the IP address.

If the User is logged into Facebook and/or Instagram, the data will be associated with their accounts. To prevent this, the User should log out of Facebook and Instagram before visiting the page.

Information regarding data processing by these social networks is available at: https://www.facebook.com/about/privacy/ https://help.instagram.com/519522125107875

Twitter

The Site provides interactivity with Twitter through its respective button, establishing a connection to Twitter servers, which will identify the Site the User is visiting and may store other data such as the IP address.

More information on how Twitter processes data is available at: https://twitter.com/privacy

B. USERS’ RIGHTS (DATA SUBJECTS)

8. RIGHT TO INFORMATION

8.1. Information provided to the User by Soldoiro (when data are collected directly from the User):

• The identity and contact details of Soldoiro, the data controller, and, where applicable, its representative;
• The contact details of the Data Protection Officer;
• The purposes of processing for which personal data are intended, as well as, where applicable, the legal basis for processing;
• Where processing is based on legitimate interests of Soldoiro or a third party, identification of such interests;
• Where applicable, the recipients or categories of recipients of personal data;
• Where applicable, indication that personal data will be transferred to a third country or international organization, and whether an adequacy decision by the Commission exists or reference to appropriate or suitable transfer safeguards;
• The retention period for personal data;
• The right to request access to personal data, as well as rectification, erasure, or restriction, the right to object to processing, and the right to data portability;
• Where processing is based on User consent, the right to withdraw consent at any time without affecting the lawfulness of processing based on prior consent;
• The right to lodge a complaint with the CNPD or another supervisory authority;
• Whether the provision of personal data is a legal or contractual requirement or a requirement necessary to enter into a contract, whether the data subject is obliged to provide the data, and the possible consequences of failure to provide such data;
• Where applicable, the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject;
• Where User Data are not collected directly from the User, information about the categories of personal data concerned, their source, and whether they originate from publicly accessible sources;
• If Soldoiro intends to further process User Data for a purpose other than that for which the data were collected, information about that purpose and any other relevant information prior to such processing.

8.2. Procedures and measures implemented to comply with the right to information.

The information referred to in 8.1. is provided in writing (including by electronic means) by Soldoiro to the User prior to the processing of the personal data concerned. Under applicable law, Soldoiro is not obliged to provide the information mentioned in 8.1. where and insofar as the User already has such information.

Information is provided by Soldoiro free of charge.

9. RIGHT OF ACCESS TO PERSONAL DATA

Soldoiro ensures the means that allow the User access to their Personal Data.

The User has the right to obtain from Soldoiro confirmation as to whether or not personal data concerning them are being processed and, where that is the case, access to the personal data and the following information:

• The purposes of data processing;
• The categories of personal data concerned;
• The recipients or categories of recipients to whom personal data have been or will be disclosed, in particular recipients in third countries or international organizations;
• The retention period for personal data;
• The right to request rectification, erasure, or restriction of processing, or to object to such processing;
• The right to lodge a complaint with the CNPD or another supervisory authority;
• Where data are not collected from the User, any available information as to their source;
• The existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject;
• The right to be informed of appropriate safeguards relating to the transfer of data to third countries or international organizations.

Upon request, Soldoiro will provide the User, free of charge, with a copy of the User Data undergoing processing. The provision of additional copies requested by the User may incur administrative costs.

10. RIGHT TO RECTIFICATION OF PERSONAL DATA

The User has the right to request, at any time, rectification of their Personal Data, as well as the right to have incomplete personal data completed, including by means of a supplementary statement.

In the event of data rectification, Soldoiro shall communicate the rectification to each recipient to whom the data have been disclosed, unless this proves impossible or involves disproportionate effort.

11. RIGHT TO ERASURE OF PERSONAL DATA (“RIGHT TO BE FORGOTTEN”)

The User has the right to obtain from Soldoiro the erasure of their data where one of the following grounds applies:

• User Data are no longer necessary for the purpose for which they were collected or processed;
• The User withdraws consent on which processing is based and there is no other legal ground for processing;
• The User objects to processing and there are no overriding legitimate grounds for processing;
• User Data have been unlawfully processed;
• User Data must be erased for compliance with a legal obligation to which Soldoiro is subject;

Under applicable law, Soldoiro is not obliged to erase User Data insofar as processing is necessary for compliance with a legal obligation or for the establishment, exercise, or defense of a legal claim.

In the event of erasure, Soldoiro shall communicate the erasure to each recipient to whom the data have been disclosed, unless this proves impossible or involves disproportionate effort.

Where Soldoiro has made User Data public and is obliged to erase them under the right to erasure, Soldoiro undertakes to take reasonable measures, including technical measures, considering available technology and implementation costs, to inform controllers processing the personal data that the User has requested erasure of links to, or copies or replications of, those personal data.

12. RIGHT TO RESTRICTION OF PROCESSING OF PERSONAL DATA

The User has the right to obtain from Soldoiro restriction of processing of User Data where one of the following applies (restriction consists of marking stored personal data with the aim of limiting their processing in the future):

• The accuracy of the personal data is contested, for a period enabling Soldoiro to verify their accuracy;
• Processing is unlawful and the User opposes erasure, requesting restriction of use instead;
• Soldoiro no longer needs the User Data for processing purposes, but they are required by the User for the establishment, exercise, or defense of legal claims;
• The User has objected to processing, pending verification whether Soldoiro’s legitimate grounds override those of the User.

Where User Data are restricted, they shall, except for storage, only be processed with the User’s consent or for the establishment, exercise, or defense of legal claims, for the protection of the rights of another natural or legal person, or for reasons of public interest provided by law.

The User who has obtained restriction of processing will be informed by Soldoiro before the restriction is lifted.

In the event of restriction, Soldoiro shall communicate the restriction to each recipient to whom the data have been disclosed, unless this proves impossible or involves disproportionate effort.

13. RIGHT TO DATA PORTABILITY

The User has the right to receive personal data concerning them that they have provided to Soldoiro, in a structured, commonly used, and machine-readable format, and the right to transmit those data to another controller where:

• Processing is based on consent or on a contract to which the User is a party;

and

• Processing is carried out by automated means.

The right to portability does not include inferred or derived data, i.e., personal data generated by Soldoiro as a consequence or result of analysis of processed data.

The User has the right to have personal data transmitted directly between controllers, where technically feasible.

14. RIGHT TO OBJECT TO PROCESSING

The User has the right to object at any time, on grounds relating to their particular situation, to processing of personal data concerning them based on Soldoiro’s legitimate interests or where processing is carried out for purposes other than those for which the personal data were collected, including profiling, or where personal data are processed for statistical purposes.

Soldoiro shall cease processing User Data unless it demonstrates compelling legitimate grounds for processing that override the interests, rights, and freedoms of the User, or for the establishment, exercise, or defense of legal claims.

Where User Data are processed for direct marketing purposes, the User has the right to object at any time to processing of personal data concerning them for such marketing, including profiling related to direct marketing. If the User objects, Soldoiro will cease processing for that purpose.

The User also has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, unless the decision:

• Is necessary for entering into, or performance of, a contract between the User and Soldoiro;
• Is authorized by law to which Soldoiro is subject; or
• Is based on the User’s explicit consent.

15. PROCEDURES FOR EXERCISING USER RIGHTS

The right of access, rectification, erasure, restriction, portability, and objection may be exercised by the User by sending an email to protecaodados@soldoiro.com

For further questions related to data protection matters, please contact Soldoiro’s Data Protection Officer via email at protecaodados@soldoiro.com or by registered letter to Rua Ramalho Ortigão, 8200-604 Albufeira.

Soldoiro will respond in writing (including by electronic means) within a maximum of one month from receipt of the request, except in particularly complex cases, where this period may be extended by up to two months.

If User requests are manifestly unfounded or excessive, particularly due to their repetitive nature, Soldoiro reserves the right to charge administrative costs or refuse to act on the request.

16. PERSONAL DATA BREACHES

In the event of a data breach and insofar as such breach is likely to result in a high risk to the rights and freedoms of the User, Soldoiro undertakes to notify the User of the personal data breach within 72 hours of becoming aware of the incident.

Under applicable law, notification to the User is not required in the following cases:

• If Soldoiro has implemented appropriate technical and organizational protection measures and those measures were applied to the personal data affected by the breach, particularly measures that render the personal data unintelligible to unauthorized persons, such as encryption;
• If Soldoiro has taken subsequent measures ensuring that the high risk to the User’s rights and freedoms is no longer likely to materialize; or
• If notification would involve disproportionate effort. In such cases, Soldoiro shall issue a public communication or take a similar measure to inform the User.

C. FINAL PART

17. CHANGES TO THE PRIVACY POLICY

Soldoiro reserves the right to amend this Privacy Policy at any time. In the event of modification, the date of the last update, available at the top of this page, will also be updated. If the change is substantial, a notice will be posted on the Site.

18. APPLICABLE LAW AND JURISDICTION

This Privacy Policy, as well as the collection, processing, or transmission of User Data, is governed by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 and by the applicable legislation and regulations in Portugal.

Any disputes arising from the validity, interpretation, or execution of this Privacy Policy, or related to the collection, processing, or transmission of User Data, shall be submitted exclusively to the jurisdiction of the judicial courts of the Lisbon district, without prejudice to mandatory applicable legal provisions.