Introduction

This policy includes Herdade dos Abegões’ obligations regarding the processing of personal data, in order to guarantee compliance with the requirements of the relevant legislation, with a view to adapting its efforts to a constantly changing reality, in order to deal with the most relevant risks. It applies to all personal data processing operations, including their collection, processing and storage by Herdade dos Abegões, in relation to its employees, service providers and clients, in the course of its activity.

Scope

The policy covers all personal data, including those relating to special categories of personal data, processed in relation to data subjects by Herdade dos Abegões, as Data Controller, or Processor. This Policy also applies to personal data processed manually as long as it is included in a structured file.

All personal data relating to special categories of personal data will be treated with greater care by Herdade dos Abegões. Both categories will also be referred to as “Personal Data” in this Policy, unless otherwise indicated.

Who processes your data

In the course of its business, Herdade dos Abegões may acquire, process and store Personal Data. In accordance with European and Portuguese data protection legislation, this data must be acquired and managed in a lawful, fair and transparent manner.

At Herdade dos Abegões, we are committed to ensuring that the entire team has sufficient knowledge of data protection legislation and practices to be able to anticipate and identify any issues that may arise. In such circumstances, the team must ensure that the Data Controller is informed, guaranteeing that all appropriate and necessary corrective actions will be taken in order to guarantee the rights, freedoms and guarantees of the Data Subjects.

Herdade dos Abegões may share Data Subjects’ Personal Data with Subcontractors provided that this is necessary for the normal provision of its services. Subcontractors’ access to the Personal Data shared by Herdade dos Abegões is regulated by the contract signed with its Subcontractors.

In this sense, Herdade dos Abegões contractually ensures and regularly verifies that the Subcontractors are reliable entities that offer adequate protection guarantees, and that no data is transmitted to them beyond what is necessary to provide the contracted service.

In the course of its role as Data Controller, Herdade dos Abegões may also share the Data Subjects’ Personal Data with other Data Controllers in order to carry out the processing operations required to provide the contracted services.

Within the scope of the aforementioned joint responsibility, Herdade dos Abegões enters into an agreement with the other data controller, which transparently identifies the respective purposes and responsibilities in compliance with the data protection legislation in force, guaranteeing compliance with the Data Subjects’ Rights and Freedoms by establishing appropriate communication channels to respond to the Data Subjects’ requests.

Regardless of the relationship between the Recipients of Personal Data, Herdade dos Abegões defines, through a formal and written contract, the delimitation of the obligations in terms of Personal Data, the specific purpose or purposes for which they are involved and the understanding that they carry out the data processing operations in accordance with the Portuguese Data Protection Legislation.

Possible Recipients of Personal Data

• Providers of IT, technical and operational support services;
• Entities related to or under common management with Herdade dos Abegões;
• Entities to which Herdade dos Abegões provides services;
• Judicial authorities, criminal police and administrative authorities.

What we do with your data

As Data Controller, Herdade dos Abegões guarantees that all Personal Data:

• They will be obtained for specific, lawful and clearly defined purposes, with the Data Subject having the right to question the purpose(s) for which Herdade dos Abegões collects and keeps them, and Herdade dos Abegões must clearly and precisely inform them of the purpose(s);
• They will be compatible with the purposes for which they were purchased;
• They will be maintained with appropriate security measures – implemented or to be implemented – to protect against unauthorized access to, or alteration, destruction or disclosure of, any Personal Data held;
• They will be kept accurate, complete and updated when necessary;
• They will be collected on a limited basis and kept only for as long as is strictly necessary, and excessive data will not be collected and/or processed.

Herdade dos Abegões has therefore implemented a procedure for responding to requests from Data Subjects, in order to manage such requests efficiently and appropriately, within the time limits stipulated by law.

Herdade dos Abegões has implemented or is in the process of implementing the levels of security and protection of Personal Data made available, as well as technical and organizational measures for the protection of Personal Data against its dissemination, loss, misuse, alteration, unauthorized processing or access, as well as against any other form of illicit processing.
All Herdade dos Abegões employees are also subject to confidentiality rules.

Purposes and grounds for lawfulness of processing operations

Clients

Herdade dos Abegões carries out processing operations on its Clients’ Personal Data to ensure compliance with the service contract agreed with the Data Subjects or with the Joint Controllers (in relation to the data and Data Subjects collected by them, such as counterparties, employees and others). The personal data identified above and subject to processing operations is necessary for the performance of a contract or for pre-contractual procedures or for the fulfillment of legal obligations, or in the case of marketing, it may be based on consent.

Special Category data relating to Customers, or obtained through Customers, will be subject to appropriate processing operations, insofar as they are necessary for reasons of important public interest such as the prevention of money laundering and terrorist financing.

The processing of Personal Data of Clients or obtained through Clients, related to criminal convictions and offenses or related security measures will always be subject to appropriate guarantees to protect the rights and freedoms of the Data Subjects, and operations concerning such data will be limited to strict compliance with applicable legal obligations.

Employees

Herdade dos Abegões processes the data of its employees for the purpose of executing the employment contract. The data processed is necessary for the performance of a contract to which the Data Subject is a party, or for the purposes of pre-contractual procedures at the request of the Data Subject.

The Personal Data of employees is also collected and processed for the purposes of complying with legal obligations to which the Data Controller is subject.

Processing operations relating to Special Category data collected from Employees are necessary for the purposes of complying with legal obligations and exercising specific rights of the Data Controller or Data Subject with regard to employment legislation, social security and social protection, as well as for the purposes of preventive or occupational medicine, for the assessment of the employee’s working capacity.

The processing of the Personal Data of Employees or obtained through Employees, related to criminal convictions and offenses or related security measures will always be subject to guarantees appropriate to the protection of the rights and freedoms of Data Subjects, and operations concerning such data will be limited to strict compliance with applicable legal obligations.

Service providers

Herdade dos Abegões carries out processing operations on the Personal Data of its Service Providers to ensure compliance with the service provision contract agreed with the Data Subjects or with the Joint Controllers (in relation to the data and Data Subjects collected by them, such as counterparties, employees and others).

The Personal Data identified herein and subject to processing operations is required for the performance of a contract or for pre-contractual procedures or for the fulfillment of legal obligations.

Special Category Data relating to Service Providers or obtained through Service Providers will be subject to processing operations insofar as they are necessary for the establishment, exercise or defense of legal claims, or the processing is necessary for the purposes of fulfilling obligations and exercising specific rights of the Controller or the Data Subject in matters of employment law, social security and social protection or important public interest.

The processing of Personal Data of Service Providers or obtained through Service Providers, related to criminal convictions and offenses or related security measures will always be subject to appropriate guarantees to protect the rights and freedoms of data subjects, and operations concerning such data will be limited to strict compliance with applicable legal obligations.

Criteria for Calculating Retention Periods

Herdade dos Abegões keeps Personal Data for the period deemed necessary and sufficient for the purposes for which it was collected and processed, with the period of data storage varying according to the purpose for which the information is processed and in accordance with the legal rules requiring its retention, after which it will be deleted, subject to the appropriate technical and functional guarantees, as documented in each of the relevant processes.

Right of Access and Exercise of Rights

Data Subjects may exercise their rights under the applicable data protection legislation, namely to access, correct, add, update or delete their Personal Data, via the following email address: info@abegoes.com. Herdade dos Abegões may request an identification document in order to protect the Data Subject’s privacy before making any changes.