Privacy policy

Last updated: 13.09.2022

CUSTOMERS AND USERS

1. Who are we?

Anturio Corporation Lda, Consultadoria Informática.

The company is committed to protecting the privacy of its customers, suppliers, users of its services and third parties, as well as the contractual information it holds. In this context it adopts the "Privacy Policy" set out in this document, to show its commitment to and respect for the rules on privacy and personal data protection under the General Data Protection Regulation, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.

2. Why this privacy policy? A brief legal background.

A privacy policy is needed to let everyone who deals with the company know the principles and general rules for processing their personal data, which is collected and processed in strict compliance with the General Data Protection Regulation.

When processing the data of its customers and other contacts, the company follows best security practice and has approved an internal policy to safeguard the personal data provided by everyone who deals with the company, in particular when providing services on the market.

In this context, and to promote fairness and transparency in processing the data of our customers and users, the company has a person responsible for personal data protection, whose role is to implement this privacy policy and check that it is followed, making sure that everyone who deals with the company, and users, know the procedures used to process their data.

This privacy policy will be supplemented, case by case and where justified, by the provisions of the contracts to which the company is a party. By reading and agreeing to our privacy policy you accept the conditions set out here, so we ask our customers and users to pay particular attention to the whole of this document.

3. What does our privacy policy cover?

The privacy policy applies solely and exclusively to the collection and processing of personal data by the company in carrying out its business and providing services to its customers.

When providing services to our customers, the company will occasionally, and only as strictly necessary, copy our customers' databases. The company guarantees the full confidentiality of the copied data, in compliance with the GDPR, and undertakes to delete it as soon as the reason for copying it no longer applies.

The company also undertakes not to process third-party data without their consent. The company further undertakes to check, before any data transfer, that its customers fully comply with the GDPR.

4. What is personal data?

The protection of natural persons in relation to the processing of personal data is a fundamental right.

Personal data is any information relating to an identified or identifiable natural person, directly or indirectly, in particular by reference to an identifier such as a name, an identification number or specific elements of physical identity.

5. Our data officer.

Our data officer can be contacted at:

Name: Anturio Corporation Lda, Consultadoria Informática
Address: Rua Regimento Infantaria 11, nº30, 2ºA 2900-584 Setúbal
Phone: 707 454 000
Email: rgpd@anturio.com

6. What types of personal data do we collect?

In the course of its business and through the hiring of the company's specialised services, the data needed to provide the services or supply the products contracted will be collected. This includes data such as name, address and phone number.

7. How do we collect your data?

Your data may be collected, with your consent, by phone or in writing.

The personal data collected will be processed electronically, in compliance with the data protection legislation in force, and stored in the company's cloud database.

The data provided and processed will never be used for purposes other than those consented to or contracted.

8. Purpose of collecting and processing personal data.

The personal data provided by our customers and users is mainly used for contract management, adapting services to the needs contracted, and information.

9. Data retention period.

Your personal data will be kept for the time needed to fulfil the purpose for which it is intended or, where legal requirements oblige us to keep it, for a given minimum period.

Data will always be kept for the duration of the contractual relationship with the customer.

Where there is no legal requirement or compelling reason to keep the data, it will be stored only for the minimum period needed to fulfil the purposes for which it was collected.

10. Rights of data subjects.

Under the legal framework for personal data protection, data subjects are guaranteed the right to access, update, correct or delete their personal data, which can be exercised through the various contacts provided.

If you wish, you can choose not to receive any email and/or SMS messages. You can also choose to cancel your subscription on our website, or delete or change your personal information.

11. How can you object to being contacted for marketing?

If you do not wish to be contacted for marketing and advertising purposes, you may object at any time to the use of your data for these purposes.

To object, simply contact us: Contact information.

12. Security measures adopted to protect your data.

The company is committed to guaranteeing the protection and security of your personal data.

To that end, and in compliance with the General Data Protection Regulation, it has approved and implemented strict rules in this area. Complying with these rules is a binding obligation for everyone who lawfully accesses the data and deals with us.

Given the great importance the company places on privacy, a range of technical and organisational security measures have been adopted to protect the personal data provided to us against disclosure, loss, misuse, alteration, unauthorised processing or access, and against any other form of unlawful processing.

Accordingly, all personal data provided to us is stored securely on the company's systems.

13. Disclosure of data to subcontracted third parties: how and when?

In the course of its business the company uses third parties to provide certain services.

Sometimes these services require these entities to access our customers' personal data. When this happens, the company takes appropriate measures to ensure that the entities with access to the data are reputable and offer the highest guarantees in this area, which will be duly set out and safeguarded in the contracts.

14. Transfer of personal data.

When the company provides certain services and fulfils its contractual relationships with its customers, your data may be transferred outside Portugal, to a subsidiary of the company, in particular when using services at international institutions.

In such cases, the applicable legal provisions will be scrupulously followed, in particular regarding whether the country concerned offers adequate protection of personal data.

Such data transfers will always be communicated to the data subject.

15. Obligations relating to data processing.

Obligations of Bound Persons. In processing data, and in line with point 3 of our privacy policy, the company states that all its employees, in performing their duties, are bound by this privacy policy and must comply with it.

In particular, when performing their duties and when they have access to personal data, Bound Persons must:

Process personal data in accordance with both the purpose for which the data is intended and the company's instructions;
Ensure that access to personal data is limited on a need-to-know basis, in line with the confidentiality duties they are contractually bound by;
Not use the personal data they have access to for purposes other than those clearly and explicitly needed to perform their duties;
Not disclose personal data to third parties, even for storage, beyond what is needed to fulfil their contractual obligations and the company's instructions;
Inform the company immediately and in writing of any irregularity concerning personal data that they detect or become aware of in performing their duties;
Inform the company of any request to exercise rights and/or complaint concerning personal data that they become aware of in performing their duties;
Keep a record of the operations they carry out in accordance with the company's instructions;
Comply with the duty of secrecy regarding the content of the personal data they access in performing their duties;
Respect the technical and organisational measures implemented to protect personal data;
Cooperate with the company and provide it with all the documentation and information needed to show compliance with the obligations set out in this Policy and in the law.

16. Contacts

If you have any questions or comments about our privacy policy, please write to us at the following address: Rua Regimento Infantaria 11, nº30, 2ºA 2900-584 Setúbal

Or by email: rgpd@anturio.com

EMPLOYEES

1. Purpose: what this privacy policy covers.

The data collected or processed by our company is used to carry out the employment contract in full, in particular for payroll, human resources management, recording working time and attendance, honouring employees' rights under the law, ensuring employees' duties are met and the employer's rights are exercised, such as any disciplinary proceedings against an employee, and for other purposes permitted by law.

In addition, personal data may also be processed to comply with legal obligations, in particular to provide information to judicial, tax, police or other authorities, when our company is notified to do so under the law.

Data is collected and processed under Article 6(1)(b), insofar as it is needed to perform the employment contract; under point (a) of the same Article where the employee has consented to its collection and processing for specific purposes; and because it is needed to comply with a legal obligation of the employer, under point (c) of the said Article 6, all of the GDPR.

2. Grounds.

The processing of employees' personal data is based on:

Its necessity for the performance of a contract to which the employee is a party;
Its necessity for compliance with the legal obligations to which the company is subject;
Its necessity for the legitimate interests pursued by the company or by third parties.

3. Data collection.

Personal data, and other data the company may process, is obtained through the employment contract and through other documents requested while the employee performs their duties and during the employment relationship.

4. Lawful basis for data collection.

The personal data of employees who are data subjects is collected and processed within an employment relationship, on the basis of the employee's consent, and to meet legal obligations inherent in performing the employment contract, in particular for social security, tax, occupational health and safety, and the fulfilment of employment rights and duties, among others, which is an obligation of the employee as data subject.

Refusing to provide this data and information would make it impossible to enter into and perform the employment contract normally and in accordance with the law.

Our company is therefore entitled to process personal data under points (b), (a) and (c) of Article 6 of the GDPR.

5. Information to be provided.

In compliance with this privacy policy, the company undertakes to provide employees with the following information:

Its identity and contact details;
The contact details of the data protection officer;
The purposes of the processing for which the personal data is intended;
The legal basis for the processing for which the personal data is intended;
Where applicable, the recipients or categories of recipients of the personal data;
Any transfers of personal data to a third country;
The retention period for the personal data and the criteria used to set it;
The existence of rights and how to exercise them;
The right to lodge a complaint with the supervisory authority;
The fact that providing personal data is a legal obligation and a requirement for entering into a contract;
The possible consequences of not providing such data. This information must be given to candidates when the data is collected.

6. Legal obligation.

Processing employees' personal data is needed both to perform the contract and to comply with the legal obligations to which the company is subject, in particular those imposed by employment, social security and tax law; providing personal data is therefore a contractual and legal obligation.

7. Special categories of data.

The company processes special categories of personal data when

Needed to comply with obligations and exercise specific rights of the company under employment, social security and social protection law; or,
Needed for preventive or occupational medicine, to assess the employee's working capacity.

8. Retention period.

The company keeps personal data only for the period needed to fulfil the purposes for which it is intended, in particular while the contract is in force.

The company will nevertheless also keep personal data for the period needed to comply with the legal obligations to which it is subject, in particular under employment, social security and tax law.

In the event of a dispute between the company and an employee, the data will be kept at least until the court decision becomes final.

9. Disclosure and transfers.

In activities related to administering and managing the employment contract and relationship, the company may disclose or transfer employees' personal data to the entities listed below, not excluding other entities not mentioned that are legally entitled to process the data concerned:

IGFSS, Instituto de Gestão Financeira da Segurança Social (social security financial management);
AT, Autoridade Tributária (Portuguese tax authority);
Banks and insurers;
INE, Instituto Nacional de Estatística (national statistics institute);
ACT, Autoridade para as Condições do Trabalho (labour conditions authority).

10. Processors

The company may disclose employees' personal data to service providers, in particular:

The entity responsible for occupational health and safety;

Data collection for preventive and occupational medicine will be carried out by the occupational medicine, health and safety services, and breath and urine tests by staff duly qualified and accredited by those services;

These services and entities are subject to the GDPR, so absolute confidentiality in processing this data is guaranteed and it may not be used for any purpose other than that intended;
Any other entity entrusted with payroll processing;
Any entity entrusted with human resources management. The disclosures or transfers referred to above are intended, in particular, for:
Calculating and paying salaries, fringe benefits, other allowances and bonuses
Calculating, withholding at source and handling mandatory or optional deductions from pay arising from legal provisions;
Carrying out non-nominative statistical operations related to payroll processing within the processing entity;
Complying with the obligations to which the company is subject, in particular under employment, social security and tax law.

The company ensures that these service providers offer sufficient guarantees of implementing appropriate technical and organisational measures so that processing meets its internal standards and requirements and those of the law, with processing by these service providers governed by a written contract and in accordance with this privacy policy.

11. Security of processing.

The company is committed to guaranteeing the protection and security of your personal data.

To that end, and in compliance with the General Data Protection Regulation, it has approved and implemented strict rules in this area. Complying with these rules is an obligation for everyone who lawfully accesses the data and deals with us.

Accordingly, all employees' personal data is stored securely on the company's systems, on the company's cloud servers.