Privacy and Security Policy

The company Phytosphera Azorica Unip., Lda., (hereinafter referred to as “Phytosphera Azorica”), in the execution of its activities, processes personal data, meaning any information relating to an identified or identifiable natural person (henceforth “Data subject(s)”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

In the cases where Phytosphera Azorica determines the purposes and means of the processing of personal data within the performance of its activities it shall be considered as joint controllers, ensuring full compliance with Data Protection Legislation.

According with the aforementioned Legislation, Phytosphera Azorica stands for the processing of personal data pursuant to all applicable principles: i) Principle of Lawfulness, Fairness and Transparency; ii) Principle of Purpose Limitation; iii) Principle of Data Minimisation; iv) Principle of Accuracy; v) Principle of Storage Limitation; vi) Principle of Integrity and Confidentiality.

In full accordance with the principles outlined above, Phytosphera Azorica fully respects the data protection rights of Data Subjects. Hence, Data Subjects may contact Phytosphera Azorica to obtain any information related to the processing of personal data, using the contacts provided in paragraph 7.

For the foregoing, this Data Protection and Privacy Policy is established in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 and other related legislation applicable (hereinafter “Data Protection Legislation”) Phytosphera Azorica undertakes any and all data processing operations in accordance with the following paragraphs:

Legal Basis and Purposes for the Processing of Personal Data
The personal data of Data Subjects will be processed by Phytosphera Azorica with the following legal basis:

Lawful Basis
What does it consist of?
Phytosphera Azorica will only process your Personal Data if you consent to its processing through a free, specific, informed and unambiguous act, by which you accept, by means of a statement (in writing or orally) or an unequivocal positive act (by completing an option), that your Personal Data is subject to processing.

Pre-contractual information’s or performance of a contract Phytosphera Azorica may process your Personal Data if it is necessary, without limitation, for the execution of a service and / or product supply contract in which you are a part of the Company as a Collaborator, Customer and / or Supplier, or to perform pre-contractual agreements at your request.

Compliance with a legal obligation
Phytosphera Azorica may process your Personal Data to ensure and guarantee compliance with legal obligations to which you are subject under the legislation of a Member State and / or the European Union.

Defence of vital interests of the Data Owner
Phytosphera Azorica may process your Personal Data to ensure the defence of your vital interests, especially when the same processing is essential to your life.

Legitimate Interests
Phytosphera Azorica, other Controllers or Third Parties, may process your Personal Data provided that such processing legitimately prevails over your interests or fundamental rights and freedoms.

Taking into account the abovementioned, the collection of personal data on the basis of the grounds of lawfulness set forth will be primarily for purposes related to the development of Phytosphera Azorica corporate purpose, for the execution of contracts and to comply with legal obligations. Hence, the non-collection of personal data will imply the impossibility of processing data for the aforesaid purposes.

Processing of personal data on the Website
In the scope of the Website personal data will be processed for the management of the same in the legitimate interest of Phytosphera Azorica and, for the purposes of using the Online Store, the personal data collected are processed for the purposes of (i) authentication; (ii) shipping; (iii) clarifications.

Phytosphera Azorica as the controller will process the following personal data of the Data Subject for the purposes of the Website for the abovementioned purpose are the following: name, surname, delivery address, email address.

In terms of the terms of retention of the personal data processed by Phytosphera Azorica as controller for the processing activities in the Website, these will be kept for the applicable fiscal, contractual and guarantee periods, as well as applicable legal retention periods that require a more extensive conservation of said data.

Processing Methods
The processing of personal data will be executed automated and manually by computer tools, which are strictly related to the mentioned purposes and, in any case, guaranteeing the security and confidentiality of personal data.

Disclosure and Transmission of Personal Data
Regarding the disclosure and transmission of personal data, Phytosphera Azorica employees will process personal data and, as a result, they can access to the personal data of Data Subjects. The referred employees will solely process personal data of Data Subjects for the purposes specified in this Policy and in strict compliance with current or future Data Protection Legislation.

Third parties who may process personal data on behalf of Phytosphera Azorica may also access to personal data of Data Subjects as subcontractors, including without limitation the providers of IT services required for the operation of information systems, outsourcing service providers or cloud computing services, professionals and consultants.

Data Subjects have the right to obtain a complete and up-to-date list of the subcontractors (if any) elected by Phytosphera Azorica and for this purpose they shall submit a specific request to Phytosphera Azorica under the terms specified in paragraph 7 of this Policy.

Data Subjects Rights
Under current or future Data Protection Legislation, Phytosphera Azorica informs that Data Subjects have the right of access, rectification, limitation, portability, erasure and the right to object to the processing of personal data in certain circumstances, which may be exercised under the terms of this chapter of the Data Protection and Privacy Policy.

Rights
What do they consist in?

Right to information
You have the right to obtain clear, transparent and easily understandable information about how Phytosphera Azorica uses your Personal Data and what are your rights. That is why Phytosphera Azorica makes all this information available to you in this Data Protection and Privacy Policy.

Right of access
You have the right to obtain information on what Personal Data Phytosphera Azorica processes (if we are processing them) and certain information (similar to that provided in this Privacy Policy) on how this Data is processed. This right allows you to know and confirm that we use your Data in accordance with data protection laws.
Phytosphera Azorica may refuse to provide the requested information whenever, in order to do so, Phytosphera Azorica has to disclose Personal Data of another person or the information negatively impacts the rights of another person.

Right to rectification
If your Data is incorrect or incomplete (for example, if your name or address is wrong), you may ask Phytosphera Azorica to take reasonable measures to correct it.

Right to erasure
This right is also known as the “right to be forgotten” and, in a simple way, allows you to request to permanently erase your data, as long as there are no valid grounds for Phytosphera Azorica to continue using them or their use is illicit. This is not a general right to erasure, since exceptions are allowed (for example, where such data are necessary for the defence of a right in a judicial proceeding).

Right to restriction of the processing activities
You have the right to “block” or prevent future use of your Data while Phytosphera Azorica evaluates a request for rectification or as an alternative to deletion. Whenever the processing is limited, Phytosphera Azorica continues to be able to store its data, but cannot use it later. Phytosphera Azorica maintains a list of the holders who have requested the “blocking” of the future use of their data to ensure that this limitation is respected.

Right to data portability
You have the right to object to certain types of processing, for reasons related to your particular situation, at any time during which this processing is carried out, for the legitimate interest of Phytosphera Azorica or of Third Parties. Phytosphera Azorica may continue to process such Data if it can prove “legitimate reasons for the processing that overlap its interests, rights and freedoms” or if such Data is necessary for the establishment, exercise or defence of a right in a judicial process.

Right to lodge a complaint
You have the right to complain to the competent control authority, the Comissão Nacional de Proteção de Dados (CNPD), if you believe that the processing carried out on Personal Data violates your rights and / or applicable data protection laws.

You may at any time, in writing, exercise the rights enshrined in the Data Protection Legislation and other applicable legislation through the methods described in paragraph 7 of this Policy.

Confidentiality and Security
To ensure the security and confidentiality of the collected personal data collected, Phytosphera Azorica uses protected databases including, but not limited to, adequate firewalls and passwords, in accordance with current and future Data Protection Legislation and other applicable legislation. Access to personal data is only possible for authorized employees who have an effective need to use the data, in accordance with the principles of security and confidentiality. Violations of the present Data Protection and Privacy Policy by Phytosphera Azorica employees may result in disciplinary action. Compliance with standards and procedures by Phytosphera Azorica staff is monitored and verified periodically.

How to Contact Phytosphera Azorica for Data Protection and Privacy Matters
Data Subjects may exercise their rights by contacting Phytosphera Azorica through the following methods: i) Rua Joaquim Marques, 22, 9500-794 Ponta Delgada; ii ) sending e-mail to the following e-mail geral@phytosphera-azorica.pt.