1. AICEP Commitment
AICEP Portugal Global, Agência para o Investimento e Comércio Externo de Portugal, EPE (hereinafter AICEP), in the context of its attributions, processes personal data, aiming to ensure rigorously, effectively and safely the protection of all data that daily collect and treat.
Please read this Privacy Policy which describes how we process your personal data and how you can exercise your rights as a holder of personal data processed by AICEP.
Within the scope of its activities and attributions, AICEP is responsible for collecting and processing personal data, which is processed and stored in an automated and non-automated way.
AICEP has a Data Protection Officer, which can be contacted via e-mail dpo@portugalglobal.pt.
The Data Protection Officer is responsible, in particular, for monitoring the compliance of activities involving the processing of your data with the applicable legal and regulatory standards, being also the point of contact between AICEP and the National Control Authority, as well as between AICEP and its customers and users in matters relating to the processing of personal data.
3. Personal data, holders of personal data and categories of personal data
What is personal data?
Personal data is all information of any nature, collected on any type of support, relating to a natural, identified or identifiable person. The set of information that can lead to the identification of a particular person is considered identifiable, namely by reference to an identifier (such as an identification number or location data).
From whom do we collect personal data?
In view of the attributions of AICEP, most of the data of legal persons (companies and associations) are processed. However, for the performance of its duties, data from the following types of natural persons may be collected and processed (non-exhaustive list):
• Customers/investors and their employees
• Service providers and their employees
• Candidates and clients of programs promoted by AICEP
What personal data do we process and how do we collect it?
AICEP only collects data that is adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
The collection of your data can be done verbally, in writing (namely through forms and contracts), and through the AICEP website. As a general rule, we collect your data directly, and personal data may also be collected through public sources (such as internet sites and official public lists), as well as incentive management entities.
For different purposes, we may collect the following types of personal data:
• Location data (such as IP address)
As a rule, AICEP does not collect special data, such as health data or data referring to administrative offences or criminal offences.
Why and on what basis do we use your personal data?
All data collected and processed by AICEP is based on one of the following legal conditions.
• Consent: When the collection is preceded by your express, specific and informed consent, through written support or via the web.
• Execution of a contract or pre-contractual steps: when the processing is necessary for the performance of a contract to which you are a party or for pre-contractual steps.This condition will be fulfilled when we process your data for the purposes of managing programs and financing and cooperation protocols or contracts for the supply and provision of services.
• Compliance with legal obligations: when processing is necessary for the fulfilment of a legal obligation. This includes, for example, the communication of data with other public (national and community), fiscal or judicial bodies.
• Public interest: when the processing is necessary to exercise public interest or public authority functions. Since AICEP is a public body, whose attributions mostly concern missions that include supporting the investment of companies in Portugal and supporting the internationalisation of Portuguese companies, this includes the treatment related to the implementation of community programs, with the granting of incentives, as well as the management of the relationship with the sectoral associations with which the companies are related.
• Legitimate interest: when processing proves to be necessary for the pursuit of the legitimate interests of the entity responsible for the treatment or third parties, without harm the rights and freedoms of its customers and/or users. This includes all treatments that result from attributions conferred by law, namely the internal and external disclosure of Portuguese entities, at national and international level.
What are the purposes for which we collect your data?
Personal data collected by AICEP is only processed for specific, explicit and legitimate purposes. Whenever personal data is collected, it is intended exclusively for the purposes expressly identified at the time of collection.
5. Personal data retention period
AICEP processes and keeps your data only for the period that is necessary for the pursuit or completion of the purposes of the treatment for which they are intended, in respect of the maximum periods necessary to comply with contractual, legal or regulatory obligations.
As a general rule, and when there is a contract that legitimizes the processing of your data, AICEP will keep such data as long as such contractual relationship is maintained. Other circumstances exist, such as compliance with legal or regulatory obligations (for example, for the purpose of complying with tax obligations, personal data relating to invoicing must be kept for a maximum period of ten years from the date of the act), as well as the pending legal proceedings, which may legitimize your data to be kept for a longer period of time.
At the end of the conservation period, AICEP will proceed with the elimination of said data.
Under the terms of the legislation in force, from the moment we collect and process your data, there is a set of rights that, at any time, you can exercise with AICEP.
What are your rights?
• Right of access: right that allows you to obtain information regarding the processing of your data and its characteristics (namely the type of data, the purpose of the treatment, to whom your data can be communicated, retention periods and which data you have to provide mandatory or optional).
• Right to rectification: right that allows you to request the rectification of your data, demanding that they are accurate and current, for example, when you consider that they are incomplete or outdated.
• Right to erase data or "Right to be forgotten”: right that allows you to request the deletion of your data when you consider that there are no valid grounds for the conservation of the data and provided that there is no other valid basis that legitimises such treatment (such as the execution of a contract or the fulfilment of a legal or regulatory obligation).
• Right to Limitation: right that allows you to suspend treatment or limit treatment to certain categories of data or purposes.
• Right to Portability: right through which you can request your data to be sent, in digital format and in common use, which allows the reuse of such data. Alternatively, you may request the transmission of your data to another entity that becomes responsible for the processing of your data.
• Right of Opposition: right that allows you to oppose certain purposes and provided that there are no legitimate interests that prevail over the your interests. One of the examples of this right concerns opposition to direct marketing purposes (marketing).
• Right to Withdraw Consent: right that allows you to withdraw your consent, but which can only be exercised when your consent is the only condition of legitimacy.
How can you exercise your rights?
All rights described above may be exercised, subject to the limitations provided for by applicable law, upon written request, to be sent through our form.
Likewise, you can send questions related to the processing of your data, directly to the Data Protection Officer, through the email indicated in point 2.
You can also submit any complaint to the National Control Authority.
7. Data transmission
With whom do we share your personal data?
In view of AICEP's attributions, and depending on its purpose, your data may be shared with third parties, which include national and international public bodies and private entities for the purpose of complying with legal or regulatory, contractual obligations or functions of interest. public.
Your data may also be accessed by AICEP service providers, considered necessary for the execution of the purposes described above, namely with regard to information security and archiving services. AICEP guarantees that it only uses service providers that present the guarantees of execution of necessary and adequate technical and organizational measures to protect your personal data.
Transfers of personal data outside the EEA: AICEP may, exceptionally, transfer your personal data to third countries (outside the EEA – European Economic Area).
In such cases, AICEP will ensure that data transfers are carried out in strict compliance with applicable legal regulations.
8. Legislation
The processing of personal data of users and customers carried out by AICEP, as well as the sending of communications of a commercial nature carried out by electronic means are in compliance with national and community legislation in force, namely with the General Data Protection Regulation (Regulation (EU) 2016/679, of 27 April 2016).