1. AICEP Commitment
AICEP Portugal Global, Agência para o Investimento e Comércio Externo de Portugal, E.P.E. (hereinafter referred to as AICEP) in carrying out its duties processes personal data and wishes to strictly, effectively and securely protect all the data it collects and processes daily.
Please carefully read this Privacy Policy which describes how we process your personal data and how you can exercise your rights as the subject of the personal data processed by AICEP.
2. The data controller and the data protection officer
As part of its activities and duties, AICEP is the entity responsible for collecting and processing personal data, which is processed and stored in an automated and non-automated manner.
AICEP has a data protection officer who may be contacted through dpo@portugalglobal.pt.
The data protection officer is responsible, especially, for monitoring that activities involving the processing of your data comply with the applicable legal and regulatory standards and is also the liaison between AICEP and Autoridade Nacional de Controlo (National Supervisory Authority), and between AICEP and its clients and users in matters regarding the processing of personal data.
3. Personal Data, personal data subjects and personal data categories
What is personal data?
Personal data is all information of any nature, collected through any type of support, about an identified and identifiable natural person. Identifiable is regarded as a set of information that may lead to the identification of a specific person, namely by reference to an identifier (such as an identification number or location information).
From whom do we collect personal data?
In keeping with its duties, AICEP processes data mostly from legal persons (companies and associations). However, to carry out its duties, it may collect and process data about the following types of natural persons (non-comprehensive list):
- Clients/investors and respective personnel;
- Service providers and respective personnel;
- Candidates to and trainees in the INOV Contacto programme;
- Candidates to and clients of programmes promoted by AICEP;
- Participants in events promoted by AICEP;
- Visitors to the AICEP premises.
What personal data do we process and how do we collect it?
AICEP only collects data that is deemed to be suitable, relevant and restricted to what is necessary for the purposes for which it is processed.
Your data may be collected verbally, in writing (namely through forms and contracts), and through the AICEP website. Generally, we collect your data directly, although personal data may also be collected from public sources (such as websites and official public lists), and from incentive management entities.
To fulfil the various purposes, we may collect the following types of personal data:
- identification data (such as name, place of birth, citizen card number or date of birth);
- contact data (such as mobile telephone number, postal address or email);
- education and professional status data (such as education level and CV);
- banking, financial and transactions data (such as IBAN or VAT identification number);
- location data (such as IP address);
- recorded images of events or videoconferences;
- images collected through video surveillance systems.
As a rule, AICEP does not collect special data, such as health data or data about administrative offences or criminal acts.
4. Grounds for and Purposes of Processing Personal Data
Porquê e com que fundamento utilizamos os seus dados pessoais?
All data collected and processed by AICEP is based on one of the following conditions of legitimacy:
Consent
When the collection is preceded by your express, specific and informed consent through a written statement or via web.
We obtain your consent, for example, for purposes related with enrolment in the INOV Contacto programme, for subscription to newsletters or enrolment in actions promoted by AICEP.
Contract conclusion or pre-contractual diligences
When data processing is necessary for concluding a contract to which you are a party or for pre-contractual diligences.
This condition will be fulfilled when we process your data for the management of financing and cooperation programmes and protocols or supply and service contracts.
Compliance with legal obligations
When data processing is necessary for fulfilling a legal obligation.
This includes, for example, communication of data to other public (national and EU), fiscal or judicial
bodies.
Of public interest
When data processing is necessary for performing duties of a public interest.
Since AICEP is a public body, duties of which regard mostly missions that include assistance to investment by companies in Portugal and assistance to internationalisation of Portuguese companies, the said duties include data processing operations related with implementing EU programmes, involving the granting of incentives, and the management of the relation with associations in the different sectors with which the companies are involved.
The legitimate interest
When data processing is deemed necessary to fulfil the legitimate interests of the entity responsible for the processing, or interests of third parties, without prejudice to the rights and liberties of its clients and/or users.
This includes all data processing resulting from duties assigned by law, namely internal and external dissemination of Portuguese entities both in Portugal and abroad.
For what purposes do we collect your data?
Personal data collected by AICEP will be processed only for specific, explicit and legitimate purposes.
Whenever personal data is collected, it will be used exclusively for the purposes expressly identified at the time of collection. We will now list the main purposes justifying the collection of personal data by AICEP:
- Internal and external dissemination of Portuguese entities;
- Contracting and management of financial and cooperation programmes and protocols;
- Management of the INOV Contacto programme;
- Management of events promoted by AICEP;
- Setting up supply and service contracts;
- Dissemination of newsletters/publications;
- Physical security of premises and persons.
5. Period during which personal data will be stored
AICEP processes and stores your data only during the period deemed necessary for carrying out or completing the processing purposes for which the data was collected, in compliance with the maximum periods necessary to fulfil contractual, legal or regulatory obligations.
Generally, and whilst a contract exists legitimising the processing of your data, AICEP will maintain the said data whilst that contractual relation is maintained. There are other circumstances, such as fulfilment of legal or regulatory obligations (for example, in compliance with fiscal obligations, personal data regarding invoicing must be kept for a maximum period of ten years as of the occurrence of the act), and whilst a judicial process remains pending, which may legitimise that your data be stored for a longer period.
At the end of the storage period, AICEP will eliminate the said data.
6. Rights of data subjects
Within the terms of the applicable law, as of the time when we collect and process your data, there are a number of rights that you may exercise at AICEP whenever you wish.
What are your rights?
Right of access
Right to obtain information about the processing of your data and its respective characteristics (namely the type of data, processing purpose, to whom your data may be communicated,
storage periods and which type of data supply is mandatory or optional).
Right to rectification
A right enabling you to request that your data be rectified, requesting that it be accurate and up to date, in situations when, for example, you consider that the data is incomplete or out of date.
Right to erasure or "Right to be forgotten"
Right enabling you to request the erasure of your personal data, when you deem that there are no valid grounds for maintaining the data and provided there are no other valid grounds to legitimize that data processing (such as a contract conclusion or compliance with a legal or regulatory obligation).
Right to Restriction of processing
A right enabling you to suspend the processing or to restrict processing to certain categories of data or purposes.
Right to Data Portability
Right through which you may request that your data be sent in a currently used digital format, making it possible to re-use the said data. As an alternative, you may request that your data be transferred to another entity that will become responsible for processing your data.
Right to Object
Right allowing you to oppose certain purposes and provided there are no legitimate interests prevailing over your interests. One of the examples of this right regards the opposition to direct marketing purposes.
Right to Withdraw Consent
Right enabling you to withdraw your consent, but that may be exercised only when your consent is the only condition of legitimacy.
How can you exercise your rights?
All rights described above may be exercised, with the limitations stipulated in the applicable legislation, by submitting a written request in our form.
Similarly, you may submit questions related with the processing of your data, directly to the Data Protection Officer to the email indicated in point 2.
You may also submit any complaint to Autoridade Nacional de Controlo.
7. Data transmission
With whom do we share your personal data?
Due to the duties of AICEP, and depending on the respective purpose, your data may be shared with third-party entities, which include national and international public entities and private entities to fulfil the legal, regulatory or contractual obligations or duties of a public interest.
Your data may also be accessed by service providers contracted by AICEP, deemed as necessary to fulfil the aforementioned purposes, namely in regards to information security and archiving services. AICEP guarantees that it relies only on service providers that have proven to provide guarantees of carrying out technical and organisational measures necessary and adequate for protecting your personal data.
Personal data transfers outside the EEA
AICEP may exceptionally transfer your personal data to third countries (outside the EEA – European Economic Area).
In those cases, AICEP will ensure that the data transfers will be performed in strict compliance with the applicable legal standards.
8. Legislation
The processing of personal user and client data by AICEP, and the sending of commercial communications through electronic means are compliant with the applicable national and EU legislation, namely with the General Data Protection Regulation.
