Personal Data Protection Policy

TABLE OF CONTENTS

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

SECTION I – INTRODUCTION

1. OUR COMMITMENT

2. YOUR PERSONAL DATA CONTROLLER

3. WHAT ARE PERSONAL DATA?

SECTION II – PROCESSING THE CUSTOMERS’ PERSONAL DATA

1. CUSTOMERS’ PERSONAL DATA SUBJECT TO PROCESSING

2. PURPOSES OF THE COLLECTION OF THE CUSTOMERS’ PERSONAL DATA

3. LEGAL GROUNDS FOR THE PROCESSING OF THE CUSTOMERS' PERSONAL DATA
 

SECTION III – PROCESSING OF EMPLOYEES’ PERSONAL DATA

1. EMPLOYEES’ PERSONAL DATA SUBJECT TO PROCESSING

2. PURPOSES FOR THE COLLECTION OF AND LEGAL GROUNDS FOR THE PROCESSING OF THE EMPLOYEES’ PERSONAL DATA

3. INTERNATIONAL TRANSFERS OF EMPLOYEES’ PERSONAL DATA
 

SECTION IV – PROCESSING OF PARTNERS’ PERSONAL DATA 
          

SECTION V – GENERAL PROVISIONS

1. STORAGE PERIOD

2. RIGHTS OF THE DATA SUBJECTS

3. SECURITY MEASURES ADOPTED

4. COMMUNICATION OF THE DATA TO THIRD-PARTY ENTITIES

5. FOR MORE INFORMATION

6. AMENDMENTS TO THE PERSONAL DATA PROTECTION POLICY

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

SECTION I – INTRODUCTION

The Manuel Champalimaud Group (i.e., the group of companies directly or indirectly held by Manuel Champalimaud SGPS S.A.) needs to collect certain personal data of its customers when supplying its goods and services. Moreover, the increasingly frequent interaction with websites (hereinafter “Site” or “Sites”) users also requires, in some instances, (i) the collection of personal information of the users (so that they can use certain contents, features or services of the Sites and enjoy the products and services), and (ii) the collection of their device’s data (using cookies) to improve Site performance and browsing.    

Additionally, the Manuel Champalimaud Group collects and processes personal data of its employees within the context of the employment relationship in place, and of the employees of any contractors and/or suppliers of the Manuel Champalimaud Group representing those entities or assigned to the provision of the services, strictly as required for the latter’s performance (“Partners’ Employees”).

In that sense, this Personal Data Protection Policy (hereinafter “Policy”) seeks to help our clients and Site users (hereinafter jointly referred to as “Customers”), our Employees and our Partners’ Employees understand which personal data we collect, how and why we use them, to whom we disclose the data and how we protect their privacy within the context of each individual relationship in place.
 

1. OUR COMMITTMENT

The Manuel Champalimaud Group is committed to protecting the safety and privacy of the data subjects whose data it processes. The Manuel Champalimaud Group has therefore prepared this Policy to uphold its commitment and abide by the privacy and personal data protection rules.

1 For the purposes of this Policy, the term “Employees” shall be interpreted so as to include both employees under an employment agreement and contractors, where applicable. Under certain circumstances, this Policy shall further apply to the processing of information of family members, dependents, beneficiaries and other persons with a relevant relationship with employees or former employees of Manuel Champalimaud, whose data we collect in accordance with or as a result of the relationship between those parties and any current or former employee of Manuel Champalimaud.

We want our Customers, Employees and our Partners’ Employees to know our general privacy rules and the terms and conditions for processing any data we collect, in strict compliance with and abidance by the applicable legislation, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the “General Data Protection Regulation”).

The Manuel Champalimaud Group tries to abide by the best personal data security and protection practices, promoting actions and improving systems in order to ensure the protection of the data provided by the relevant data subjects.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

(1) The direct or indirect provision of the data by the relevant data subjects requires them to have knowledge of and agree to the terms and conditions of this Policy and of any other terms, policies and specific conditions applicable to the relationship with the data subjects. When they provide their personal data, data subjects are in effect authorizing their collection, processing, use and disclosure in accordance with the rules established herein. 

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

2. YOUR PERSONAL DATA CONTROLLER

Any references in this Personal Data Protection Policy to the “Manuel Champalimaud Group”, “we/us” or “our/ours” shall be references to the company of the Manuel Champalimaud Group which, as applicable, establishes the contractual relationship, markets products and/or supplies services, and the company that provides access to the websites and, as appropriate, that determines the purposes and means for processing the data. This company shall consequently be deemed to be the data controller, pursuant to the General Data Protection Regulation. The identification of each data controller shall be provided to the data subjects upon collection of their personal data.
 

3. WHAT ARE PERSONAL DATA?

Personal data are defined as any information on an identified or identifiable natural person (data subject), regardless of its nature and medium, including sound and image. A person is deemed to be identifiable if they can be directly or indirectly identified, namely by reference to an ID number or more specific information on their physical, physiological, psychic, economic, cultural or social identity.
 

SECTION II – PROCESSING OF THE CUSTOMERS’ PERSONAL DATA

The Manuel Champalimaud Group collects and processes the personal data required for the Manuel Champalimaud Group to supply goods and services and subsequently to manage the contractual relationship with the Customers, as well as any personal data that may prove required to access the Sites, their contents, features or services. Additionally, Customers’ data may be collected by any suppliers providing them services on behalf of the Manuel Champalimaud Group and by any other partners or third parties acting on behalf of the Group, as set out below in the “communication of data to other entities” section.
 

1. CUSTOMERS’ PERSONAL DATA SUBJECT TO PROCESSING

2. PURPOSES OF THE COLLECTION OF THE CUSTOMERS’ PERSONAL DATA

As a rule, Customers’ personal data are used to supply products, and to provide and manage the services hired.

The Customers’ personal data collected directly or through Sites are specifically processed for Site management purposes, in order to enable Customers to use the Site’s features, including filling out forms.  The data are further processed by the Manuel Champalimaud Group in this context for purposes of Customers’ communications, including to reply to information and clarification requests, complaints, comments and/or suggestions. 

Any personal data collected shall be processed on the terms and for the purposes set out herein and, in certain instances, to comply with our legal obligations.

As such, we use the Customers’ personal data for the following purposes:

• To supply products and services

The above information shall be used to supply goods and services, particularly to ensure the delivery of the products and the management of the activities developed, to manage and organize corporate events and to supply ancillary services.

• To communicate and manage the relationship with Customers

Customers may on occasion be contacted by telephone, email and/or SMS, for administrative or operational reasons. The Customers’ personal data shall be further used to reply to their requests, suggestions or contacts, to improve the services provided and their experience as Customers of the Manuel Champalimaud Group.

• To inform Customers of news and offers of interest to them

Customers may be sent marketing communications, advertisements of products and services of the Manuel Champalimaud Group and newsletters, should they have indicated their wish to receive them.

Such communications may be made through any communication channel, including email, SMS or any other forms of automated call.

Should Customers not wish to receive any further marketing communications or newsletters of the Manuel Champalimaud Group, they only need to notify the Manuel Champalimaud Group in accordance by calling 21 3500850 or sending an email to privacidade@manuelchampalimaud.pt.

• To customize and improve the Customers’ experience

The Customers’ personal data may be used to bring the services provided in line with each Customer’s needs and preferences and to provide our Customers with a customized experience. If the Customer agrees to the Manuel Champalimaud Group using their consumption data, such profile data (which shall not be shared with third parties) will enable the Manuel Champalimaud Group to know the Customers better and to offer them the campaigns, promotions, advantages and products that are better suited to and fit their profile. Consequently, the Customer’s profile shall be created and developed for each promotional action in accordance with the use and frequency of their consumption in order to adjust the relevant action to their interests.

Information may also be collected on how Customers use the Sites and the products they purchase, in order to understand their likes and preferences. Such information may be used to tailor the content and offers that the Customers see on the Sites and to send the Customers messages in their interest, subject to them having agreed to receive marketing communications. 

• To improve the services to be provided and meet the administrative and commercial goals of the Manuel Champalimaud Group

The Customers’ information may also be used for purposes of accounting, billing and audit, checking credit cards or other, fraud analysis, security, legal and procedural purposes, statistical surveys and of developing and maintaining systems.

• To comply with the legal obligations of the Manuel Champalimaud Group

The Customers’ personal data may be provided to Social Security, Compensation Funds, Trade Unions, Health Insurance Funds, Pension Funds, Insurers, Health Subsystems, Courts, Paralegals (within the context of enforcement proceedings), the Tax and Customs Authority, the Labor Conditions Authority and any other proper public entities with jurisdiction over the economic sectors where the Manuel Champalimaud Group develops its business, in order to comply with legal obligations.
 

3. LEGAL GROUNDS FOR THE PROCESSING OF THE CUSTOMERS' PERSONAL DATA

The Customers’ personal data shall only be processed if the processing is lawful, i.e., only in the following events, pursuant to the applicable laws:

The Customer consented to the processing;

The processing is required to:

Perform any contract to which the Customer is a party or for any pre-contractual measures at the Customer's request;

Comply with a legal obligation imposed on the Manuel Champalimaud Group;

Pursue the lawful interests of the Manuel Champalimaud Group or of any third parties.
 

SECTION III – PROCESSING OF EMPLOYEES’ PERSONAL DATA

As the controller for the personal data of its Employees, the Manuel Champalimaud Group processes the data required for purposes of human resource management, including data collected within the context of recruitment processes or unsolicited applications. Personal data effectively collected may vary in accordance with the employee’s and/or the applicant's status, as well as with the nature of the position and the duties performed.
 

1. EMPLOYEES’ PERSONAL DATA SUBJECT TO PROCESSING

As part of regular human resources’ activities, the Manuel Champalimaud Group may collect the following categories of personal data, among others:

Contact information, such as name, address, phone numbers (landline and mobile), email address and emergency contact:

• Gender, date of birth and marital status;
• Place of birth and nationality;
• Social security number, taxpayer ID number, passport and national ID number, as well as a copy of the citizen card (subject to consent);
• Bank account information;
• Residence permit / work visa status and information concerning any immigration/emigration process (where applicable);
• Employment history, academic qualifications, professional and academic certificates, references and letters of recommendation;
• Date of hiring, job title/position, department, work-related contact details, date(s) of promotion, professional background, technical skills and training courses attended;
• Salary, bonus, long-term incentives and history of bonuses granted;
• Working hours (if applicable);
• Sick pay, records of absences from work, leave entitlement and respective scheduling, performance evaluations, attendance, disciplinary procedures and grievances;
• Fit/unfit for work;
• Usernames for computer systems;
• Electronic content produced or received by the employee using the Manuel Champalimaud Group’s computer equipment and systems, pursuant to the Internal Policy on the Use of Electronic Resources, including emails and other electronic communications transmitted or received by using the Manuel Champalimaud Group’s computer systems;
• Time and duration of any phone calls made from a telephone of the Manuel Champalimaud Group and phone number called; 
• Information on pensions, insurance and other information concerning benefits (that may include information on spouses, children and other eligible dependents and beneficiaries – such as name, date of birth, address, telephone/mobile number of any household members);
• Information on Via Verde (ETC system) consumptions (specifying the relevant toll booths) and fuel card consumptions (subject to consent);
• Date of termination or expiry of the employment contract, reason for termination or expiry and any other information concerning the termination of the contract;
• Information collected by security systems, including access control systems using biometric data and CCTV systems;
• Information concerning the number of the driver’s license and license plate, if applicable; and
• Images captured on film or photography.

Additionally, certain special categories of personal data may be processed if such information is required to exercise the rights of, or comply with any obligations imposed on, the Manuel Champalimaud Group, which may include: 

• Information on health restrictions, special needs and other specific workplace accommodations due to a medical condition;
• If permitted by law and adequate as concerns the employee’s duties, criminal record and drug and alcohol tests, or other adequate screening procedures.
   

2. PURPOSES FOR THE COLLECTION OF AND LEGAL GROUNDS FOR THE PROCESSING OF EMPLOYEES’ PERSONAL DATA

As the data controller for its Employees’ personal data, the Manuel Champalimaud Group processes such data pursuant to applicable legislation, for different purposes and based on different legal grounds:

i. Management of the contractual relationship and pre-contractual measures

• Staff management, including mobility, recruitment and unsolicited applications, training and development, performance management and evaluation and strategic planning, hiring and termination of employment, and talent management;
• Payroll processing, compensation and benefit planning, and disciplinary sanction management;
• Management of work tools (such as car fleet and mobile phones).

ii. Compliance with legal obligations

• Compliance with legal obligations, in particular with regard to occupational medicine, management and maintenance of workers’ compensation plans/insurance and management of workplace accident processes;
• Planning and management of taxes, insurance and pensions;
• Dispute resolution, internal investigations and enquiries, audits, compliance and risk management;
• Compliance with record keeping and reporting obligations to the supervisory authority;
• Compliance with court and administrative/supervisory authority orders concerning certain Employees; and
• Exercise of the right of defense in legal proceedings.

iii. Legal interests

• Physical access control and facility security;
• Management and use of internal social and collaborative platforms;
• Carrying out Employee Surveys and other similar Human Resources initiatives to assess Employee involvement;
• Time and attendance control;
• Control of electronic communication means, as defined in the Internal Policy on the Use of Electronic Resources and to the extent necessary for the implementation of good human and material resources management practices, so as not to affect the scope or exercise of the Employees’ fundamental rights and freedoms.

iii. Data subjects’ consent

Subject to the data subjects’ consent and strictly to te extent necessary, the Manuel Champalimaud Group also processes the personal data of its Employees and their relatives for the following purposes:

• granting benefits (such as Via Verde (ETC system), fuel cards or education tickets);
• subscription and management of life and health insurance (to the extent that the insurance coverage exceeds the coverage required by law);
• participation in quizzes or contests organized by the Manuel Champalimaud Group (including sending any related communications materials); and
• collection and filing of a copy of the citizen card.

For more information or questions on how the Manuel Champalimaud Group processes its Employees’ personal data, employees may contact Human Resources by sending an email to rh@manuelchampalimaud.pt  or calling 213500718.
 

3. INTERNATIONAL TRANSFERS OF EMPLOYEES’ PERSONAL DATA

The Manuel Champalimaud Group may transfer personal data of its Employees to third countries (outside the European Union or the European Economic Area) for the purposes set out in this Policy, for which there is no adequacy decision taken by the European Commission. In such instances, the Manuel Champalimaud Group undertakes to adopt the appropriate security measures to ensure the confidentiality and protection of its Employees’ personal data, pursuant to the applicable personal data protection laws.
 

SECTION IV – PROCESSING OF PARTNERS’ PERSONAL DATA

The Manuel Champalimaud Group receives personal data of the legal representatives and employees of the Partners ("Partners' Employees”) (such as name, taxpayer ID number, identification document, date of birth, academic qualifications and professional training) pursuant to the contractual relationship in place. Such data are received by the Manuel Champalimaud Group and processed for specific purposes in connection with the supplies and/or provision of the services hired, including to manage the contractual relationship, control access to its facilities and check the training and skills for the provision of the services.

In those instances, the Manuel Champalimaud Group shall require the Partners to warrant that they are authorized to share the data of their legal representatives and employees with the Manuel Champalimaud Group, who shall process the data confidentially and solely for the purposes set out above, for the management of the agreement and/or for any legal interests of the data controller.
 

SECTION V – GENERAL PROVISIONS

1. STORAGE PERIOD

The period during which data is stored and retained varies according to the purpose for which the information is used. There are however legal requirements imposing an obligation to store the data for a certain period. Consequently, where there is no specific legal requirement, data shall be stored and retained only for the time necessary for the purposes for which they were collected, as identified above.

2. RIGHTS OF THE DATA SUBJECTS

Pursuant to the law, data subjects may at any time exercise their rights in connection with their personal data:

• Right of Access, i.e., the right to obtain the Manuel Champalimaud Group’s confirmation whether their personal data are subject to processing or not and the right of access to those data and any related information;
• Right to Rectification, namely the right to obtain from the Manuel Champalimaud Group rectification of any inaccurate personal data, and the right to complete any incomplete personal data;
• Right to erasure, which means that data subjects are entitled to request the erasure of their data in certain cases, including without limitation, where the personal data are no longer necessary for the purpose for which they were collected or processed, or where the data subject withdraws their consent, where the processing of the data is based on it, among other things;
• Right to Portability, i.e., in certain cases data subjects may request, in connection with their personal data previously provided to the Manuel Champalimaud Group, that such data are transmitted to them in a structured, commonly used and machine-readable form, including the right to transmit such data to another controller;
• Right to Restriction of Processing, which includes the right to request the restriction of processing of the data subject’s personal data in certain instances, notably where the processing is unlawful and the data subject objects to the erasure of the data, requesting instead the restriction to their processing, or if the Manuel Champalimaud Group no longer requires the personal data for processing purposes, but requires them for the purposes of, among others, declaration, exercise or defense of a right in a legal proceeding;
• Right to Object, i.e., the right of the data subject to object to the processing of his or her data, on grounds relating to his or her particular situation, and in cases where (i) the data are processed for the purposes of the legitimate interests pursued by the Manuel Champalimaud Group or by third parties, (ii) they are processed for purposes other than those for which the data were collected, without the consent of the data subject having been obtained or without such processing being based on provisions of Union or Member State law, (iii) personal data are processed for the purposes of direct marketing, or (iii) personal data are processed for scientific research or historical or statistical purposes.

Data subjects may exercise the above rights by means of a written request addressed and sent to privacidade@manuelchampalimaud.pt  or to Avenida Duque de Ávila, n.º 79, 1000 – 139 Lisboa.

Data subjects are also entitled under the law to withdraw their consent to the processing of data for which their consent is the legal ground of the processing.

Data subjects are therefore entitled to withdraw their consent at any time. However, this does not affect any processing carried out until such date based on any consent previously provided.

Without prejudice to any administrative or judicial appeal available, data subjects are entitled to file a complaint with the CNPD (National Data Protection Commission) or any other legally proper supervising authority, if they believe that their data is not being lawfully processed by the Manuel Champalimaud Group, pursuant to the applicable laws and this Policy.
 

3. SECURITY MEASURES ADOPTED

The Manuel Champalimaud Group is committed to ensuring the confidentiality, protection and security of the personal data of its Customers, Employees and its Partners’ Employees by implementing technical and organizational measures adequate to protect their data against any undue or unlawful processing and against any accidental loss or destruction.

To this end, it develops its business using systems designed to ensure the security of the personal data processed, creating and updating procedures to prevent unauthorized access, accidental loss and/or destruction of personal data, and undertakes to abide by the personal data protection legislation and to process such data only for the purposes for which they were collected, as well as to ensure that such data are processed with appropriate levels of security and confidentiality.
 

4. COMMUNICATION OF THE DATA TO THIRD-PARTY ENTITIES

The Manuel Champalimaud Group hires other entities for the provision of certain services. Such provision of services could entail access by those entities to the personal data it processes.

Consequently, any processor of the Manuel Champalimaud Group shall process the personal data of Customers, Employees and Partners’ Employees in the name and on behalf of the Manuel Champalimaud Group and must strictly abide by our instructions.

Such entities include partners or suppliers of goods and providers of services, including members of the Manuel Champalimaud Group, credit institutions, accounting firms, consulting firms, training firms, security services companies, occupational hygiene and health, real estate or access control managers, IT systems and IT platforms maintenance companies, among others. 

In certain situations, the personal data of Customers, Employees and Partners' Employees may also be transmitted to third parties when such data communications are necessary or appropriate (i) under applicable law, (ii) to comply with legal obligations/court orders, (iii) as a result of a determination by the National Data Protection Commission or other proper supervisory authority, or (iv) to reply to requests from public or governmental authorities.

In any of the above situations, the Manuel Champalimaud Group undertakes to take reasonable measures to ensure the effective protection of the personal data it processes.
 

5. FOR MORE INFORMATION

For more information on the processing of personal data and for any questions concerning the exercise of the rights vested in the data subjects by the applicable laws, in particular as set out in this Policy, please contact:

Telephone: 213500850

E-mail: privacidade@manuelchampalimaud.pt
 

6. AMENDMENTS TO THE PERSONAL DATA PROTECTION POLICY

This Personal Data Protection Policy may be amended from time to time. Such amendments shall be published on the Sites and, if they entail a substantial change in the way the data is processed, communicated directly to the data subjects to the contact details provided by them.
 

Last updated on: 07.06.2019