In the context of registration and access to the website, O FRASCO, as the data controller, may request the User to provide their personal data, that is, information provided by the User that allows O FRASCO to identify and/or contact them (“Personal Data”).
As a rule, Personal Data is requested when the User visits our website or wishes to contact us through the form provided for that purpose.
In the context of processing the User’s Data, O FRASCO uses or may use third-party entities, subcontracted by it, to process the User’s Data on behalf of O FRASCO and in accordance with its instructions, in strict compliance with the provisions of the law and this Privacy Policy.
These subcontracted entities may not transfer the User’s Data to other entities without prior written authorization from O FRASCO, and are also prohibited from contracting other entities without prior authorization from O FRASCO.
O FRASCO undertakes to subcontract only entities that provide sufficient guarantees of implementing appropriate technical and organizational measures to safeguard the User’s rights. All entities subcontracted by O FRASCO are bound to the latter through a written contract that regulates, in particular, the subject and duration of the processing, the nature and purpose of the processing, the type of personal data, the categories of data subjects, and the rights and obligations of the parties.
In terms of general principles relating to the processing of personal data, O FRASCO undertakes to ensure that the User’s Data it processes is:
• Subject to lawful, fair and transparent processing in relation to the User;
• Collected for specified, explicit and legitimate purposes, and not further processed in a manner incompatible with those purposes;
• Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
• Accurate and, where necessary, kept up to date, with all reasonable measures taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;
• Kept in a form which permits identification of the User for no longer than is necessary for the purposes for which the data are processed;
• Processed in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures.
The data processing carried out by O FRASCO is lawful when the User has given explicit consent to the processing of their Personal Data for one or more specific purposes, when the processing is necessary for the performance of a contract to which the User is a party or for pre-contractual steps taken at the User’s request, for compliance with a legal obligation to which O FRASCO is subject, and for the legitimate interests pursued by O FRASCO or by third parties.
O FRASCO undertakes to ensure that the processing of the User’s Data is only carried out under the conditions listed above and with respect for the principles mentioned above.
When the processing of the User’s Data is carried out by O FRASCO based on the User’s consent, the User has the right to withdraw their consent at any time. The withdrawal of consent, however, does not compromise the lawfulness of the processing carried out by O FRASCO based on the consent previously given by the User.
To ensure the security of the User’s Data and maximum confidentiality, we treat the information you have provided us with absolute confidentiality, in accordance with our internal security and confidentiality policies and procedures, which are updated periodically as needs arise, as well as in accordance with the legally provided terms and conditions.
Depending on the nature, scope, context and purposes of the data processing, as well as the risks arising from the processing for the rights and freedoms of the User, O FRASCO undertakes to implement, both at the time of defining the means of processing and at the time of the actual processing, the necessary and appropriate technical and organizational measures to protect the User’s Data and to comply with legal requirements. It also undertakes to ensure that, by default, only the data necessary for each specific purpose of the processing are processed and that such data are not made available without human intervention to an indeterminate number of persons.
In certain types of processing, the personal data collected by O FRASCO may be made available to third parties, which may involve their transfer outside the European Union. In such cases, O FRASCO undertakes to ensure that the transfer complies with applicable legal provisions, particularly regarding the determination of the adequacy of such country in respect of data protection and the requirements applicable to such transfers.
The right of access, the right of rectification, the right of erasure, the right to restriction, the right to portability and the right to object may be exercised by the User by contacting us via e-mail or at the address Rua das Amoreiras, n.o 97 a 99, 1250-022 Lisboa.
O FRASCO will respond in writing (preferably by electronic means) to the User’s request within a maximum period of one month from the receipt of the request, except in cases of particular complexity, where this period may be extended by up to two months.
The Website may contain links to third-party websites or portals. O FRASCO is not responsible for the privacy practices of such websites or portals. We therefore recommend that you read their respective privacy statements. O FRASCO cannot be held responsible nor liable for the content and activities of such websites or portals.
In the future, we may choose to modify or update this policy, either due to changes in legislation or to encompass new developments on the Internet. Therefore, we reserve the right to make any changes in this regard and ask that you visit our website regularly, as such changes may affect you as a User.
The Privacy Policy, as well as the collection, processing or transmission of User Data, are governed by the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 and by the legislation and regulations applicable in Portugal.
