Symington Family Estates Vinhos S.A., when processing data, is fully committed to protecting your privacy and your personal data.
At Symington Family Estates we know we have the legal duty to protect personal data that is processed by us, be it from users of our website, employees, service providers, suppliers or customers, and we comply with and enforce the terms of the Regulations Governing the Protection of General Data, dating from 27th of April 2016, concerning the protection of individuals with regard to the processing of personal data and the free circulation of said data (GDPR) and the respective national compliance legislation: Decree nº 58/2019, of 8th of August.
- Only authorized people use authorized data for authorized purposes;
- We understand that the safety of your data is a priority that we review periodically in line with technological innovation;
- We know that personal data does not belong to us, but to their holders;
- We promote good practices in the scope of Privacy, Data Protection and Information Security, which we continuously review because we understand that we are an integral part of a process of continuous improvement, where it is always possible to do more and better.
III. CONCEPTS AND INFORMATION — DATA HOLDER
1. What is personal data and its processing?
a) For the purposes of this Policy, we follow the definition adopted by the General Data Protection Regulation (GDPR), namely, any information related to an identified or identifiable person, being that a person is considered identifiable if one can be identified, direct or indirectly, namely by reference to an identification number or one or more specific elements of their physical, physiological, psychological, economic, cultural or social identity.
b) Likewise, processing is an operation or a set of operations undertaken on personal data or on a set of personal data, by automated or non-automated means, such as the collection, registration, organization, structuring, conservation, adaptation or alteration, recovery, consultation, usage, dissemination by transmission, diffusion or any other form of rendering it available, comparison or interconnection, limitation, deletion or destruction.
2. How does Symington Family Estates collect your personal data?
a) As part of our activity, we collect and process your personal data by various means, including by phone, in writing and when you contact us in person.
b) The data we collect are only those strictly necessary for the development of our activity and the provision of our services.
c) Symington Family Estates may use automated means to collect information about you, the devices you use and your interaction with our website. These automated means include tracking technology such as cookies and web server logs, which can collect information such as: IP address, access device, operating system, domain, website address and the address of the web page that brought you to our website.
3. Which personal data does Symington Family Estates collect?
a) The categories of data we collect, in order to provide our services to our clients, depend on the purpose pursued, namely the following, as applicable:
- Identification data (eg: name, civil identification number, birth date, nationality);
- Contact data (eg: mobile number, e-mail, address);
- Academic and Professional data (eg: school, academic career);
- Billing information (eg: NIF);
- IP addresses, operating system, access devices, language and other information (mentioned above) collected by cookies;
- Biometric data (fingerprint);
- Image, both because certain facilities that belong to Symington are under video surveillance (and we may capture your image), as well as for use on the intranet and activity documentation, among others.
b) The personal data which we collect are subject to computer processing and then stored in databases, strictly adhering to the legislation in force on Data Protection and the norms of Information Security.
c) We will only process your personal data for a specific purpose or purposes, determined at the time of collecting, not being subsequently processed in such a way that is not in line with the previously defined purpose/s, except for the finality of public interest archiving, scientific or historical research or additionally, for statistical purposes — when this is not deemed incompatible under the terms of GDPR.
d) Should we collect and process special categories of personal data (“sensitive data”), this processing will only be undertaken in accordance with the exceptions provided for in article 9º, nº2 of GDPR.
e) Given that the data is collected directly from its owner/holder and if the processing of the special categories of data (“sensitive data”) is carried out on the basis of consent, we will inform you of the right to withdraw consent, provided for in number 2, paragraph d) mentioned above, without, however, compromising the lawfulness of processing carried out on the basis of given prior consent.
4. For what purpose does Symington Family Estates collect your personal data?
4.1 We process your personal data for the following purposes:
a) To provide services and sell products to our customers;
b) To process and manage orders;
c) To book visits;
d) To provide information requested from us and to respond to requests sent to us;
e) To monitor, comply with or evaluate:
i) The terms and conditions of the website;
ii) Filing complaints;
iii) The safety of the website;
iv) To optimize the visit and the user experience and personalization of the website.
f) Management and observance of contractual relationships, such as:
i) Provision of contracted services;
ii) For billing and settlement of services provided;
iii) To communicate changes to the terms and conditions of contracted services.
g) To comply with legal obligations to which we are subject;
h) For the purpose of recruitment and selection;
i) To control access and to safeguard the security of the facilities;
j) To carry out statistical studies.
4.2 Depending on circumstances, the processing of your personal data can be carried out, with the following legal grounding:
i) Contractual execution or for pre-contractual steps at the request of the data owner/holder;
ii) Compliance with judicial obligations to which we are subject;
iii) The exercise of public interest functions or the exercise of public authority;
iv) Our legitimate interests;
v) The consent given by the data subject, when consent is the legal basis for processing;
vi) The defense of vital interests of the data owner/holder.
4.3 If you wish to withdraw your consent, you may contact us at [email protected]
5. For how long does Symington Family Estates keep your personal data?
a) The period during which the data is stored and preserved varies according to the purposes for which the information is processed.
b) There are legal requirements that oblige us to retain data for a minimum period, which we will respect.
c) In case there is no legal timeline for data preservation, the data will be stored and preserved only for the required minimum period for the purposes for which it was collected and subsequently processed, after which they will be appropriately managed, being destroyed or made anonymous.
6. What are your rights as a data owner/holder?
6.1 According to the provisions of the GDPR we guarantee the exercise of your rights as a data owner/holder, namely:
a) Right of access – you have the right to ask us, among other information, for information on whether your data is being processed, what data we process and for what purposes. Should you require it, we can provide you a copy of the personal data being processed, and the supply of other copies might be subject to the payment of a fee deemed reasonable, bearing in mind administrative costs. If the request is made via electronic format, and unless you indicate otherwise, the information will be provided by us in an electronic format in current use.
b) Right of Rectification – you have the right to, without undue delay, require us to rectify inaccurate personal data concerning yourself and to review and correct incomplete data as required.
c) Right of Cancellation – also termed: ‘right to be forgotten’ – you can request, under certain circumstances, that your personal data is deleted from our records, without undue delay, whenever one of the conditions foreseen in the GDPR exists.
d) Right of Opposition – the right to oppose, for reasons relating to your specific situation, certain types of data processing foreseen within the GDPR, such as data processing for the purpose of direct marketing, in which case we will cease data processing for that purpose.
e) Right to Portability – the right to transfer your personal data that is kept by us to another organization or to receive it in a structured and commonly use and automatic reading format.
f) Right to Limits of Processing – the right to have limits on the processing of your personal data, when you wish, for example, to contest the accuracy of your personal data during a period of time that allows us to verify its accuracy , when the processing is illegal or encroaches on your right of opposition.
g) Complaint – the data owner/holder also has the right to lodge a complaint to a supervisory authority, which in Portugal is the Comissão Nacional de Proteção de Dados (National Data Protection Commission).
6.3 After sending the email, the Data holder’s Form will be sent to you, for filling out and returned to us duly completed.
6.4 Within the legal period of 30 (thirty) days you will receive a duly substantiated communication from us.
7. What measures has Symington Family Estates implemented to ensure the safety of your personal data?
We adopt appropriate technical and organizational measures to ensure a level of security appropriate to the risk, which we periodically review and improve, aimed at guaranteeing the security and protection of your personal data in terms of their availability, integrity and confidentiality, as well as those aimed at preventing its loss, misuse, alteration, processing or unauthorized access, as well as any other form of illicit processing.
8. Does Symington Family Estates communicate your data to third parties?
8.1 In the scope of our activity we may use subcontracted parties to process your data on our behalf, which implies the access, by them, to that data, and when this happens we take the appropriate measures, contractually foreseen, in order to ensure that these subcontracted third parties, ensure sufficient and adequate guarantees of the execution of technical and organizational measures and that they will operate within the strict guidelines we set down.
8.2 We use subcontracted parties to provide the following services: security of installations, auditing, software supplying and shipping orders.
8.3 We may also share your personal data with third parties, in strict compliance with legal obligations or when we have obtained your consent to do so.
9. Does Symington Family Estates make international transfers of your personal data?
a) It may be that we are obliged to communicate your personal data to third countries or international organizations. In this case, we will strictly comply with the applicable legal provisions and submit the transfers to the appropriate mechanisms, depending on the level of protection of personal data guaranteed by the third country or the international organization concerned.
b) In particular, security issues pertaining to data transmission will be safeguarded, if the third parties are contractually bound and respect the confidentiality of the data received, and not using it in any way whatsoever for purposes other than those that motivated the transmission or for self -benefit or for the favouring of third parties.
10. How does Symington Family Estates use “cookies” on its websites?
To know more about cookies and how we use them on our website, please consult our Cookies Policy.
If you have any questions or concerns about the way we collect and process personal data you may contact us through the following contacts:
E-mail: [email protected]
Morada: Travessa Barão de Forrester 86, Apartado 26, 4431-901 Vila Nova de Gaia
b) After a change is published on our website, the user is bound by the new terms when browsing our website and whenever he or she interacts with us.