1. The AICEP Portugal Global commitment

AICEP Portugal Global, Agency for Investment and Foreign Trade of Portugal, E.P.E. (hereinafter AICEP), ensures in its personal data policy, the protection of all data that it collects daily and with efficiency and security.

Please read this Privacy Policy which describes how we treat your personal data and how you can exercise your rights as a holder of personal data processed by 
AICEP.

2. Data protection officer

Within the scope of its activities and duties, AICEP is the entity responsible for the collection and processing of personal data, which is processed and stored in an automated and non-automated way.

AICEP has a Data Protection Officer, who can be contacted via e-mail dpo@portugalglobal.pt.

The Data Protection Officer is responsible for monitoring the compliance of activities involving the processing of data with the applicable legal and regulatory rules. It is also the point of contact between AICEP and the National Supervisory Authority, as well as between AICEP and its customers and users in matters relating to the processing of personal data.

3. Personal Data, personal data holders, and personal data categories

What is personal data?

Personal data is all information of any nature, collected on any type of support, relating to an identified or identifiable person. The set of information that can lead to the identification of a specific person (such as an identification number or location data) is considered identifiable.

From whom do we collect personal data?

Given AICEP’s duties, most of the data are processed by legal entities (companies and associations). However, data from the following types of people can be collected and processed:

• Customers/investors and their employees;

• Service providers and their employees;

• Candidates and interns of the INOV Contacto program;

• Applicants and clients of programs promoted by AICEP;

• Participants in events promoted by AICEP;

• Visitors to AICEP facilities.

What personal data do we process and how do we collect it?

AICEP only collects data that is appropriate, relevant, and limited to what is necessary for relation to the purposes for which they are processed.

The collection of your data can be done orally, in writing (namely through forms and contracts), as well as through the AICEP website. As a general rule, we collect your data directly, and personal data may also be collected through public sources (such as internet sites and official public lists), as well as incentive management entities.

For the execution of different purposes, we may collect the following types of personal data:

• identification data (such as name, place of birth, citizen’s card, or date of birth);

• contact details (such as mobile phone, address, or e-mail);

• qualification and professional status data (such as education level and CV);

• bank, financial, and transaction details (such as account number or tax identification number);

• location data (such as IP address);

• images of recording events or videoconferences;

• images collected through video surveillance systems.

AICEP does not collect any special data, such as health data or data relating to criminal offenses or crimes.

4. Purposes of the Collection of Personal Data

Why and on what basis do we use your personal data?

All data collected and processed by AICEP are based on one of the following conditions of the law.

• Consent: When the collection is preceded by your express, specific, and informed consent, through written support or via the web:

We collect your consent, for example, for purposes related to signing up for the INOV Contacto program, subscribing to newsletters, or signing up for actions promoted by AICEP.

• Execution of contracts or pre-contractual steps: when treatment is necessary for the execution of a contract to which it is a party or the pre-contractual stages:

This condition will be fulfilled when we process your data to manage financing and cooperation programs and protocols or supply and service contracts.

• Compliance with legal obligations: when data collection is necessary to comply with a legal obligation:

This includes, for example, the communication of data with other public services (national and community), tax, or judicial.

• The public interest: when data collection is necessary for the exercise of public interest functions:

As AICEP is a public entity, whose duties mostly refer to missions that include supporting investment by companies in Portugal and supporting the internationalization of Portuguese companies, here are included treatments related to the implementation of community programs, with incentives, as well as the management of the relationship with the sectoral associations with which the companies are related.

• Legitimate interest: when data collection is necessary for the pursuit of legitimate interests of the entity responsible for the processing or of third parties, without prejudice to the rights and freedoms of its customers/users:

This includes all data processing that results from attributions conferred by law, namely the internal and external disclosure of Portuguese entities, at national and international levels.

What are the purposes for which we collect your data?

Personal data collected by AICEP are only collected for specific, explicit, and legitimate purposes. Whenever personal data are collected, they are exclusively for the purposes expressly identified at the time of collection.

Here we list the main purposes that justify the collection of personal data by AICEP:

• Internal and external disclosure of Portuguese entities;

• Contracting and management of financing and cooperation programs and protocols;

• Management of the INOV Contacto program;

• Management of events promoted by AICEP;

• Contracting supply and service contracts;

• Disclosure of newsletters/publications;

• Physical Security of Facilities and People.

5. Period of retention of personal data

AICEP treats and retains your data only for as long as it is necessary to pursue or complete the purposes of the processing for which it is intended, with due regard for the maximum time required to comply with contractual, legal, or regulatory obligations.

Other circumstances exist, such as the fulfillment of legal or regulatory obligations (for example, to comply with tax obligations, personal data related to billing must be kept for a maximum period of ten years from the practice of the act), as well as the pending a lawsuit, which may legitimize your data to be kept for a longer period of time. After the retention period, AICEP will proceed with the elimination of said data.

6. Rights of data subjects

What are your rights?

Right of access: right that allows you to obtain information regarding the processing of your data and its characteristics (namely the type of data, the purpose of the treatment, to whom your data may be communicated, retention periods, and what data you have to mandatory or optional).

Right of rectification: right that allows you to request the rectification of your data, requiring that they be accurate, for example, when you consider that they are incomplete or out of date.

Right to delete data or “Right to be forgotten”: right that allows you to request the deletion of your data when you consider that there are no valid grounds for the conservation of data and provided that there is no other valid ground that legitimizes such treatment (as the performance of a contract or compliance with a legal or regulatory obligation).

Right to Limitation: right that allows you to suspend collection or limit treatment to certain categories of data or purposes.

Right to Portability: right through which you can request the sending of your data, in digital format, and in current use, which allows the reuse of such data. Alternatively, you can request the transmission of your data to another entity that becomes responsible for the processing of your data.

Right of Opposition: right that allows you to oppose certain purposes and as long as there are no legitimate interests that prevail over your interests. One example of this right concerns opposition to the purposes of direct marketing (marketing).

Right to Withdraw Consent: a right that allows you to withdraw your consent, but that can only be exercised when your consent is the only condition of legitimacy.

How can you exercise your rights?

All of the rights described above apply to the limitations provided by law, upon written request.

In the same way, you can send questions related to the collection of your data, directly to the Data Protection Officer, through the email indicated in point 2.

7. Data transmission

With whom do we share your personal data?

Given AICEP’s duties, and depending on the respective purpose, your data may be shared with third parties, which include national and international public bodies and private entities to comply with legal or regulatory, contractual obligations, or functions of interest. public.

Your data may also be accessed by AICEP service providers, considered necessary for the performance of the purposes described above, namely about information security and archiving services. AICEP guarantees that it only uses service providers that present the guarantees of execution of necessary and adequate technical and organizational measures to protect your personal data.

Transfers of personal data outside the EEA

AICEP may exceptionally transfer your personal data to third countries (outside the EEA – European Economic Area). In such cases, AICEP will ensure that data transfers are carried out in strict compliance with applicable legal rules.

8. Legislation

The collection of personal data from users and customers carried out by AICEP, as well as the sending of commercial communications carried out by electronic channels are under the Portuguese and international legislation in force, namely the General Data Protection Regulation.