PRIVACY POLICY

      THE GENERAL PART

1. 1. COLLECTION AND PROCESSING OF USER DATA 

As part of the provision of websites hosted on https://www.ecm.pt/, https://www.cervejacoral.com e https://www.brisanet.pt/ (“Site”), entering into any contracts, providing information, content, including newsletters, requests for visits to the factory, export requests, sending suggestions, applications, campaigns/casting, requests for sponsorship or the “Coral em casa” (together, the “Services”) to its users (“User”) and other entities that have a relationship with him, the entities that are part of Empresa de Cervejas da Madeira, a sole proprietorship based at PEZO – Parque Empresarial Zona Oeste , 9304-003 Câmara de Lobos, registered at the Commercial Registry Office of Câmara de Lobos under the single registration and legal person number 511 001 720 (hereinafter “ECM”) may request the User to provide personal data, that is, information provided by the User that allow ECM to identify and/or contact him (“Personal Data”).

As a rule, Personal Data is requested when the User applies to be an ECM employee, makes sponsorship, export and factory visit requests, sends a suggestion, joins campaigns/castings, asks to be called within the scope of the service Coral at Home.

The Personal Data collected and processed essentially consists of information relating to the name, institution, date of birth, address, postal code, e-mail, fax, telephone, data contained in the CV or other similar document, educational qualifications, relevant professional experience, although other Personal Data that may be necessary or convenient for the provision or billing of Services by ECM may be collected.

After collecting the Personal Data, ECM provides the User with detailed information about the nature of the data collected and about the purpose and processing that will be carried out in relation to the Personal Data, as well as the information mentioned in clause 8.

ECM also collects and processes information about the device's hardware characteristics and browser/software characteristics, as well as information about the pages visited by the User within the Site. This information may include your browser type, domain name, access times and links through which the User accessed the Site (“Usability Information”). We only use this information to improve the quality of your visit to our Site.

Usability Information and Personal Data are referred to in this Privacy Policy as “User Data”.

For the purposes of this Privacy Policy, a contractual relationship means any and all contracts established between ECM and the entities that have relationships with it, regardless of the respective object. 

1.2. SUBCONTRACTED ENTITIES

Within the scope of the processing of User Data, ECM uses or may use third parties, subcontracted by it, to, on behalf of ECM, and in accordance with the instructions given by it, carry out the processing of User Data, in accordance with with the law and this Privacy Policy.

These subcontracted entities may not transmit User Data to other entities without ECM having previously given, in writing, authorization to do so, and are also prevented from contracting other entities without prior authorization from ECM.

ECM is committed to subcontracting only entities that offer maximum security in the execution of appropriate technical and organizational measures, in order to guarantee the defense of the User's rights. All entities subcontracted by ECM are bound to the latter through a written contract which regulates, namely, the object and duration of treatment, the nature and purpose of treatment, the type of personal data, categories of data subjects and the rights and obligations of the parties.

After collecting personal data, ECM provides the User with information about the categories of subcontracted entities that, in the specific case, may carry out data processing on behalf of ECM.  

2. GENERAL PRINCIPLES APPLICABLE TO USER DATA PROCESSING

In terms of general principles relating to the processing of personal data, ECM undertakes to ensure that the User Data processed by it is:

• Object of treatment in accordance with the law, fair and transparent in relation to the User;
• Collected for specific, objective and legitimate purposes, not being further processed in a manner contrary to those purposes;
• Adequate, justified and limited to what is necessary in relation to the purposes for which they are processed;
• Accurate and updated whenever necessary, with all necessary measures being taken to ensure that inaccurate data, taking into account the purposes for which they are processed, are erased or corrected without delay;
• Stored in a way that allows the User to be identified only for the period necessary for the purposes for which the data is processed;
• Processed in a way that guarantees its security, including protection against unauthorized or illegal processing and against its loss, destruction or unforeseen damage, with appropriate technical or organizational measures being adopted.

Data processing carried out by ECM is permitted and legal when at least one of the following situations is verified:

• The User has undoubtedly given their consent to the processing of User Data for one or more specific purposes;
• The processing is necessary for the fulfillment of a contract to which the User is a party, or for pre-contractual procedures at the User's request;
• The treatment is necessary for the fulfillment of a legal obligation to which the ECM is subject;
• The processing is necessary for the defense of fundamental interests of the User or another individual.

The processing is necessary for the purpose of the legal interests pursued by ECM or by third parties (except if the interests or fundamental rights and freedoms of the User that require the protection of personal data prevail).

ECM undertakes to ensure that the processing of User Data is only carried out under the conditions listed above and with respect for the principles mentioned above.

When the processing of User Data is carried out by ECM based on the User's agreement, the User has the right to withdraw his consent at any time. The withdrawal of consent, however, does not compromise the legality of the treatment carried out by ECM based on the consent previously given by the User.

The period of time during which the data is stored and maintained varies according to the purpose for which the information is processed.

Indeed, there are legal requirements that oblige the retention of data for a minimum period of time. Thus, and whenever there is no specific legal obligation, the data will be stored and kept only for the minimum period necessary for the purposes that motivated its collection or its subsequent processing, which at its end will be deleted.

3. USE AND PURPOSES OF USER DATA PROCESSING

In general terms, ECM uses User Data for the following purposes:

• Applications / Recruitment / Campaigns and Casting of data subjects;
• Fulfillment of orders, namely export orders, factory visit requests and sponsorship requests;
• Sending suggestions from data subjects;
• “Coral em Casa” service in which the data subject enters his telephone number for ECM to call him;
• Ensuring that the Site meets the User's needs, through the development and publication of content that is as adapted as possible to the requests and type of User, improving the Site's search capabilities and functionalities and obtaining associated information or statistics regarding the typical profile of the User (analysis of consumption profiles);
• ECM may combine Usability Information with anonymous demographic information for research purposes, and may use the results of this combination to provide more relevant content on the Site. In certain restricted areas of the Site, ECM may combine Personal Data with Usability Information to provide the User with more personalized content.

User Data collected by ECM is not shared with third parties without the User's consent, with the exception of the situations referred to in the following paragraph. However, if the User contracts with ECM services that are provided by other entities responsible for the processing of personal data, the User Data may be consulted or accessed by these entities, to the extent that this is necessary for the provision of said services.

Under the applicable legal terms, ECM may transmit or communicate User Data to other entities in the event that such transmission or communication is necessary for the performance of the contract established between the User and ECM, or for pre-contractual measures at the User's request. , in case it is necessary to comply with a legal obligation to which ECM is subject or in case it is necessary to obtain the legitimate interests of ECM or a third party. In the event of a transmission of User Data to third parties, reasonable efforts will be made so that the transmitter uses the User Data transmitted in an appropriate manner with this Privacy Policy.

4. TECHNICAL, ORGANIZATIONAL AND SAFETY MEASURES IMPLEMENTED 

To guarantee the security of User Data and maximum confidentiality, ECM treats the information you provide to us in an absolutely confidential manner, in accordance with its internal security and confidentiality policies and procedures, which are periodically updated according to needs, as well as the legally established terms and conditions.

Depending on the nature, scope, context and purposes of data processing, as well as the risks arising from processing for the User's rights and freedoms, ECM undertakes to apply, both when defining the means of processing as well as at the time of the processing itself, the necessary and appropriate technical and organizational measures to protect User Data and comply with legal requirements.
It is also committed to ensuring that, by default, only the data that is necessary for each specific processing purpose is processed and that these data are not made available without human intervention to an indeterminate number of people.
Communication between the user's device and the ECM Site is carried out through secure channels and communications using the HTTPS protocol and the SSL security standard.

Still, in terms of general measures, the ECM adopts the following:

• Regular audits with a view to identifying the competence of the technical and organizational measures implemented;
• Raising awareness and training of personnel involved in data processing operations;
• Mechanisms capable of ensuring the permanent confidentiality, availability and resilience of information systems;
• Mechanisms that ensure the restoration of information systems and access to personal data quickly in the event of a physical or technical incident.

5. TRANSFER OF DATA OUTSIDE THE EUROPEAN UNION 

The personal data collected and used by ECM is not made available to third parties established outside the European Union. If, in the future, this transfer takes place for the reasons mentioned above, ECM undertakes to ensure that the transfer complies with the applicable legal provisions, namely regarding the determination of the suitability of such country with regard to data protection and the requirements applicable to such transfers.

6. USE OF COOKIES

When you visit our website, a small text file (Cookie) is created and saved on your computer's disk, therefore, when browsing the Site you are accepting the installation of this text file on your device. This file will allow you to access the Site more easily and quickly, as well as customize it according to your preferences.

Most browsers accept these files (Cookies), but the User can delete them or automatically block them. In the “Help” menu of your browser you will find how to make these settings. However, if you do not allow the use of cookies, there may be some features of the Site that you will not be able to use.

If you do not wish to install cookies on your device, you should not browse our website.

7. TOOLS USED BY THE WEBSITE FOR READING STATISTICS AND USER BEHAVIOR.

Google Analytics

The Site uses Google Analytics, a web analysis service provided by Google Inc (hereinafter “Google”).

Cookies will be stored that provide information about the use and navigability of the Site. This data, including the User's IP address, is transmitted to Google's servers, but is not linked to any other data held by Google.

The User can deactivate the tool by downloading and installing a browser add-on available from Google: https://tools.google.com/dlpage/gaoptout?hl=en.

Facebook, Linkedin, Pinterest, Flickr and Youtube:

The Site has interactivity with Facebook, Linkedin, Pinterest, Flickr and Youtube through a connection to the servers of these social networks, this will allow identifying the website that the user is visiting and possibly storing other data, such as the IP address.

If the User is logged in to Facebook, Linkedin, Pinterest, Flickr and/or Youtube, the data will be associated with their accounts. To prevent this from happening, the User must end their sessions on Facebook, Linkedin, Pinterest, Flickr and Youtube before visiting the page.

Information regarding data processing carried out by these social networks is available at: https://www.facebook.com/about/privacy/,  https://www.linkedin.com/legal/privacy-policy?trk=hb_ft_priv, https://policy.pinterest.com/en/privacy-policy, https://www.flickr.com/help/privacy e https://www.youtube.com/intl/pt-BR/yt/about/policies/#community-guidelines.

Twitter

The Site provides interactivity with Twitter Inc., (hereinafter “Twitter”), through the respective button, establishing a connection to the Twitter servers, which will identify the Site that the user is visiting and possibly store other data, such as the IP address.

Data will be stored in this way only for the purpose of displaying the button. More information about how Twitter processes data is available at: https://twitter.com/privacy.

     B RIGHTS OF USERS (DATA HOLDERS) 

8. RIGHT TO INFORMATION

8.1. Information provided to the User by ECM (when data is collected directly from the User):

The identity and contact details of the ECM, controller and, if applicable, its representative;

• Contacts of the Data Protection Officer;
• The purposes of the treatment for which the personal data are intended, as well as, if applicable, the legal reasons for the treatment;
• If the processing of data is based on legitimate interests of ECM or a third party, indication of such interests;
• If applicable, the recipients or categories of recipients of the personal data;
• If applicable, indication that the personal data will be transferred to a third country or an international organization, and the existence or not of an adequacy decision adopted by the Commission or the reference to appropriate or adequate transfer guarantees;
• Period of retention of personal data;
• The right to request permission from ECM for personal data, as well as its correction, deletion or limitation, the right to object to processing and the right to data accessibility;
• If data processing is based on the User's consent, the right to withdraw it at any time, without compromising the legality of the processing carried out based on previously given consent;
• The right to lodge a complaint with the CNPD or another supervisory authority;
• Indication of whether or not the communication of personal data constitutes a legal or contractual obligation, or a necessary requirement to conclude a contract, as well as whether the holder is obliged to provide the personal data and the possible consequences of not providing such data;
• If applicable, the existence of automatic decisions, including the definition of profiles, and information regarding the basic concept, as well as the importance and expected consequences of such treatment for the data subject;
• If User Data is not collected directly by ECM from the User, in addition to the information referred to above, the User is also informed about the categories of personal data subject to processing and, as well, about the origin of the data and, eventually , if they are from sources accessible to the public;
• If ECM intends to further process User Data for a purpose other than that for which the data was collected, before such processing ECM will provide the User with information about that purpose and any other information of interest, under the terms referred to above. .

8.2. Procedures and measures implemented with a view to fulfilling the right to information.

The information referred to in 8.1. is provided in writing (including by electronic means) by ECM to the User prior to the processing of personal data in question. Under applicable law, ECM is under no obligation to provide the User with the information mentioned in 8.1 when and to the extent that the User is already aware of them.

The information is provided by ECM at no charge.

9. RIGHT OF ACCESS TO PERSONAL DATA 

ECM guarantees the means that allow the User to consult their Personal Data.
The User has the right to obtain from ECM confirmation that personal data concerning him or her are being processed or not and, if applicable, the right to access his or her personal data and the following information:

• The purposes of data processing;
• The categories of personal data in question;
• The recipients or categories of recipients to whom the personal data have been or will be disclosed, namely recipients established in third countries or belonging to international organizations;
• The period of retention of personal data;
• Right to request ECM to correct, delete or limit the processing of personal data, or the right to prevent such processing;
• Right to file a complaint with the CNPD or another supervisory authority;
• If the data has not been collected from the User, the information available on the origin of that data;
• The existence of automated decisions, including profiling, and information regarding the underlying logic, as well as the importance and anticipated consequences of such processing for the data subject;
• Right to be informed about adequate guarantees associated with the transfer of data to third countries or international organizations.

Upon request, ECM will provide the User, free of charge, with a copy of the User Data that is being processed. The provision of other copies requested by the User may incur administrative costs. 

10. RIGHT TO RECTIFICATION OF PERSONAL DATA

The User has the right to request, at any time, the rectification of their Personal Data, as well as the right to have their incomplete personal data completed, including by means of an additional declaration.

In the event of data rectification, ECM communicates the respective rectification to each recipient to whom the data has been transmitted, unless such communication is considered impossible or involves a disproportionate effort for ECM.

11. RIGHT TO DELETE PERSONAL DATA (“RIGHT TO BE FORGOTTEN”) 

The User has the right to obtain, from ECM, the deletion of their data when one of the following reasons applies:

• User Data is no longer necessary for the purpose for which it was collected or processed;
• The User withdraws the consent on which the processing of data is based and there is no other legal basis for said processing;
• The User opposes the processing under the right to object and there are no prevailing legitimate interests that justify the processing;
• If User Data is processed illegally;
• If User Data has to be erased to comply with a legal obligation to which ECM is subject.

Under applicable legal terms, ECM is not obliged to delete User Data to the extent that the processing proves necessary to comply with a legal obligation to which ECM is subject or for the purposes of declaring, exercising or defending a right. of ECM in a legal proceeding.

In case of deletion of data, ECM communicates to each recipient/entity to whom the data has been transmitted the respective deletion, unless such communication proves impossible or implies a disproportionate effort for ECM.

When ECM has made User Data public and is obliged to erase them under the right of such erasure, ECM undertakes to ensure the measures that are reasonable, including those of a technical nature, taking into account the technology available and the costs of its application, to inform those responsible for the effective processing of personal data that the User has asked them to delete the links to that personal data, as well as the copies or reproductions thereof.

12. RIGHT TO LIMIT THE PROCESSING OF PERSONAL DATA 

The User has the right to obtain, on the part of ECM, the limitation of the processing of User Data, if one of the following situations applies (the limitation consists of inserting a mark in the personal data kept with the aim of limiting its treatment in the future):

• If you dispute the accuracy of the personal data, during a period that allows ECM to verify its accuracy;
• If the treatment is unlawful and the User opposes the deletion of the data, requesting, in return, the limitation of its use;
• If ECM no longer needs User Data for processing purposes, but such data is required by the User for the purposes of declaring, exercising or defending a right in legal proceedings;
• If the User has objected to the treatment, until it is verified that the legitimate reasons of ECM prevail over those of the User;
• When User Data is subject to limitation, it may only, with the exception of conservation, be processed with the User's consent or for the purposes of declaring, exercising or defending a right in a judicial proceeding, defending the rights of another natural person or collective, or for legally foreseen public interest reasons;
• The User who has obtained the limitation of the processing of their data in the cases referred to above will be informed by ECM before the limitation of processing is canceled;
• In the event of limitation of data processing, ECM will inform each recipient to whom the data has been transmitted of the respective limitation, unless this communication proves impossible or implies a disproportionate effort for ECM.

13. RIGHT TO PORTABILITY OF PERSONAL DATA

The User has the right to receive the personal data concerning him and that he has provided to ECM, in a structured, commonly used and machine-readable format, and the right to transmit this data to another controller, if:

• The processing is based on consent or a contract to which the User is a party; It is
• Processing is carried out by automated means.

The right to portability does not include inferred data or derived data, ie, personal data that is generated by ECM as a consequence or result of the analysis of the data subject to processing.

The User has the right for their personal data to be transmitted directly between those responsible for the treatment, whenever this is technically possible.

14. RIGHT TO OPPOSE TREATMENT 

The User has the right to object at any time, for reasons related to their particular situation, to the processing of personal data concerning them that is based on the exercise of legitimate interests pursued by ECM or when the processing is carried out for purposes other than whether those for which personal data was collected, including profiling, or when personal data is processed for statistical purposes.

ECM will terminate the processing of User Data, unless it presents urgent and legitimate reasons for such treatment that prevail over the interests, rights and freedoms of the User, or for the purposes of declaring, exercising or defending ECM's right in a legal proceeding. .

When User Data is processed for the purposes of direct marketing (marketing), the User has the right to object at any time to the processing of data concerning him for the purposes of said marketing, which includes the definition of profiles on the in so far as it relates to direct marketing. If the User objects to the processing of their data for the purposes of direct marketing, ECM ceases processing the data for that purpose.

The User also has the right not to be subject to any decision taken exclusively based on automated processing, including the definition of profiles, that produces effects in their legal sphere or that significantly affects them in a similar way, unless the decision:

• It is necessary for the conclusion or performance of a contract between the User and ECM;
• Is authorized by legislation to which the ECM is subject; or
• It is based on the User's explicit consent.

15. PROCEDURES FOR THE EXERCISE OF RIGHTS BY THE USER

The right to access, the right to rectification, the right to deletion, the right to limitation, the right to portability and the right to object can be exercised by the User via email Privacy@ecm.pt or by registered letter to the following address : Pezo, West Zone Business Park, Ribeira dos Socorris 9304-003 Câmara de Lobos.

ECM will respond in writing (including by electronic means) to the User's request within a maximum period of one month from receipt of the request, except in cases of special complexity, in which this period may be extended to two months.

If the requests submitted by the User are manifestly unjustified or excessive, namely due to their repetitive nature, ECM reserves the right to charge administrative costs or refuse to comply with the request.

16. PERSONAL DATA VIOLATIONS

In the event of a data breach and to the extent that such breach is likely to pose a high risk to the User's rights and freedoms, ECM undertakes to communicate the breach of personal data to the User concerned within 72 hours from upon becoming aware of the incident.

Under legal terms, communication to the User is not required in the following cases:

• If ECM has applied adequate protection measures, both technical and organizational, and these measures have been applied to the personal data affected by the breach of personal data, especially measures that make the personal data incomprehensible to any person not authorized to access such data, such as encryption;
• If ECM has taken subsequent measures to ensure that the high risk to the User's rights and freedoms is no longer likely to materialise; or
• If communication to the User involves a disproportionate effort for ECM. In this case, ECM will make a public communication or take a similar measure through which the User will be informed.

      C FINAL PART 

1. CHANGES TO THE PRIVACY POLICY

ECM reserves the right to change this Privacy Policy at any time. If the Privacy Policy is modified, the date of the last change, available at the top of this page, is also updated. If the change is substantial, a notice will be placed on the Site.

18. APPLICABLE LAW AND JURISDICTION 

The Privacy Policy, as well as the collection, processing or transmission of User Data, are governed by the provisions of Regulation (EU) 2016/679, of the European Parliament and of the Council, of April 27, 2016 and by the applicable laws and regulations in Portugal.

Any disputes arising from the validity, interpretation or execution of the Privacy Policy, or that are related to the collection, processing or transmission of User Data, must be submitted exclusively to the jurisdiction of the judicial courts of the district of Lisbon, without prejudice to the legal norms. applicable imperatives.