Find out how your personal data is collected, processed and used and how you can access all the details.

1 . Personal data
What is personal data?
Personal Data is any information, of any nature and on any format (ex: sound or image), relating to an identified or identifiable singular natural person.
It’s considered as identifiable the person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an electronic identifier or other elements that allow the identification of that singular natural person.

Who are the owners of personal data?
The Client or User, a singular natural person, to whom the data relates and who has used INDELAGUE GROUP’s (INDELAGUE and ROXO Lighting) services or products. The Client will be the person who celebrates the contract with INDELAGUE GROUP (INDELAGUE or ROXO Lighting) and the User is the person who uses the services or products of INDELAGUE GROUP, but who may be or may not be the Client. For example:

– In the business segment, the contract with INDELAGUE GROUP is in the company’s name but the Users are the clients or employees of that company;

– In the private segment, a Client will be able to purchase various services, with each person in the household who’s benefiting from the services or products, being considered a User.

In this regard, INDELAGUE GROUP informs that it also protects personal data and respects the rights of clients and users.

What categories of personal data do we process?
The categories of data we process are the following:

Identification and contact details and other identification data
Civil or fiscal/tax identification numbers, payment details, billing/installation address, telephone contact or email address; date of birth, gender

Service
Products and services acquired or subscribed

Profile and interests
Interest in INDELAGUE GROUP’s products or services, Newsletter, social networks, or other preferences and interests.

2 .Treatment of personal data
Who is responsible for the processing of your personal data?
The responsible for collecting and processing of your personal data will be the INDELAGUE GROUP company that provides you with the service or supplies you the product and that in this context decides what data is collected, the means of treatment and purposes for which the data are used.

The Data Protection Officer
INDELAGUE GROUP also has a Data Protection Officer (DPO), who:

1. Monitors the compliance of data processing with applicable norms;
2. It’s a point of contact with the client or user for the clarification of questions regarding the processing of their data by INDELAGUE GROUP;
3. Cooperates with the supervising authority;
4. Provides information and advises the controller or the subcontractor on their privacy and data protection obligations.

How can I contact the Data Protection Officer?
You can contact the DPO at the following addresses:

By letter/mail:  Data Protection Officer (DPO)  INDELAGUE – INDÚSTRIA ELÉCTRICA DE ÁGUEDA, S.A. – Rua da mina 465, Covão, Zona Industrial EN1 Norte, 3750-792 Trofa, ÁGUEDA PORTUGAL

By Email:  dpo@indelague.pt

3 . Basis for the processing of personal data

On what basis can we process your personal data?
These are the circumstances in which we process your personal data:

Consent
When you have your express consent – in writing, orally or through the validation of an option – and prior and if that consent is free, informed, specific and unambiguous. Examples are your consent for INDELAGUE GROUP to analyze the use of services and consumption profile and make recommendations or send marketing messages, to use your identification data or use of services, so to send INDELAGUE GROUP marketing messages.

or

Contract execution and pre-contractual diligences
When the processing of personal data is necessary for the celebration, execution and management of the contract celebrated with the INDELAGUE GROUP companies, such as for the preparation of a service proposal or information on the installation address, for the supply of communication services, for the contacts, information and orders management, for the billing, collection and payments management;

or

Compliance with legal obligation
When the processing of personal data is necessary to comply with a legal obligation to which the INDELAGUE GROUP companies are subjected, such as the communication of identification data or traffic data to police authorities, judicial, fiscal or regulatory entities or of location data so to provide emergency services;

or

Legitimate interest
When the processing of personal data corresponds to a legitimate interest of the INDELAGUE GROUP companies or third parties, such as, for example, the processing of data for, improvement of quality of service, detection of fraud and protection of revenue and when our reasons for its use should prevail over your data protection rights;

4 .Purposes and data processing period
How long do we process your Personal Data?

Your personal data are processed by INDELAGUE GROUP only for the period of time necessary for the accomplishment of the defined purpose or, depending on what is applicable, until you exercise your right of opposition right, right to be forgotten or withdraw your consent.
After the respective conservation period has elapsed, INDELAGUE GROUP will delete or anonymize the data whenever they should not be kept for a different purpose that may exist.

For what purposes do we process your Personal Data?

Marketing and Sales
– Marketing or sales of new products or services;
– Analysis of consumption profiles;
– Adaptation and development of new products or services.

Customer Management and Service Delivery
– Management of contacts, information or requests;
– Management of installation, activation or shutdowns;
– Management of complaints or breakdowns;
– Management of billing, collection and payments;
– Consumption analysis;

Accounting, Tax and Administrative Management
– Accounting, billing;
– Commission management;
– Tax information, including sending information to the tax authority;

Litigation Management
– Judicial and extrajudicial debt collection;
– Management of other conflicts;

Fraud detection, revenue protection and auditing
– Detection of fraud and illicit practices;
– Revenue protection and control;
– Credit risk management;
– Internal audit and investigation;

Network and systems management
Support and improvement of networks and applications that support the Monitoring service, improvement and support of the service

Compliance with legal obligations
– Track call locations to emergency services;
– Judicial requests for interception of communications;
– Investigation, detection and prosecution of serious crimes;
– Response to judicial, regulatory and supervising entities;

Control of information security
– Access management, logs;
– Backup management;
– Management of security incidentes.

Control of physical security
Video surveillance in facilities, namely Offices and Factory

What are the deadlines for processing and retaining personal data?
INDELAGUE GROUP processes and preserves your personal data according to the purposes for which they are processed.

There are cases where the law requires the processing and retention of data for a minimum period of time, namely: for one year, traffic and location data for the purposes of investigation, detection and prosecution of serious crimes or for 10 years the necessary data for information to the Tax Authority for accounting or tax purposes.
But, whenever there is no specific legal obligation, then the data will only be processed for the period necessary to fulfil the purposes that motivated its collection and preservation and always in accordance with the law, the guidelines and decisions of the CNPD (National Commission for Data Protection).
Thus, INDELAGUE GROUP will process and maintain your personal data for the period in which it maintains a contractual relationship with you.
However, the traffic data necessary for billing, for example, the destination and origin numbers of calls made, date/time of communication, duration of communication, IP address and Mac address, will only be kept for a maximum period of 6 months since the data is generated.
With regard to the video surveillance of its facilities, INDELAGUE GROUP will only keep the recordings of images and respective personal data for a maximum period of 30 days.
INDELAGUE GROUP may keep other personal data for periods longer than the duration of the contractual relationship, either based on your consent, or to ensure rights or duties related to the contract, or because it has legitimate interests that underlie it, but always for the period strictly necessary for the achievement of the respective purposes and in accordance with the guidelines and decisions of the CNPD (National Commission for Data Protection).
Examples are contact for marketing and sales purposes, preservation of data within the scope of invoice complaint processes, exercise of warranty rights, return of equipment after customer disconnection or legal proceedings, in the latter case for the period in which they were pending.

5 . Collection of personal data
How do we collect your personal data?

We collect personal data with your consent when you purchase products or services from INDELAGUE GROUP, when you download or use INDELAGUE GROUP products, services and applications or when you participate in market studies.

The collection can be done orally, in writing or through the website of INDELAGUE GROUP.

But your personal information may also be collected from publicly accessible sources or other sources.

How is your personal data indirectly collected?
In order for you to better understand this indirect data collection, we indicate the following cases:

Database Shared between electronic communications operators for contracting purposes
If you have outstanding invoices worth more than 20% of the national minimum wage, your data may be included in a debtor list. But before including your data in the list, INDELAGUE GROUP will notify you so that, within 5 days, the outstanding amount is paid and it’s proven that the debt does not exist or that it is not due. Also, in case you have a debt payment agreement, if you justify the non-payment of invoices with the operator not complying with the contract, or, if you have complained about the invoiced amount or proven that you do not owe the amount charged, you will not be able to be a part of this database. This list is shared between the participating communications operators and the INDELAGUE GROUP may use this list before taking a decision on contracting services with customers.

Other relevant information on credit risk or on identification and contact details for collection management, fraud detection and revenue protection
INDELAGUE GROUP may collect personal data from private entities that maintain relevant information on the credit of personal data holders, provided that these bases comply with the applicable data protection rules. INDELAGUE GROUP may also access, collect or confirm personal data on websites of the Public Administration and private entities, namely, to confirm the accuracy of your identification and contact data.

6.Data protection rights
What are your rights?

See below for your rights and the details of what is safeguarded in each one.

Right of access
Right to obtain confirmation on which of your personal data is being processed and information about them, such as, the purposes of the processing, the retention periods, among others. Right to see/hear or obtain a copy, for example, of invoices, written agreements or calls in which you are involved and which are recorded.

Right of rectification
Right to request rectification of your personal data that are inaccurate or request that incomplete personal data be completed, such as address, VAT number, email, telephone contacts, or others.

Right to data erasure or “right to be forgotten”
Right to have your personal data erased, as long as there are no valid grounds for its conservation, such as in cases where INDELAGUE GROUP has to keep the data in order to comply with a legal obligation of preservation for investigation, detection and prosecution of crimes or because a court case is in progress.

Right to withdraw consent or right to object
Right to oppose or withdraw your consent at any time to data processing, for example in the case of data processing for marketing purposes, provided that there are no legitimate interests that prevail over your interests, rights and freedoms, such as defending a right in a judicial process.

Right of limitation
Right to request limitation of the processing of your personal data, in the form of:

1. Suspension of processing
2. Limiting the scope of processing to certain categories of data or processing purposes.

Automated profile and decisions
INDELAGUE GROUP can profile its customers based, for example, on their preferences, personal interests, service use, location, etc., in order to provide services, increase the quality and experience of products and services, adjust marketing communications, etc., provided that such treatment is necessary for the celebration or execution of the contract between the holder and INDELAGUE GROUP, thus, being based on the holder’s consent.
When the processing of personal data, including the processing for the definition of profiles, is exclusively automatic (without human intervention) and may produce effects in your legal sphere or significantly affect you, you will have the right not to be subjected to any decision based on this automatic treatment, except for the exceptions provided for in the law and you will have the right for INDELAGUE GROUP to take appropriate measures to safeguard your rights and freedoms and legitimate interests, including the right for human intervention in the decision-making by INDELAGUE GROUP, the right to express your point of view or contest the decision taken on the basis of the automated processing of personal data.

Right to complain
Right to file a complaint with the supervisory authority, the CNPD, in addition to the company or the DPO.

How can you exercise your rights?
The exercise of rights is free of charge, unless the request is manifestly unfounded or excessive, in which case a reasonable fee may be charged taking into account the costs. Information must be provided in writing but, if requested, may be provided orally. In this case, INDELAGUE GROUP must verify your identity by means other than orally.

The response to requests must be provided within a maximum period of 30 days, unless it is a particularly complex request.

Exercise your rights through the following addresses:

INDELAGUE – INDÚSTRIA ELÉCTRICA DE ÁGUEDA, S.A.
Address: Rua da mina 465, Covão, Industrial Zone EN1 North, 3750-792 Trofa, ÁGUEDA PORTUGAL
Mail: dpo@indelague.pt
Telephone: +351 234 612 310

7 . Transmission of personal data
Under what circumstances is your personal data communicated to other entities, subcontractors or third parties?
Your data may be transmitted to subcontractors so that they can be processed in the name and on the behalf of the INDELAGUE GROUP. In this case, INDELAGUE GROUP will take the necessary contractual measures to ensure that the subcontractors respect and protect the holder’s personal data.
The data may also be transmitted to third parties – entities other than INDELAGUE GROUP or subcontractors, companies with which INDELAGUE GROUP develops partnerships, if the holder has consented – or entities to which the data must be communicated by law, as the tax authority.

8 . Protection of personal data
How does INDELAGUE GROUP protect your personal data?
INDELAGUE GROUP has implemented the appropriate, necessary and sufficient logical, physical, organizational and security measures to protect your personal data against destruction, loss, alteration, dissemination, unauthorized access or any other form of accidental or unlawful processing.

The INDELAGUE GROUP has implemented:
-Logical security requirements and measures, such as the use of firewalls and intrusion detection programs in its systems, the existence of a strict policy on access to systems and information and the recording of actions carried out by the employees of INDELAGUE GROUP on personal data of clients or users (logging);

-Physical security measures, including strict control of access to the physical facilities of INDELAGUE GROUP, by employees, partners and visitors, as well as very restricted and permanently monitored access to the essential technological infrastructures of INDELAGUE GROUP;

-Means of data protection from conception (“privacy by design”), and by using technical means such as mask, encryption, pseudonymisation and anonymisation of personal data, and also a set of preventive measures favourable to privacy (“privacy by default”);

-Scrutiny, auditing and control mechanisms to ensure compliance with security and privacy policies;

-An information and training program for INDELAGUE GROUP employees and partners;

-Access rules to certain products or services for Clients or Users, such as the introduction of a password, in order to reinforce the control and security mechanisms.

9.Useful advice for the protection of your data
INDELAGUE GROUP and third party websites
Regarding the use and processing of personal data from INDELAGUE GROUP websites, be sure to consult the rules on the use of cookies on the respective websites.

The INDELAGUE GROUP websites, products or applications may contain links to third parties websites, products or services, which have no relationship with INDELAGUE GROUP or which are not covered by this Privacy Policy.

The collection or processing of personal data requested by these third parties is your sole responsibility, and INDELAGUE GROUP cannot be held responsible, under any circumstances, for the content, accuracy, truthfulness or legitimacy of these websites or for the misuse of the data collected or processed through them.

We alert INDELAGUE GROUP’s Clients and Users to this fact and to the need of, before using the websites, products or applications, reading and accepting the rules related to the processing of personal data defined by these third parties.

Other advice
INDELAGUE GROUP advises prudence in the exposure of your personal data and in the circulation of this data over the internet, acts that are the client’s full responsibility, since this data is not fully protected against possible violations, the adoption of complementary security measures, including the maintenance of equipment (PCs, tablets or mobile phones) and programs duly updated and configured with firewalls and protection against malicious software (example: antivirus), not browsing websites with dubious reputation or for which you do not have proper authenticity guarantees, the physical protection of your equipment and avoid placing access credentials on publicly accessible computers (example: cybercafés, hotels, etc.) and the use of strong passwords that are differentiated according to each service or website.