Privacy Policy
Privacy Policy
This Privacy Policy aims to inform users of the Hagra website about how their personal data is collected, processed and protected, in accordance with the General Data Protection Regulation, GDPR, Regulation (EU) 2016/679, and the other legislation applicable in Portugal.
Hagra is a brand belonging to Biopositivo Lda., which is the entity responsible for processing personal data. Reading this document is recommended.
Identification of the entity responsible for data processing
The entity responsible for data processing is BIOPOSITIVO III, LDA, hereinafter referred to as BIO III, which manages the website www.hagra.pt. The company has NIPC 516408437 and its registered office is at Edifício Hubel, Parque de Empresas, lotes 16 e 30, 7900 Ferreira do Alentejo. The telephone contact is 289 710 500, call to the national landline network, and the contact email is info@hagra.pt.
Purpose of this policy
This Privacy Policy explains how BIO III collects and processes the personal data necessary for providing the services available through the website, describing the practices adopted for that purpose.
What personal data is
Personal data is any information relating to a person that identifies that person or makes that person identifiable, regardless of the nature and format of that information, including the person’s sound and image.
An identifiable person is understood to be a person who can be identified, directly or indirectly, namely by reference to an identification number or to other elements specific to that person’s physical, physiological, mental, economic, cultural or social identity.
How personal data is used
The personal data processing operations carried out by BIO III are considered essential for user satisfaction and for the company’s activity. These operations are carried out in accordance with the applicable legislation and best practices.
Purposes, legal bases and retention periods for the data collected
The personal data processed by BIO III has specific legal bases, according to the purposes for which it is intended, and is retained only for the time necessary to fulfil those purposes. The data collected is only that which is necessary and appropriate for the indicated purposes.
To follow up on customer registration on the website and allow the use of the respective features, data processing is based on consent given for that specific purpose. In this case, name and email are collected. This data is retained for the period during which the user remains registered as a customer and wishes to use the website services, and up to 1 year after the last access.
To retain account data in the reserved area, processing is based on BIO III’s legitimate interests in keeping user information in the respective account. Identification data, contact details, address data and tax data, including the NIF, are processed. This data is retained for the period during which the user remains registered as a customer and wishes to use the website services, and up to 1 year after the last access.
To analyse and reply to messages, provide customer support and respond to requests for information, processing is based on pre-contractual steps and on BIO III’s legitimate interests in analysing and responding to the contact requests received. In this context, name, email, contact details, address data and tax data, including the NIF, may be collected. This data is retained for the period considered necessary for the indicated purpose. If a contract is entered into with the customer following the contact, the data will be retained during the performance period of that contract.
To process online purchases, issue invoices and send orders, processing is based on pre-contractual steps, performance of the contract and compliance with legal obligations to which BIO III is subject, namely in relation to invoicing. In this case, the following may be collected: first name, surname, company name, country, full address, telephone, email, NIF and bank details strictly necessary for processing payments. This data is retained for the period necessary for the performance of the contract, for ensuring the exercise of the rights of the customer and BIO III in relation to the purchase made, and for compliance with the applicable legal obligations, namely tax obligations.
For the sending of newsletters or other publications requested by the user, or that may be of interest to the user, processing is based on consent for that specific purpose or on legitimate interests, when the customer has already made purchases or acquired products or services similar to those advertised. In this case, the email address is processed. The data is retained until the user withdraws consent or opts out, that is, cancels the subscription to this type of communication.
For website management operations, processing may be based on consent for the use of cookies and on BIO III’s legitimate interests in analysing users’ interaction with the website and managing it. The applicable information is detailed in the Cookie Policy.
For fraud prevention and information system security, processing is based on BIO III’s legitimate interests in ensuring the security of the information systems and of website browsing.
For the adaptation, improvement and modification of the services, namely by identifying usage trends or determining the effectiveness of promotional campaigns, processing may be based on consent for the use of cookies and on BIO III’s legitimate interests in adapting and improving the website.
When the law determines a specific or mandatory retention period, that period will apply. In all other cases, personal data will be retained, at most, for the periods indicated in this Privacy Policy, which BIO III considers sufficient to fulfil the respective purposes. Once the retention period has ended, all personal data collected will be deleted.
Newsletters and other commercial or promotional communications
BIO III may send newsletters or other commercial and promotional communications relating to its activity whenever the user exercises the right to purchase or order and does not previously object to receiving such communications, in an informed manner, through the checkboxes available on the website for that purpose.
The user may withdraw consent at any time by email, through the unsubscribe option, or by written communication addressed to BIO III using the contacts indicated in the section relating to the exercise of rights. Withdrawal of consent does not affect processing carried out before that withdrawal.
When BIO III obtains its customers’ email address in the context of the sale of a product or service, it may use it for direct marketing purposes concerning its own products or services similar to those previously transacted. For this purpose, it must clearly and explicitly guarantee customers the possibility to object, free of charge and easily, in each message sent, for example through the unsubscribe option.
How personal data is collected
Personal data is collected through the forms available on the website, through the website itself and the communication it establishes with the user’s device, as well as through email messages sent by the user.
Personal data may be collected from the user’s device through the browser, cookies, pixel tags and other similar technologies, and the IP address.
BIO III undertakes to process personal data in accordance with the law and in a lawful manner. The company will not sell, rent or share personal data with third parties, except in the cases clearly identified in this Privacy Policy.
Whenever the user provides personal data to BIO III, the user undertakes to provide true and accurate information about themselves, according to the data requested in the website forms, to keep their data updated with BIO III, and not to provide personal data relating to third parties without a legal basis for doing so and without being able to demonstrate it.
Cookies
Cookies are small information files that help identify the user’s browser and may store information, such as settings and preferences.
BIO III stores cookies on the user’s device to personalise and facilitate browsing, as well as for troubleshooting, statistics, quality assurance and monitoring the security of the system.
With the exception of cookies that are specifically necessary for the operation of the website, the storage of all other cookies always depends on the user’s acceptance and consent. This consent may be withdrawn at any time through specific browser tools.
For more information about the cookies used, the Cookie Policy should be consulted.
Protection of personal data
Personal data is kept secure through the adoption of several technical and organisational security measures, which ensure that only employees who need to access personal data do so, in accordance with access needs and the rules created for that purpose.
To protect personal data, BIO III uses only data centre providers that offer appropriate and documented security measures, including guarantees that personal data is stored on servers maintained in controlled environments with limited access.
When browsing the website, data is protected by encryption, such as the Transport Layer Security protocol, TLS, which protects telecommunications over the internet. The user’s password is stored using a one-way hash, which means that it cannot be retrieved or disclosed by anyone, including BIO III, and can only be reset.
Despite the measures adopted, no security system is completely impenetrable. For this reason, the user should keep the password secret and not disclose it to third parties. If the user suspects that the password has been misused, the user should change it and inform BIO III immediately. The user should also take care to log in and log out whenever closing the browser.
Rights of data subjects
The user has the right of access, meaning the right to obtain confirmation as to whether or not personal data concerning the user is being processed and, where applicable, the right to access that data.
The user also has the right to rectification, which consists of the right to obtain correction of inaccurate personal data concerning the user, as well as completion of incomplete personal data.
The user has the right to erasure of personal data when one of the grounds provided for in the legislation applies. This right may exist, for example, when the data is no longer necessary for the purpose that motivated its collection or processing, when the user withdraws consent and there is no other legal basis for processing, when the user objects to processing and there are no overriding legitimate interests, when the data has been processed unlawfully, when the data must be erased to comply with a legal obligation, or when the data has been collected in the context of offering information society services.
The user also has the right to restriction of processing when one of the situations provided for in the legislation occurs. This may happen, for example, when the user contests the accuracy of the personal data, when processing is unlawful and the data subject opposes erasure of the data and requests restriction of its use instead, when the controller no longer needs the data for processing purposes but the data is required by the data subject for the establishment, exercise or defence of a legal claim, or when the data subject has objected to processing involving automated individual decisions.
The user also has the right to object and may object at any time to the processing of personal data concerning the user.
In addition, the user has the right to data portability, which means that the user may receive the personal data concerning the user in a structured, commonly used and machine-readable format, and may transmit that data to another controller without hindrance from the controller to whom the personal data was provided, when the processing is based on consent or on a contract, or when it is carried out by automated means.
The user also has the right to lodge a complaint with the competent supervisory authority. In Portugal, that authority is the Comissão Nacional de Proteção de Dados, available at www.cnpd.pt.
Whenever data processing is based on consent, the user has the right to withdraw that consent at any time, without invalidating the processing carried out up to that date.
How to exercise rights
The user may exercise their rights by written contact to the email address info@hagra.pt or by post to BIOPOSITIVO III, LDA, Parque Hubel, Pechão, 8700-179 Olhão.
If the deletion of some or all personal data is requested, some of the requested services may no longer be provided. In that case, BIO III will retain only the personal data necessary to comply with the legal obligations to which it is bound.
Communication of data to third parties
BIO III may use third parties to provide certain services, namely maintenance, technical support, marketing and invoicing. These third parties may have access to some personal data, only to the extent necessary for the contracted purposes.
Data may also be transmitted to transport companies, for the purpose of ensuring delivery of orders placed by customers. These entities act as controllers of the external order data until the respective delivery.
BIO III ensures that the entities with access to data are credible and offer high protection guarantees. No more data will be transmitted to them than is necessary for the provision of the contracted service, with BIO III remaining responsible for the personal data made available.
BIO III may also transmit data to third parties in the context of investigations, inquiries and judicial or administrative proceedings, or similar proceedings, whenever this is duly ordered by a judicial decision.
Third-party websites
The website may contain links to other websites, which may collect and process personal data. Such processing is the exclusive responsibility of the owners of those websites, and BIO III has no responsibility for their respective policies or practices.
Examples of such third parties include Facebook, LinkedIn and Instagram, through the buttons present on the website.
Data transfers outside the European Union
Personal data is processed by BIO III within the European Economic Area.
If data transfers occur to third countries outside the European Economic Area, BIO III undertakes to adopt appropriate safeguards so that such transfers are carried out in accordance with the applicable legislation.
Minors
The website is not aimed at persons under 18 years of age. For this reason, BIO III asks that minors do not provide personal data through the website, application, social networks, social media or emails.
Sensitive personal data
BIO III asks that sensitive personal data not be sent or communicated. This includes information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic information, biometric information, health data, data relating to sexual life or data concerning the sexual orientation of a natural person.
If, nevertheless, such categories of personal data are sent or communicated to BIO III, they will be immediately deleted.
Changes to the Privacy Policy
BIO III reserves the right to readjust or change this Privacy Policy at any time, and such changes will be published.
BIO III recommends that users who interact with the website consult this Privacy Policy regularly, in order to remain informed about any changes made.
Contact details
If there is any doubt or question related to this Privacy Policy, contact should be made in writing. In this section, the document states the email address info@bruga.pt, although in other parts of the document the email address info@hagra.pt is stated.