Privacy and Protection Policy
of Personal Data

Who are we?

O Caldas da Rainh@ shopping district aims to promote the transformation of Caldas da Rainha's local commerce, fostering a digital transition that strengthens and adds value to the community. 

By integrating technology strategically, the Caldas da Rainh@ shopping district aims to boost the municipality's economy by promoting the region's cultural and social heritage.

Why this privacy and personal data protection policy?

The purpose of this Policy is to inform Users of the platform of Caldas da Rainh@ shopping district, The data protection website, managed by the Municipality of Caldas da Rainha, complies with the general rules on privacy and the processing of personal data, which are collected and processed in strict compliance with the provisions of the personal data protection legislation in force at any given time, namely Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (“GDPR”).

O Caldas da Rainh@ shopping district respects the best practices in the field of security and protection of personal data and, to this end, has taken the necessary technical and organisational measures in order to comply with the GDPR and ensure that the processing of personal data is lawful, fair, transparent and limited to the authorised purposes.

O Caldas da Rainh@ shopping district is committed to the protection and confidentiality of personal data and has adopted the measures it deems appropriate to ensure the accuracy, integrity and confidentiality of personal data, as well as all the other rights that the respective holders enjoy.

What does this policy cover?

This Policy applies exclusively to the collection and processing of personal data for which the Caldas da Rainh@ shopping district is responsible for the processing thereof in connection with the use of the platform.

The processing of personal data carried out by Merchants / Service Providers registered on the platform, within the scope of their sales, communications and customer management, is their sole responsibility and they must fully comply with the GDPR and other applicable legislation.

What is personal data?

Personal data is any information of any nature and regardless of its medium, including sound and image, relating to an identified or identifiable natural person.

An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to a name, an identification number, location data, an electronic identifier or to one or more factors specific to his or her physical, physiological, genetic, mental, economic, cultural or social identity.

What does the processing of personal data consist of?

The processing of personal data consists of an operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, namely collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, comparison, interconnection, restriction, erasure or destruction.

Who is the data controller?

The entity responsible for processing personal data is Caldas da Rainh@ shopping district, This determines the purposes and means of processing them.

To this end, if the holder of the personal data needs to contact the data controller, they can do so through the following means and contacts indicated: caldasbairrocomercial@mcr.pt

What types of personal data are processed?

O Caldas da Rainh@ shopping district, in the context of making the platform available, processes the personal data necessary for the operation of the platform, processing data such as:

• Identification Data: Name, surname, e-mail address, telephone number.
• Account details: Username, password.
• Payment detailsBank details (e.g. IBAN), Payment method details.
• Navigation data: IP address, cookies, geolocalisation.

Personal data may also be processed for marketing purposes if the data subject has authorised this. If the data subject has given their prior consent, this may be withdrawn at any time, without jeopardising the lawfulness of the processing carried out on the basis of the consent previously given.

O Caldas da Rainh@ shopping district does not collect or process special categories of personal data (sensitive data), such as racial origin, religious beliefs, political opinions or health data.

When and how do we collect your personal data?

O Caldas da Rainh@ shopping district collects your personal data, namely by telephone, in writing, through its website, guaranteeing, whenever necessary, the prior consent of the holder of the personal data.

Some personal data is indispensable for the performance of the contract, without which the Caldas da Rainh@ shopping district will not be able to offer the product or service in question.

If the owner of the personal data is not a Customer/User of the Caldas da Rainh@ shopping district, In the event of a breach of this Policy, the respective personal data will only be processed when it is made available, in which case the rules of this Policy will apply.

The personal data collected may be processed by computer and in an automated or non-automated way, guaranteeing in all cases strict compliance with personal data protection legislation, being stored in specific databases created for this purpose and, under no circumstances, will the data collected be used for any purpose other than that for which it was collected or the consent of the data subject was given.

Who has access to personal data?

• Platform Management Team: The platform's management team has access to traders' and buyers' data, which is processed solely for the purposes of managing the platform. 
• Sellers: Sellers have access to buyers' information, but only to the extent necessary to process orders and provide services.

Without prejudice to the recipients indicated throughout this Policy, the Caldas da Rainh@ shopping district may communicate Users' personal data for the purpose of complying with legal obligations, in particular to police, judicial, tax and regulatory bodies.

All access to personal data is recorded and auditable, and is limited to authorised personnel on a need-to-know basis.

What are the purposes for processing personal data and the legal grounds for doing so?

In general, the personal data collected is based on and intended for the management of the contractual and commercial relationship, the provision of the contracted services, the adaptation of the services to the needs and interests of the User, namely for the purposes of access to specific functionalities, information and marketing actions.

In addition, personal data may also be processed for the purposes of complying with legal obligations.

The processing of personal data is based on the consent of the data subject, the performance of a contract, the fulfilment of legal obligations or the legitimate interest of the controller, as provided for in Article 6 of the GDPR.

How long do we keep your personal data?

The length of time for which personal data is stored and retained varies according to the purpose for which the information is processed.

In fact, there are legal requirements that oblige data to be kept for a minimum period of time. Therefore, whenever there is no specific legal requirement, the data will only be stored and kept for the minimum period necessary to fulfil the purposes for which it was collected or subsequently processed, under the terms defined by law.

Account and billing data will be kept for the period legally required for tax and accounting purposes (currently 10 years), after which it will be securely deleted.

What are your rights as a holder?

As holders of personal data, Users are guaranteed, at any time, the right to access, rectify, update, limit and delete their personal data (except for data that is indispensable for the provision of services by the company). Caldas da Rainh@ shopping district  or for the fulfilment of legal obligations to which the controller is subject), the right to object to the use of the data for commercial purposes by the data controller, or the right to object to the use of the data for commercial purposes by the data controller. Caldas da Rainh@ shopping district and withdrawal of consent, without this jeopardising the lawfulness of the processing carried out under that consent, as well as the right to data portability.

How can you access, rectify, update, limit, erase, oppose the processing of your personal data, or remove the sentiment?

Without prejudice to the provisions of the GDPR, the holder of personal data may do so, directly or by written request, addressed to the respective Data Controller, through the contact details provided for this purpose in this document, as well as other contact details provided by the company. Caldas da Rainh@ shopping district.

How can you object to receiving contacts for marketing purposes?

O Caldas da Rainh@ shopping district may promote publicity actions with its Users, namely by telephone, e-mail, SMS or any other electronic communications service, if the holder of the personal data has given their consent.

If the data subject no longer wishes to receive these communications, they can withdraw their consent to the use of their data for marketing purposes at any time.

How can you complain?

Without prejudice to the possibility of submitting complaints directly to Caldas da Rainh@ shopping district through the contacts made available for this purpose, the User can complain directly to the Supervisory Authority, which is the National Data Protection Commission (CNPD), using the contacts made available by this entity for this purpose.

What measures has the caldas da rainh@ shopping district adopted to ensure the security of your personal data?

O Caldas da Rainh@ shopping district is committed to guaranteeing the protection of the security of the personal data made available to it, and has approved and implemented strict rules in this regard. Compliance with these rules is an obligation of all those who legally access them.

Bearing in mind the concern and commitment that the Caldas da Rainh@ shopping district reveals that, in defence of personal data, various technical and organisational security measures have been adopted to protect the personal data made available to it against unauthorised disclosure, loss, misuse, alteration, processing or access, as well as against any other form of unlawful processing.

In addition, third parties who, in the context of the provision of services, process the personal data of the Customer/User in the name of and on behalf of the Caldas da Rainh@ shopping district, are obliged, in writing, to implement appropriate technical and security measures which, at all times, meet the requirements of the legislation in force and ensure the defence of the rights of the data subject (in particular, the protection of privacy and personal data).

Under what circumstances is data communicated to other entities (third parties and subcontractors)?

O Caldas da Rainh@ shopping district, As part of its business activity, the company may use third parties to provide certain services. Sometimes, the provision of these services implies access by these entities to Users' personal data. When this happens Caldas da Rainh@ shopping district takes the appropriate measures to ensure that the entities that have access to the data are reputable and offer the highest guarantees in this regard, which is duly enshrined and contractually safeguarded between the two organisations. Caldas da Rainh@ shopping district and the third party(ies).

Thus, any entity subcontracted by Caldas da Rainh@ shopping district will process Users' personal data in the name and on behalf of Caldas da Rainh@ shopping district and taking the necessary technical and organisational measures to protect personal data against accidental or unlawful destruction, accidental loss, alteration, unauthorised disclosure or access, and against all other unlawful forms of processing.

In any case, the Caldas da Rainh@ shopping district remains responsible for the personal data made available to it.

If data is transferred outside the European Economic Area, the Caldas da Rainh@ shopping district will ensure that it is only made to countries with an adequacy decision by the European Commission or with adequate contractual guarantees in accordance with the GDPR.

Under what circumstances do we transfer your personal data?

The provision of certain services by Caldas da Rainh@ shopping district may involve the transfer of your data outside Portugal, including outside the European Union or to International Organisations.

In this case, the Caldas da Rainh@ shopping district will strictly comply with the applicable legal provisions, in particular with regard to determining the suitability of the country or countries of destination with regard to the protection of personal data and the requirements applicable to such transfers, including, where applicable, the conclusion of appropriate contractual instruments that guarantee and respect the legal requirements in force.

How can you find out about any changes to the personal data protection policy?

To Caldas da Rainh@ shopping district reserves the right to make adjustments or changes to this Personal Data Protection Policy at any time.

Updated versions of this Policy will be published on the Caldas da Rainh@ shopping district, indicating the date of the last update.

Further information

For more information on the conditions of sale, returns and cookies, please consult the respective documents available on the Caldas da Rainh@ shopping district.