The procedures must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are treated.
Personal data can only be processed when the purpose of the processing cannot be achieved by other means.

Procedures must be accurate and updated whenever necessary.

All appropriate measures must be taken to ensure that inaccurate data, having regard to the purposes for which it is processed, is erased without delay.

The data must be kept in a way that allows the identification of the data subjects only for the period necessary for the purposes for which they are processed.

The data controller must implement a policy for maintaining, archiving and deleting the data in order to ensure that it is not kept for a period longer than the period strictly necessary.

The data must be treated in a way that guarantees its security, including protection against its unauthorized or illicit treatment and against its accidental loss, destruction or damage, adopting the appropriate technical or organizational measures.

The controller must be able to demonstrate that the holder of the personal data has consented freely and in an informed manner. A consent given orally or even through tacit or other consent does not offer these guarantees, as it does not allow proof of having been obtained in a free, specific, informed, explicit way and through the unambiguous act.

The controller of personal data must ensure, in accordance with Article 5 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016:
a) That the personal data you have are legitimate and are limited to what is necessary;
b) That the data are up-to-date, secure and confidential;
c) That it has policies, procedures, codes of conduct, internal instructions formalized and capable of being made available to the supervisory entities;

d) That it has systems in place to monitor whether the policies and procedures being followed;
e) Implement the permanent and dynamic mechanism for verifying compliance with the General Data Protection Regulation;
f) Proving evidence of compliance with the General Regulation on Data Protection;
g) Promote audits within the scope of a continuous control to verify the effectiveness of the implemented measures and, eventually, modify them;

The data controller is obliged to notify the control entity, which in Portugal is the National Data Protection Commission, of all data breaches with risk to the data subject, and this communication must be made within 72 hours, in pursuant to Article 33 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.

APPLICATION OF THE REGULATION

The personal data that is collected in the company are:
a) Name, address, telephone number, e-mail address of buyers and sellers;
b) Name, tax number, identification document number, marital status and address of employees and collaborators.

The data is obtained in several ways:
a) Through a contract signed with the seller, collaborator and employee;
b) By contacting customers by e-mail, or visiting our website where interested parties enter their personal data;
c) By calling the company and vice versa;
d) By physical visit of the store;
e) By personal contact, through verbal consent.

When collecting data through contracts or data collection with direct contact with the person, the person is informed of his rights and asked for his consent to the processing of data.

In the case of telephone contact, the employee who collects the data, informs the person concerned that he / she will then send an email with the person’s data,

asking you to respond by giving your express consent to the processing of data.

All data collected, CRM (Customer Relationship Management) and archived company documents are introduced.

The data is encrypted.

The manager, subcontractors and employees, responsible for data processing, are the only ones with access to them.

All data contained in physical documents, whether they are customer visit forms, mediation contracts, copies of purchase and sale lease agreements, or others, are kept in the company’s file.

Eventually, it should improve the application of the regulation.

The personal data of each user will be maintained as long as the user’s subscription and / or requests are active, with the aim of improving the services offered, so that after their expiry, they will be depersonalized and not identifiable.

Providers of personal data are allowed to question the data and may request the deletion of the data, rectification, updating or completing the same. These requests should be sent to [email protected].