Personal Data collected and treated consist of the information regarding the name, email, address, date of birth, although there may be other Personal Data collected that may be necessary or convenient for service provision by GNG. After the Personal Data is collected, GNG provides the User with detailed information about the nature of the data collected and about the purpose and treatment that will take place regarding Personal Data. GNG also collects and treats information about the features of your hardware’s device and the features of the browser/software, as well as information about the pages visited by the User within the Website. This information may include your type of browser, the domain name, the time of access and hyperlinks through which the User accessed the Website (“Usability Information”). We will use this information only to improve the quality of your visit to our Website. Usability Information and Personal Data are designated in the present Privacy Policy as “User Data”. To the present Privacy Policy, a contractual relation should mean any and every contract signed between GNG and the entities related to it, regardless of the respective object.

Under the scope of the treatment of User Data, GNG uses or may use third parties, outsources by GNG, for GNG and on behalf of GNG, and according to the instructions provided by GNG, to proceed to the treatment of User Data, according to the law and the present Privacy Policy. These outsources entities may not communicate User Data to other entities without previous authorisation in writing by GNG and may not hire other entities without a previous authorisation by GNG. GNG assumes the commitment of only outsourcing entities that offer maximum security in the execution of adequate technical and organisational measures, to assure the defence of User rights. All the entities outsourced by GNG will be bound to the latter through a contract in writing which regulates, namely: the object and duration of the treatment, the nature and purpose of the treatment, the type of personal data, the categories of the data owners and the rights and obligations of the parties. Following the collection of personal data, GNG provides the User with information about the categories of the outsourced entities, which, in a specific case, may treat data on behalf of GNG.

GNG may collect data directly (i.e., directly from the User) or indirectly (i.e., through partner entities or third parties). The collection may be done through the following channels:

• Direct collection: presential, by phone, email and through the Website.
• Indirect collection: through partners or companies of the Group and official entities.

In terms of the general principles regarding the treatment of personal data, GNG commits to assure that User Data treated by GNG are:

• Object of a treatment according to the law, faithful and transparent regarding the User;
• Collected for determined ends that are objective and legitimate, not treated posteriorly in a way that is contrary to those purposes.
• Adequate, justified and limited to what is necessary regarding the purposes for which they are treated.
• Accurate and updated whenever necessary, with the provision of all the necessary measures so that inaccurate data are immediately deleted or corrected, considering the purposes of their treatment.
• Retained in a way that allows for the identification of the User only during the period necessary for the purposes for which the data is treated.
• Treated in a way that assures its security, including protection against its unauthorised or illegal treatment and against its loss, destruction, or unforeseen damages, with the adoption of adequate technical or organisational measures.

Data treatment by GNG is permitted and legal if at least one of the following situations is verified:

• The User gave his/her consent without any doubt, for the treatment of User Data for one or more specific purposes.
• The treatment is necessary to undertake a contract in which the User is a party, or for pre-contract procedures at the request of the User.
• The treatment is necessary to comply with a legal obligation to which GNG is subject to.
• The treatment is necessary for the defence of fundamental interests of the User or of any other legal person.
• The treatment is necessary for the purpose of the legal interests pursued by GNG or by third parties (except when User fundamental interests, rights or liberties prevail that require the protection of personal data).

GNG commits to assuring that User Data treatment is only done in the conditions mentioned above and respecting the principles mentioned above. When the treatment of User Data is done by GNG based on the consent of the User, he/she has the right to revoke his/her consent at any moment. The withdrawal of consent, however, does not compromise the legal value of the treatment made by GNG based on the consent previously given by the User.

The period during which data is stored and maintained varies according to the purpose for which information is treated. In fact, there are legal requirements that impose data retention for a minimum period. Thus, and whenever there is no specific legal obligation, data will be stored and retained only during the necessary minimum period for the purposes that motivated its collection and later treatment and, in its term, the same will be deleted.

In general terms, GNG uses User Data with the following purposes:

• Contact management with the User.
• Inform the User, if he/she requested it, about new products and services made available on the Website, offers and special campaigns, updated information about GNG’s activity and, in a general manner, for marketing purposes at GNG and through any media, including digital support or social media.
• Enable access to Website restricted areas, as is the case of the online store.
• To assure the Website responds to the needs of the User, through the development and publication of content that is the most adapted as possible to the requests and the type of User, the improvement of the Website’s research capacities and features and obtaining related information or statistics regarding the User’s profile type (consumption profile analysis).
• Service provision and other services, such as newsletters, opinion surveys or other information or products requested or bought by the User.
• Send satisfaction surveys.
• GNG may combine Usability Information with anonymous demographic information for research purposes and may use the result of this combination to provide the Website with more relevant content. In certain restricted areas of the Website, GNG may combine Personal Data with Usability Information to provide the User with a more customised content.

User Data collected by GNG are not shared with third parties without the consent of the User, except for the situations referred in the following paragraph. However, if the User hires services from GNG that are provided by other entities responsible for the treatment of personal data, the User Data may be consulted or accessed by these entities, if this is necessary for the provision of the said services and the User will be informed of this.

Under the applicable legal terms, GNG may transmit or communicate User Data to other entities if this transmission or communication is necessary for the execution of the contract established between the User and GNG, or for pre-contractual diligences at the request of the User, if this is necessary to comply with a legal obligation that GNG is subject to, or if this is necessary to obtain legitimate interests of GNG or third parties. If there is a transmission of the User Data to third parties, all efforts considered as reasonable will be taken for the transferee to use the User Data transmitted in an adequate form in compliance with this Privacy Policy.

To assure the utmost security of the User Data and the utmost confidentiality, GNG treats the information supplied in a confidential manner, according to its policies and internal procedures of security and confidentiality, which are regularly updated as necessary, as well as according to the legally foreseen terms and conditions.

Depending on the nature, scope, context, and purposes of data treatment, as well as the risks resulting from the treatment in terms of the rights and liberties of the User, GNG commits to applying, both at the time of the definition of the modes of treatment, and at the time of the treatment itself, the necessary and adequate technical and organisational measures for the protection of User Data and the compliance with legal impositions.

The communication between the user’s device and GNG is made through secure channels and communications using the HTTPS protocol and the SSL security standard.

Still, in terms of general measures, GNG adopts the following:

• Regular audits to identify the competence of the technical and organisational measures implemented.
• Awareness and training of the staff involved in the data treatment operations.
• Personal data encryption and coding.
• Mechanisms capable of assuring the permanent confidentiality, availability, and resilience of the information systems.
• Mechanisms that assure the reestablishment of information systems and the access to personal data in an agile way in case there is a physical or technical incident.

The Website does not transfer your personal data to end users located in countries outside the European Union.

When you visit our Website, a small text file (Cookie) is created and saved in your computer hard drive, and consequently, by browsing the Website, you will be accepting the installation of the text file in our device. This file will allow you to access the Website more quickly and easily, as well as to customise it according to your preferences.

If you wish to delete it or automatically define its blockage, in the “Help” menu on your browser, you will see how to perform those settings. However, in case you do not allow the use of cookies, there may be some Website functionalities that you will not be able to use.

By browsing our Website, you are authorising the collection and storage of small text files named cookies, which contain information, and which are downloaded to the computer or other User devices via a server. These text files will enable a more personalised and efficient browsing experience. During each visit to the Website, your Internet browser will send these cookies back to the Website, enabling the recognition and memorisation of the identity of the Users, as well as the User’s preferences.

For more information, please see our cookie policy here.

Information supplied to the User by GNG (when the data is collected directly from the User):

• The identity and contacts of GNG and the treatment officer.
• The contacts of the Data Protection Officer.
• The treatment purposes of the personal data as well as, if applicable, the legal reasons for the treatment.
• If the data treatment is based on GNG’s legitimate interests or third parties', an indication of such interests.
• If applicable, the recipients or categories of recipients of the personal data.
• If applicable, an indication that personal data will be transferred to another country or an international organisation and the existence or inexistence of a decision to adapt adopted by the Commission or the reference to guarantees of transfer that are appropriate or adequate.
• The retention period of the personal data.
• The right to request, to GNG, the permission for personal data, as well as its amendment, deletion or restriction, the right to oppose the treatment and the right to access the data.
• If the treatment of the data is based on the consent of the User, the right to withdraw it at any time, without compromising the legal value of the treatment made based on the previous consent.
• The right to file a claim at CNPD or any other control authority.
• An indication of whether the communication of personal data is a legal or contractual obligation, or a requirement necessary to sign a contract, as well as whether the holder is forced to supply the personal data and the eventual consequences of not supplying this data.
• If applicable, the existence of automatic decisions, including profile definition and information regarding the base concept, as well as the foreseen relevance and consequences of each treatment for the data owner.

In case the User Data is not collected directly by GNG from the User, besides the information referred above, the User is also informed about the categories of personal data object of treatment and about the origin of the data. Finally, the User will be informed of whether the data are from sources accessible to the public.

In case GNG intends to proceed to the later treatment of the User Data for a purpose other than the one the data were collected for, before the treatment, GNG will supply the User with information about this purpose and any other information of interests, under the terms referred above.

The information referred in 7.1. is provided in writing (including by electronic means) by GNG to the User before the treatment of the personal data. Under the terms of the applicable law, GNG has no obligation to provide the User with the information mentioned in 7.1. when and if the User is knowledgeable of this information. The information is supplied by GNG without any cost.

GNG guarantees the means that enable the consultation, by the User, of its Personal Data. The User has the right to obtain, from GNG, the confirmation that his/her personal data are not object of treatment, and if this is the case, the right to access his/her personal data and the following information:

• The purposes of the data treatment.
• The categories of the personal data.
• The recipients or categories of recipients to which the personal data have been or will be disclosed, namely the recipients established in other countries or belonging to international organisations.
• The retention period of the personal data.
• The right to request the amendment, deletion, or restriction of the treatment of personal data to GNG, or the right to prevent this treatment.
• To right to file a claim at CNPD or any other control authority.
• If the data is not collected from the User, the available information about the origin of the data.
• The existence of automatic decisions, including profile definition, and information regarding the underlying logic, as well as the foreseen relevance and consequences of such treatment for the data holder.
• The right to be informed about the adequate warranties associated to the transfer of data to other countries or international organisations.

Via a request, GNG will supply the User, without any cost, a copy of the User Data under treatment. The supply of other copies requested by the User may imply administrative costs.

The User has the right to request, at any moment, the amendment of his/her Personal Data and the right for any of his/her incomplete personal data to be completed, including through an additional declaration.

In case the data is amended, GNG will communicate to each recipient to whom the data has been transmitted, the respective amendment, except when such communication is considered impossible or implies an unproportioned effort for GNG.

The User has the right to obtain, from GNG, the deletion of his/her data if one of the following motives apply:

• User Data are no longer necessary for the purpose that motivated its collection or treatment.
• The User withdraws the consent on which the data treatment is based and there is no other legal basis for the referred treatment.
• The User opposes to the treatment under the right of opposition and if there are no prevailing legitimate interests that justify the treatment.
• In case the User Data is illegally treated.
• In case the User Data must be deleted to comply with a legal obligation that GNG is subject to.
• Under the legally applicable terms, GNG has no obligation to delete the User Data if the treatment reveals to be necessary to comply with a legal obligation that GNG is subject to or for the purposes of declaration, exercise, or defence of a right belonging to GNG in a legal procedure.

In case the data is deleted, GNG communicates to each recipient/entity to whom the data has been transmitted, the respective deletion, except if such communication reveals impossible, or implies an unproportionable effort for GNG.

When GNG makes User Data public and is forced to delete it under the right to that deletion, GNG commits to assure the measures that are reasonable for this purpose, including technical measures, considering the available technology and the costs of its application, to inform the officers for the effective treatment of personal data that the User requested the deletion of the connections to this personal data, as well as its copies or reproductions.

The User has the right to obtain, from GNG, the restriction of the treatment of User Data, if one of the following situations applies (the restriction consists of the insertion of a mark in the personal data retained with the purpose to limit its future treatment):

• If the accuracy of the personal data is contested, during a period that enables GNG to verify its accuracy.
• If the treatment is illicit and the User opposes to the deletion of the data, requesting, on the other hand, the restriction of its use.
• If GNG no longer needs the User Data for treatment purposes, but this data is requested by the User for the purposes of declaration, exercise, or defence of a right in a legal procedure.
• In case the User opposes to the treatment, until it is verified that GNG’s legitimate motives prevail over the User’s.

When the User Data are object of a restriction, the treatment will only be possible, except in the case of retention, with the consent of the User, or for purposes of declaration, exercise, or defence of a right in a legal proceeding, defence of the rights of another natural or legal person, or for motives of legally foreseen public interests.

The User that obtained the restriction over the treatment of his/her data in the cases referred above, will be informed by GNG before the treatment restriction is annulled.

In case of a restriction on the treatment of data, GNG will communicate to each recipient, to whom the data has been transmitted, its respective restriction, except if this communication reveals impossible or implies an unproportioned effort to GNG.

The User has the right to receive the personal data that regards him/her and that they supplied to GNG, in a structured format, of current use and automatic reading, and the right to transmit this data to another treatment officer, if:

• The treatment is based on consent or on a contract the User is part of; and
• The treatment is made by automatic means.

The right of portability does not include inferred data, or derived data, i.e., personal data generated by GNG consequently or resulting from the analysis of the data being treated.

The User is entitled to the direct transmission of his/her personal data between the ones responsible for the treatment, whenever this is technically possible.

The User has the right to oppose at any moment, for reasons related to his/her situation, the treatment of the personal data that regard him/her based on the exercise of legitimate interests prosecuted by GNG, or when the treatment is made for purposes that are not the ones for which this data was collected, including profile definition, or when personal data is treated for statistical purposes.

GNG will finalise the treatment of User Data, except if it presents urgent and legitimate reasons for this treatment that prevail over the interests, rights, and liberties of the User, or for purposes of declaration, exercise, or defence of a right of GNG in a legal proceeding.

When User Data is treated for marketing purposes, the User has the right to oppose at any moment to the treatment of the data that regard him/her for the purposes of the referred marketing, which includes profile definition if related to direct marketing. In case the User opposes to the treatment of his/her data for purposes of direct marketing, GNG will cease to treat the data for this purpose.

The User also has the right to not be subject to any decision taken exclusively based on automated treatment, including profile definition, that produces effects in its legal sphere or that affects the User significantly in a similar way, except if the decision:

• Is necessary for the signing or execution of a contract between the User and GNG.
• Is authorised by a legislation that GNG is subject to, or
• Is based on the explicit consent of the User.

The right of access, amendment, deletion, restriction, portability, and opposition may be exercised by the User via a contact with the Data Protection Officer of GNG via the email address dpo@gng.pt.

GNG will provide a response in writing (including by electronic means) at the request of the User in a maximum term of one month counting from the date of reception of the request, except in cases of particular complexity, when this term may be extended to up to two months.

If the requests presented by the User are manifestly unjustified or excessive, namely due to its repetitive character, GNG reserves the right to charge administrative costs or to refuse to follow up the request. To exercise any of these rights, you may fill in the form and address it to dpo@gng.pt.

In case of data violation and as far as such violation is susceptible of implying a high risk to the rights and liberties of the User, GNG commits to communication the personal data violation to the User in 72 days counting from the day GNG gained knowledge of the incident.

In legal terms, the communication to the User is not required in the following cases:

• In case GNG applied adequate protection measures, both technical and organisational, and these measures have been applied to personal data affected by the violation of personal data, especially measures that turn personal data incomprehensible to any person that is not authorised to access this data, such as through encryption.
• In case GNG took subsequent measures that assure that the high risk to the rights and liberties of the User is no longer susceptible of materialising; or
• In case the communication to the User implies an unproportionable effort for GNG. In this case, GNG will make a public communication or a similar measure through which the User will be informed.

GNG reserves the right to change the present Privacy Policy at any time. In case of modification of the Privacy Policy, the date of the last change, available at the end of this page, is also updated. In case the alteration is substantial, there will be a warning on the Website.

The Privacy Policy, as well as the collection, treatment, or communication of User Data, are governed by the provisions of Regulation (EU) 2016/679 from the European Parliament and the Council, from 27 April 2016 and by the legislation and regulation applicable in Portugal, namely Law 58/2019.

Any litigation because of the validity, interpretation, or execution of the Privacy Policy, or that is related to the collection, treatment, or communication of User Data, should be submitted exclusively to the jurisdiction of the judicial courts of the Porto District Court, without prejudice to the applicable imperative legal norms.