PRIVACY AND DATA PROCESSING POLICY OF RODRIGUES RIBEIRO & ASSOCIADOS, LDA.
This privacy and data processing policy applies specifically and exclusively to the activity of Rodrigues Ribeiro & Associados, Lda., legal entity no. 503838381, with registered office at Rua Roberto Ivens, no. 1280, Room 9, 4450-251 Matosinhos, hereinafter referred to as “RRA”.
Website
Each time you use the RRA website at www.rraconsultores.com, or when you otherwise interact with RRA (e.g., subscribing to the newsletter, pre-registering for training courses, requesting information via the contact form, submitting a suggestion/complaint via the contact form), the personal data you provide to us will be processed in accordance with this Privacy Policy and applicable legislation.
External links
The RRA website may contain links to websites and services of other entities, which have their own privacy policies; we recommend that you also carefully read the privacy policies of those entities. RRA is not responsible for the practices or content of third-party privacy policies.
COOKIES AND SIMILAR TECHNOLOGIES
The RRA website uses cookies and similar technologies to ensure its operation, improve the browsing experience, and measure website usage. For measurement and statistical purposes, RRA uses the Google Analytics service, which uses cookies/identifiers to measure interactions and website usage patterns.
Whenever non-essential cookies are used, the user will be informed and given the opportunity to grant or refuse their consent through the cookie preference management mechanism provided on the website.
The user may, at any time, change their cookie preferences through the same mechanism provided on the website.
Data collected and respective purposes
Through its website, RRA may collect the following personal data:
Newsletter subscription form
Name and email.
This data will be collected based on your consent, given freely, specifically, informedly, and unequivocally, through an explicit positive action. The submitted data will be processed and used exclusively for the purpose of distributing newsletters about RRA training courses, RRA training-action projects, news about services provided, and news about the company itself. The collected data will not be transmitted to third parties, except in situations related to legal imperatives or to the subcontractor(s) strictly necessary for the technical management of the newsletter delivery, when applicable.
Training course registration form
Title, first name, last name, email, telephone/mobile.
This data will be collected for pre-contractual procedures and for managing registration in the training course in question, as well as for the execution of the training contract, when applicable. The data provided may be used by RRA to communicate with the user in order to follow up on their registration for the training course. The collected data will not be transmitted to third parties, except in situations related to legal imperatives or when necessary for the operation of the training, including training management platforms, certification, invoicing, or technical support, through appropriate contracts with subcontractors.
Information request form
Company name, contact name, sector of activity, address, postal code, street code, email, telephone/mobile, requested information, description of requested information, how you heard about RRA.
This data will be collected to respond to the submitted information request and, when applicable, for pre-contractual procedures at the request of the data subject. The collected data will not be transmitted to third parties, except in situations related to legal imperatives.
Suggestion/complaint form
Course, name, email, address, postal code, telephone/mobile, detailed description.
This data will be collected for managing the communication received, processing the complaint or suggestion, and providing a possible response to the data subject. The collected data will not be transmitted to third parties, except in situations related to legal imperatives.
Paper forms for personal data collection
Applicable to trainees, employees, trainers, consultants, and other covered situations.
Personal data is collected based on the legal grounds applicable to each case, namely consent, contract execution, pre-contractual procedures, compliance with a legal obligation, or legitimate interest, as indicated on the corresponding form/printout. Detailed information on the collection and processing of data is provided on each form/printout.
Collection on paper is not necessarily based on consent; the legal basis varies depending on the purpose and the relationship with the data subject.
Furthermore, RRA does not accept the submission of unsolicited applications; therefore, if any user uses this website or the contacts disclosed here for that purpose, said application will be immediately deleted or archived only when necessary for internal management, information security, or compliance with legal obligations. Should employment opportunities exist at RRA, such situations will be disclosed through this website and/or through the company’s social media pages, and the collection and processing of data collected at that time and for that purpose will be duly clarified at that moment.
All personal data or unsolicited information sent by the respective subjects without prior consent or request from RRA will be deleted when there is no legal basis for its retention or processing. Deletion does not prejudice legal retention obligations nor any internal records necessary for proof, security, or the defense of RRA’s rights.
RRA does not intentionally collect personal information from minors under 18. If it detects that it has involuntarily collected personal information from minors under 18, RRA will take the necessary measures to delete the information as quickly as possible, unless required by applicable law to retain it or if processing is necessary for the provision of legally permissible and duly authorized services, when applicable.
In any case, the rights of data subjects under the GDPR will be scrupulously respected; to exercise these rights, you should send an email to rgpd@rraconsultores.com, providing detailed information on the information or action you wish to be provided or performed.
RRA frequently reviews its data collection, storage, and processing policies to ensure that it only collects, stores, and processes information essential for providing or improving services.
Data recipients
RRA may use subcontractors to support the provision of services and technological support, namely for:
- management of email communications and collaboration (for example, Microsoft 365);
- measurement and statistics of website usage (for example, Google Analytics).
In these cases, such entities may have access to personal data strictly necessary for the execution of the contracted tasks. RRA ensures that appropriate contractual instruments exist with subcontractors and that access is limited and subject to duties of confidentiality and security.
RRA may also communicate personal data when required by law, within the scope of judicial proceedings, or to competent authorities.
INTERNATIONAL DATA TRANSFERS
The use of certain technological providers may imply that personal data is processed outside the European Economic Area (EEA). Whenever international transfers occur, RRA ensures that these are carried out based on appropriate legal mechanisms provided for in the GDPR, namely adequacy decisions and/or standard contractual clauses (SCC), and other applicable guarantees.
In the case of Microsoft, it provides customers with EU Standard Contractual Clauses (EU Model Clauses/SCC) through its respective Data Protection Addendum (DPA) for covered services.
In the case of Google, the company describes that it maintains servers in different geographies and that information may be processed outside the user’s country, acting in accordance with legal transfer frameworks and applicable mechanisms.
Data controller
The entity responsible for processing your personal data is Rodrigues Ribeiro & Associados, Lda., a private legal entity with its registered office at Rua Roberto Ivens no. 1280, Room 9, 4450-251 Matosinhos, holder of legal entity identification number 503 838 381.
The user may contact RRA through the following means:
– Tel.: 229 397 490
– Email address: rgpd@rraconsultores.com
Data storage
RRA stores the personal data provided by the user on servers located in a secure environment, protected from unauthorized access, use, or disclosure. RRA adopts the technical, electronic, and organizational procedures necessary and appropriate to ensure the security of your personal data and prevent its loss, misuse, or unauthorized access.
Personal data contained in written documents is preserved and stored at our facilities and protected from unauthorized or controlled access by third parties. All RRA employees sign a statement of responsibility binding them to the security, secrecy, and confidentiality practices defined by the company.
RRA adopts appropriate procedures to ensure that your information is accurate, complete, and up to date, but depends on the user to update or correct their personal information when necessary.
Data collection via the internet involves risks inherent to any open network; RRA makes efforts to reduce these risks but cannot guarantee absolute security in the transmission of data over the public network.
This clause is not intended to exclude or limit RRA’s legal responsibilities when security failures, non-compliance, or violation of applicable legislation are attributable to it.
RRA does not make automated decisions nor does it carry out fully automated individual decisions with legal or significantly similar effects.
User rights
In accordance with applicable legislation, RRA undertakes to respect the confidentiality of your personal information and guarantee the exercise of your rights, namely:
a) Right to be informed: our visitors/customers have the right to obtain clear, transparent, and understandable information about how RRA uses their personal data.
b) Right of access: in addition to the right to information, you may request access to your personal data that we process and store. To this end, you should contact RRA via the email address rgpd@rraconsultores.com. Consequently, the email address you use to contact RRA will be used exclusively to respond to the request addressed to us. RRA will provide you with a copy of the personal data undergoing processing.
c) Right to rectification: you have the right to rectify your personal data if it is incorrect, outdated, or if you wish to complete it. To this end, you should contact RRA via the email address rgpd@rraconsultores.com. Consequently, the email address you use to contact RRA will be used exclusively to respond to the request addressed to us.
d) Right to erasure/right to be forgotten: you can request that we delete your data. To this end, you should address this request to the email address rgpd@rraconsultores.com. However, please take into consideration that this is not an absolute right, as we may have legal grounds or other legitimate interests for retaining your personal data.
e) Right to object, including to direct marketing: the user may, at any time, cancel their subscription to the newsletter; for this purpose, a “Cancel Newsletter” button will be provided in each newsletter. This request may also be addressed to us by telephone (229 397 490), email (rgpd@rraconsultores.com), or via the website.
f) Right to withdraw your consent for data processing at any time: you may withdraw your consent to data processing when said processing is based on your consent. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
g) Right to data portability: you have the right to move, copy, or transfer data from our database to another when applicable, namely when processing is based on consent or the execution of a contract and is carried out by automated means.
h) Right to restriction of processing: you have the right to request the restriction of the processing of your data in the following situations: if you contest the accuracy of the data, if the processing is unlawful and you do not want to delete your data but only restrict it, if the data is no longer necessary for RRA but necessary for the visitor/customer, or if you have exercised the right to object mentioned above, during the period in which RRA analyzes whether its legitimate interests for processing prevail over that right.
i) Right to lodge a complaint with the National Data Protection Commission (CNPD), without prejudice to any other administrative or judicial remedy.
To request the exercise of any of the rights listed above, in addition to the forms specifically mentioned in the respective paragraphs, you may send a communication addressed to the address identified above.
Duration for which we store data
We only keep personal data for the time necessary to achieve the purpose for which it was collected, to respond to your needs, or to comply with our legal obligations.
To determine the period for which we keep your data, we use the criteria mentioned below. If several criteria apply simultaneously, we will retain your personal data according to the criterion that implies the retention of your personal data for the longest period of time.
- When you contact us to ask questions, we will keep your personal data for the period of time necessary to resolve your question;
- When you have consented to the sending of the newsletter, we will keep your personal data until you cancel the subscription or ask us to delete it;
- When processing is necessary for compliance with a legal obligation, we will keep the data for the period required by law;
- Until the specific purpose applicable to certain data ceases to exist.
In any of the aforementioned situations, if there is a pending judicial or administrative offense proceeding, the data will be kept for the duration of the proceeding and up to six months after the final decision has been rendered.
We may also retain some of your personal data to the extent necessary to comply with our legal obligations, as well as to manage or enforce our rights, namely through judicial means.
Once the retention periods mentioned above have expired, personal data will be deleted and/or erased in a secure manner.
Guarantees
The data subject guarantees that the personal data communicated to RRA is correct and accurate and undertakes to notify any change or modification to it, and assumes exclusive responsibility for losses and damages caused by the erroneous, inaccurate, or incomplete communication of data to the extent permitted by applicable law.
The data subject is expressly warned that by disclosing personal data on RRA’s public channels such as Facebook, Twitter, LinkedIn, and Google+, this information may be seen and used by third parties. RRA does not read any personal communication published on its visitors’ own web pages.
RRA reserves the right to modify the Privacy Policy in light of new legal and/or regulatory requirements, for security reasons, or for the purpose of adapting said Policy to the instructions of data protection supervisory authorities.
Whenever any change is introduced to the Privacy Policy, the user will be informed of the changes through the RRA website.
RRA expresses its firm commitment to comply with the legislation in force at all times and to process your personal data in accordance with this privacy policy.
Security breaches
RRA continuously monitors its security and data protection policies. If for any reason an actual or potential security breach occurs, the following measures will be adopted:
Internal record of the incident and the measures adopted, when legally required.
Communication to the competent authorities and, when applicable, to the affected subjects;
Containment of the security breach;
Identification of the reasons for the security breach and implementation of appropriate solutions for its resolution;