Information
Compliance with legislation regarding the protection of personal data and respect for the rights of individuals who interact with CASA DO MARQUÊS is a priority. Clients, Employees, Suppliers, and anyone who occasionally interacts with CASA DO MARQUÊS (including visitors to the website) can expect a high level of protection and respect for their rights from CASA DO MARQUÊS, which has adopted a diverse set of technical and organizational measures for this purpose.
refers to any information relating to an identified or identifiable individual (the "data subject") – an identifiable individual is considered to be one who can be identified, directly or indirectly, in particular by reference to an identifier (such as a name, identification number, location data, electronic identifiers) or one or more specific elements of the physical, physiological, genetic, mental, economic, cultural, or social identity of that individual.
This page aims to provide information on how CASA DO MARQUÊS processes personal data (any operation on personal data, including its access, collection, storage, organization, and use until its disappearance) in accordance with the General Data Protection Regulation, available at: https://eur-lex.europa.eu/legal-content/PT/ALL/?uri=celex%3A32016R0679
1. What personal data of Clients are collected by CASA DO MARQUÊS and from where are they collected?
CASA DO MARQUÊS does not collect, record, store, use, or communicate, by automated and/or non-automated means — including the creation of a personal data database or profiling — the personal data of its Clients.
The information and personal data in our possession are solely for the purpose of providing our services, as duly contracted and detailed in the service contracts signed with our clients. These data are retained, at a minimum, for the duration of a contractual relationship between CASA DO MARQUÊS and its Client or for a longer period if required by law or by legitimate interests of CASA DO MARQUÊS or third parties. CASA DO MARQUÊS may also collect and use personal data from individuals who are not Clients, as further explained below.
CASA DO MARQUÊS classifies the personal data of its Clients into the following categories:
Identification data: may include full or abbreviated name; gender; date of birth/age; marital status; citizen card number; social security number; passport number; other number issued by a competent authority (tax identification number; driver's license, national health system user, etc.); nationality; academic titles; images of identity cards, passports, driver's licenses, and signatures; photographs.
Family data: may include the name and contact details of relatives, dependents, or information regarding the composition of the family unit.
Contact data: may include address, telephone number, email address.
Employment data: may include sector and area of activity; hierarchical position; name of current employer and past employers; professional address; telephone number of workplace, professional email address.
Qualification data: may include data on professional and academic training.
Financial data: may include residential address; bank account number.
CASA DO MARQUÊS will treat Client's personal data as strictly confidential in accordance with applicable legal and regulatory rules, having adopted technical and organizational measures to prevent — to the best of its abilities and responsibilities — third parties from making improper use of them, and conditioning the transfer or transmission, when legally possible, to the express acceptance, by the assignee, of the confidentiality obligation referred to above.
The personal data to which CASA DO MARQUÊS has access mainly result from being provided by the Client in the context of the commercial relationship established with CASA DO MARQUÊS.
2. Is there any legal obligation to provide personal data to CASA DO MARQUÊS?
In the context of contractual relationships established between CASA DO MARQUÊS and its Clients, the Client must transmit a set of personal data that are essential for the formation of contractual will by CASA DO MARQUÊS and subsequently for execution according to the terms agreed upon.
Regarding anything that is not essential for the conclusion of the contract or the provision of a service by CASA DO MARQUÊS — whether by legal requirement or by legitimate interest of CASA DO MARQUÊS — the communication of personal data depends entirely on the Client's choice.
Likewise, in the absence of any contractual relationship established, personal data that third parties communicate to CASA DO MARQUÊS, of which they are the data subjects, is not subject to a legal obligation, and the non-communication of such data does not entail any consequences for third parties. The communication of personal data depends entirely on the data subject's choice.
3. Why does CASA DO MARQUÊS process personal data of Clients (purpose of processing) and other data subjects? What is the legal basis for processing?
CASA DO MARQUÊS informs the Client that it is legally authorized, regardless of the Client's consent, to:
I. process the personal data of the Client necessary for the execution of contracts concluded with CASA DO MARQUÊS or for pre-contractual measures at the Client's request;
- process the personal data of the Client necessary for compliance with legal obligations to which CASA DO MARQUÊS is subject;
All other processing of personal data and other purposes of processing that do not fall within the scope defined above depend, for their lawfulness, on the consent of the Client, which must be freely, specifically, informed, and explicitly given. This means that in all processing of personal data that exceeds the scope identified in this paragraph, the Client can always refuse their consent, without such consent being a requirement for the conclusion of the service provision contract or any other contract with CASA DO MARQUÊS. On the other hand, the consent that has been given at a certain time can always be withdrawn.
CASA DO MARQUÊS processes personal data for various purposes and with different legal bases::
a) To allow for the conclusion, execution, and management of contractual relationships established with the Client, including the performance or management of related operations.
For example:
– Contact details provided by the Client at the time of contract conclusion, or immediately preceding phases of the contract, which constituted the necessary and obligatory steps for its conclusion, are maintained for the entire duration of the commercial relationship, to prove the conclusion of a contract, identify the counterparty, authenticate their instructions, and send them contractual communications and notifications.
b) Compliance with applicable legal or regulatory provisions and pursuit of CASA DO MARQUÊS' activity.
For example:
– CASA DO MARQUÊS is legally obliged to obtain various documentation that allows it to identify its Client and may have to conduct exhaustive due diligence on the Client and the origin of the data provided, by virtue of anti-money laundering and counter-terrorism financing legislation, for which CASA DO MARQUÊS may need to access publicly available information about the Client, as well as request various information from them;
c) Pursuit of CASA DO MARQUÊS' legitimate interests.
For example:
– CASA DO MARQUÊS may use the contact details it has access to under the contract concluded with the Clients for the purpose of communicating to Clients about products and services provided by CASA DO MARQUÊS, without prejudice to the Client's right to object if they do not wish to receive such communications;
– CASA DO MARQUÊS may use the email address for communicating declarative tax obligations, information about tax amounts, withholdings, or other amounts to be delivered to the state and also for information on amounts owed by CASA DO MARQUÊS as a result of services provided under the established contract or expressly requested by the client and, although falling within the scope of the services offered, are excluded from the scope of the established contract;
– CASA DO MARQUÊS may also use personal data for the pursuit of the legitimate interests of the Client, namely obtaining exemptions or tax benefits associated with the accounting information processed.
d) Consent
Whenever the aforementioned legal grounds do not exist, the processing of personal data of the Client depends on the Client's Consent or other data subjects processed by CASA DO MARQUÊS. In this regard, the Client may have authorized CASA DO MARQUÊS at the time of establishing the service provision contract to be able to use contact data and store them in specific databases for the purpose of promoting and advertising products and services of CASA DO MARQUÊS;
Regarding Potential Clients, as previously defined, the maintenance of information about identity and contacts and their use in communications for marketing purposes, regardless of the means used, always depends on their consent.
In general, CASA DO MARQUÊS categorized the purposes of processing personal data as follows:
Onboarding: data processing for the purpose of contracting new clients and compliance with CASA DO MARQUÊS' internal policies and procedures for client onboarding.
Investigations: data processing necessary for the detection, prevention, and investigation of situations of non-compliance with internal policies and situations of fraud.
Security: data processing to ensure the physical security of CASA DO MARQUÊS' facilities (including records of visits to CASA DO MARQUÊS' facilities and records from video surveillance cameras) and security of the computer system (including access records and details of access to the computer system).
Recruitment: data processing for the purpose of the recruitment process for hiring Employees.
Employment relationship: data processing for the purpose of executing the employment relationship, including records of working and non-working times and payment of salaries.
Safety and health: data processing necessary to comply with legal obligations regarding safety and health at work.
Legal compliance: data processing necessary to ensure that CASA DO MARQUÊS complies with legal obligations to which it is subject.
Legal proceedings: data processing necessary for the exercise of rights that CASA DO MARQUÊS holds.
Financial management: data processing for supplier management, compliance with tax obligations, management of CASA DO MARQUÊS' financing, accounting records, and financial audit.
Marketing/Prospecting: data processing for the purpose of communication with clients or potential clients (including email, telephone, SMS messages, posts on social networks, or personal communications), and for maintaining and updating contact information for these purposes.
Governance of products and services: data processing necessary for the identification of relevant issues related to the services provided by CASA DO MARQUÊS. Planning improvements in services. Offering new services.
Products and services: data processing necessary to execute and administer contractual relationships established between CASA DO MARQUÊS and its Clients and related tasks. Including communications established for these purposes and services.
Operation of websites: data processing necessary for the operation and management of CASA DO MARQUÊS' websites and applications and other information and communication and interaction through websites.
Information Technology Management: Data processing necessary for managing the communication system of CASA DO MARQUÊS, operating security measures for information technology systems, and auditing these systems.
4. Who can access personal data?
Regarding the personal data held by CASA DO MARQUÊS, access is granted to employees of CASA DO MARQUÊS who require access to fulfill the aforementioned processing purposes. In this regard, CASA DO MARQUÊS has implemented technical and organizational measures to limit access to the minimum necessary on a need-to-know basis, aiming to maximize security regarding this data.
As previously mentioned, CASA DO MARQUÊS may also need to provide information about the Client to various competent authorities (such as the Tax Authority, Social Security, Public Prosecutor's Office, criminal police bodies, etc.), both national and international, to fulfill obligations within criminal proceedings, investigations of money laundering and terrorism financing, judicial processes, or fiscal matters, and in general, whenever required by law.
CASA DO MARQUÊS may also need to transmit personal data of Clients to third parties to execute the contracts concluded with the Clients or instructions given to it, to the extent that such transmission is a sine qua non condition for the execution of these contracts or instructions.
CASA DO MARQUÊS may transmit personal data of Clients to third parties, with adequate contractual safeguards in place and with scrupulous respect for rules on confidentiality and personal data protection, resorting to anonymization of data whenever required by the way its activity and organization are structured and based on contractual partnerships established. For example, CASA DO MARQUÊS may use outsourcing services for physical document archiving or outsourcing of IT systems for electronic data archiving or service provision (cloud computing).
5. How long are personal data retained?
Personal data are retained by CASA DO MARQUÊS based on the purpose that justifies their processing. As a general rule, CASA DO MARQUÊS will not retain personal data after the reasons justifying their processing have ceased, unless retention is required by law.
It should be noted that some personal data, duly deleted from the various CASA DO MARQUÊS databases, may need to be retained in CASA DO MARQUÊS' backup files. This retention is subject to strict rules regarding access or their return to the computer system, insofar as such retention is required by the security rules related to CASA DO MARQUÊS' computer system, particularly those related to business continuity.
The commercial relationship is generally established for an indefinite period concerning the service provision contract. Therefore, the personal data maintained for purposes of executing operations related to the contract or a legitimate interest based on the contract will last, at least, for the duration of that contractual relationship. It should be noted that even after the termination of the contract, some records may need to remain accessible due to legal requirements or may be necessary to demonstrate the terms of the contractual relationship. In the Portuguese legal system, since the ordinary prescription period is 10 years, it may be necessary to keep records of personal data for at least that period.
6. What are the rights of Clients regarding personal data?
Whenever the Client or any other data subject has authorized the processing of personal data for one or more specific purposes, and such processing can only be lawfully carried out based on that consent as no other grounds for processing are applicable, as informed in point 3 of this Information Document, the Client has the right to withdraw their consent at any time. To do so, they should contact CASA DO MARQUÊS in writing.
Regarding the processing of personal data justified by CASA DO MARQUÊS' legitimate interests, as informed in point 3 of this Information Document, and whenever CASA DO MARQUÊS processes data for purposes other than those for which the personal data were collected, the Client or other data subjects have the right to object at any time, on grounds relating to their particular situation, to the processing of data concerning them, including profiling (right to object).
The right to object includes the objection to personal data being processed for direct marketing purposes by CASA DO MARQUÊS. In other words, the Client can always object at any time to CASA DO MARQUÊS using their contact details for advertising purposes concerning its products and services.
Under data protection legislation, the Client has the right:
a) To access, request the update, or rectification of their personal data (rights of access and rectification) by contacting CASA DO MARQUÊS in writing; and also,
b) Regarding personal data provided to CASA DO MARQUÊS by the Client, either under a contract or based on consent, to request that they be delivered to them or to a different data controller designated by them, in a structured, commonly used, and machine-readable format (right to data portability) by contacting CASA DO MARQUÊS in writing;
c) Under the conditions defined in data protection legislation, including (i) whenever the data are no longer necessary for the purpose that justified their collection or processing; (ii) whenever consent is withdrawn and no other legal grounds for processing exist; (iii) when the right to object has been exercised and no overriding legitimate grounds for processing exist, the Client has the right to request the deletion (right to be forgotten) by contacting CASA DO MARQUÊS in writing;
d) Under the conditions defined in data protection legislation, to request that data processed by CASA DO MARQUÊS be subject to restricted processing, in which case the data can only be retained by CASA DO MARQUÊS or used with the data subject’s consent or for the establishment, exercise, or defense of legal claims (right to restriction of processing) by contacting CASA DO MARQUÊS in writing.
The data subject has the right to be informed by CASA DO MARQUÊS about the measures taken following the exercise of their rights without undue delay and within 30 days after receiving the request, unless an extension is legally permissible. The measures taken are generally free of charge. If requests are manifestly unfounded or excessive, CASA DO MARQUÊS may charge a reasonable fee based on the administrative costs of providing the information or communication or may even refuse the request.
7. Contact Us
For any inquiries or requests related to personal data protection, you can contact us via email at comunicacao@casadomarques.pt.