BOL

Introduction

ETNAGA – Consultores Sistemas de Informação, hereinafter referred to as ETNAGA, operates in Portugal and specializes in the provision of accounting, financial management, and business consultancy services, with a focus on optimizing the administrative and financial processes of its clients.

For the purposes of the general data protection framework, ETNAGA is the entity responsible for the processing of personal data within the scope of providing its services. In this context, it processes data relating to its employees, clients, business partners, and any other individuals with whom it establishes relationships in the course of its activities.

The personal data processed by ETNAGA is managed in accordance with the applicable European regulations and national laws relating to the protection of personal information, namely:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, concerning the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation or “GDPR”); and
• Law No. 58/2019 of 8 August, which ensures the implementation of the GDPR within the Portuguese legal framework (“Law No. 58/2019”).

Given the importance placed on the privacy and protection of the personal data entrusted by data subjects, readers are encouraged to consult this “Privacy and Data Protection Policy”. However, for information regarding your personal data, please refer to the Personal Data page.

This Policy covers the information collected by ETNAGA from its clients, website users, and partners in the context of establishing contractual relationships and providing the services made available. Such information includes data that identifies or may be used to identify data subjects (“Personal Data”). It does not apply to information that does not reasonably allow the identification of data subjects, such as anonymised or aggregated data.

ETNAGA respects the privacy rights of its clients and is committed to protecting their privacy. This Policy explains the data processing practices applied to Personal Data and the rights of data subjects regarding the processing of such data.

Scope

ETNAGA’s Information Security Policy applies to all employees and suppliers, including employees of external entities or any other entities and/or individuals who access ETNAGA’s Information Systems. In this policy, the term “users” shall be used to refer to any of the individuals mentioned above.

This policy applies to all activities of the organisation and to all information under the organisation’s responsibility, regardless of the recording medium (paper, electronic, audiovisual, or otherwise).

Recipients

In addition to having appropriate access to the information necessary for the performance of their duties, all users must be aware of this policy and are required to comply with the implemented security controls.

Definitions

Term	Definition
Personal Data	Any information relating to an identified or identifiable natural person. A person is considered identifiable if they can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, electronic identifiers, or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural, or social identity.
Data Subject	The natural person to whom the personal data relates and who can be identified directly or indirectly through such data.
Data Controller	The entity that determines the purposes and means of processing personal data. For the purposes of this Policy, ETNAGA is the Data Controller.
Processor	The entity that processes personal data on behalf of the Data Controller, following the latter’s instructions.
Data Processing	Any operation or set of operations performed on personal data, such as collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, transmission, dissemination, comparison, interconnection, restriction, erasure, or destruction.
Consent	Any freely given, specific, informed, and explicit indication of the data subject’s wishes by which they, through a statement or clear affirmative action, signify agreement to the processing of their personal data for one or more specific purposes.
Sensitive Data	Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a person, data concerning health, or data concerning a person’s sex life or sexual orientation.
GDPR	General Data Protection Regulation (Regulation (EU) 2016/679), which establishes rules for the processing of personal data and the protection of data subjects’ privacy within the European Union.
Data Breach	A security breach leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data being processed.

Personal Data Collected

Within the scope of using the bol.pt website, ETNAGA may collect and process personal data of users who purchase tickets for events made available on the platform.

This data is necessary for the management of the commercial and pre-contractual relationship, for the provision of services associated with the platform, for processing purchases and tickets, as well as for compliance with applicable legal obligations. ETNAGA may access personal data entered or generated on the platform to the extent necessary for its operation, support, and management.

Categories of Personal Data Collected

ETNAGA processes personal data provided within the context of the relationship with the data subject, client, or prospective client, or within the scope of providing specific services, including, where applicable, the following categories of data:

• Identification, Family, and Contact Data

Name, address, telephone number, email address, signature (physical or digital), place of birth, marital status, Citizen Card details (identification document number, tax identification number (NIF), gender, date of birth, nationality, validity of the identification document, and tax address), IBAN, and, where applicable, details of the legal representative.

• Sensitive and Health Data

Records of accidents or physical disabilities, information regarding physical impairments, and criminal convictions, where strictly necessary for legal or contractual purposes.

• Technical and Browsing Data

IP address, session identifiers, browsing data, and information relating to interaction with and use of the Website.

• Additional Data

Any other data voluntarily provided by the data subject within the context of the provision of services, including information submitted through forms, registrations, or during interactions with the Website services.

• Cookies

Statistical information collected through cookies relating to the use of the website or ETNAGA’s digital platforms, in accordance with the client’s preferences and instructions.

Purposes of Personal Data Processing

Within the scope of its activities, ETNAGA collects and processes personal data for the following purposes:

• Compliance with Legal and Regulatory Obligations

Users’ Personal Data may be used for legal purposes or during stages leading to possible legal action arising from improper use of this Website or related services. The User acknowledges that the Website may be required to disclose Personal Data upon request by governmental authorities.

• System Logs and Maintenance

For operation and maintenance purposes, this Website and any third-party services may collect files that record interaction with this Website (System Logs) or use other Personal Data (such as IP addresses) for this purpose.

• Additional Information Regarding Users’ Personal Data

In addition to the information contained in this privacy policy, this Website may provide Users with additional and contextual information concerning specific services or the collection and processing of Personal Data upon request.

Whenever necessary, ETNAGA may also process personal data obtained from public sources or third parties, provided that such processing is lawful and complies with the applicable legal provisions.

Legal Grounds for Processing

The processing of personal data carried out by ETNAGA is based on one or more of the following legal grounds, as provided for in Article 6 of the GDPR:

• Consent of the Data Subject (Article 6.º, n.º1 subparagraph a) GDPR): Whenever the data subject provides explicit consent for the processing of personal data for specific purposes. Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out prior to the withdrawal.
• Performance of a Contract or Pre-Contractual Measures (Article 6.º, n.º1 subparagraph b) GDPR): Processing is necessary for the conclusion, performance, or management of contracts with the data subject, or for carrying out pre-contractual measures at the request of the data subject.
• Compliance with a Legal Obligation (Article 6.º, n.º1 subparagraph c) GDPR): Processing is necessary for compliance with legal obligations applicable to ETNAGA, such as those relating to tax, accounting, or anti-money laundering legislation.
• Legitimate Interests (Article 6.º, n.º1 subparagraph f) GDPR): Processing is necessary for the purposes of the legitimate interests pursued by ETNAGA or by third parties, provided that such interests are not overridden by the data subject’s fundamental rights and freedoms. These interests may include, for example, fraud prevention or defence in legal proceedings.

Sharing and Transfer of Personal Data Processed

ETNAGA is the primary recipient of the personal data collected, and its employees only have access to the data strictly necessary for the performance of their duties and for compliance with contractual and legal obligations.

Whenever data is transferred outside the European Union, ETNAGA ensures that processors or third parties comply with the applicable legal requirements, guaranteeing an adequate level of protection.

Personal data may also be shared with the following entities:

• 1.

  Cloudflare

  This website uses the services of Cloudflare, Inc. as a provider of content delivery network (CDN) services, security services, technical analytics services (Cloudflare Analytics), and Waiting Room management services, with the purpose of ensuring the availability, performance, protection, and stability of the website, including during periods of high traffic.

  Within the scope of providing these services, Cloudflare acts as a processor on behalf of the data controller and may process limited technical and personal data, namely:

  • IP address;
  • Approximate location data (country and city), which may be collected and stored by the data controller for statistical, security, and operational management purposes of the website, only when the user joins the waiting list;
  • Technical HTTP request information (date and time of access, requested URL, user-agent, referer);
  • Technical identifiers necessary for security management, attack mitigation, and operation of the Waiting Room service;
  • Aggregated statistical data relating to website traffic and performance, generated through simple navigation on the website.

  This data is processed exclusively for security purposes, abuse prevention, load balancing, technical analysis, and to ensure the proper functioning of the website, and is not used by the data controller for marketing or behavioural advertising purposes.

• 2.

  Google Analytics

  The website uses Google Analytics for statistical analysis and improvement of the user experience. No data is transmitted to Google Analytics without the user’s explicit consent for analytical cookies, in compliance with European legislation regarding cookies and data protection. Within the scope of providing these services, Google Analytics acts as a processor on behalf of the data controller.

  The data collected by Google Analytics is processed in an anonymised manner and retained for a period in accordance with the service settings and applicable legislation.

• 3.

  Meta Pixel

  The website uses Meta Pixel for statistical analysis, advertising campaign performance measurement, and optimisation of the user experience.

  Through this technology, it is possible to collect information relating to the user’s navigation on the website, namely pages visited, actions performed, and interactions with content, enabling the assessment of advertising campaign effectiveness and the display of more relevant advertisements. However, no data is transmitted to Meta without the user’s explicit consent for marketing cookies, in accordance with the applicable European legislation on cookies and data protection.

  Within the scope of providing these services, Meta acts as a processor or joint controller, in accordance with the applicable terms and conditions.

  The data collected is processed in an aggregated manner and retained for the period necessary for the purposes described above, in accordance with Meta’s policies and the applicable legislation.

• 4.

  TikTok Pixel

  The website uses TikTok Pixel for performance analysis, advertising campaign measurement, and personalisation of promotional content.

  This technology makes it possible to collect information regarding the use of the website, including pages visited, interactions carried out, and conversions, for the purpose of evaluating the effectiveness of advertising campaigns and displaying advertisements tailored to the user’s interests.

  The activation of TikTok Pixel depends on the user’s prior and explicit consent for marketing cookies, in accordance with the applicable European legislation on data protection and electronic communications.

  Within the scope of these services, TikTok may act as a processor or joint controller, in accordance with the applicable terms and conditions.

  The data collected is processed in an aggregated manner and retained for the period necessary for the purposes indicated, in compliance with TikTok’s policies and the applicable legislation.

Processing of Personal Data

Personal Data may be freely provided by the User or, in the case of Usage Data, collected automatically when using this Website. In addition, the personal data collected may be shared with event organisers for the purpose of contacting users regarding information related to the purchased event. This sharing is based on legitimate interest (Art. 6/1/f GDPR) or consent (Art. 6/1/a GDPR), as applicable. The data is shared through an API managed by ETNAGA, with technical and contractual measures in place to ensure GDPR compliance. Users may object to this sharing at any time through their profile or by contacting [email protected].

All Data requested by this Website is mandatory, and failure to provide such Data may make it impossible for this Website to provide its services. In cases where this Website specifically states that certain Data is not mandatory, Users are free not to communicate such Data without any consequences to the availability or functioning of this Website.

Users who have doubts regarding which Personal Data is mandatory are invited to contact ETNAGA via the email address [email protected].

Any use of cookies — or other tracking tools — by this Website shall be for the purpose of providing the services requested by the User, in addition to the other purposes described in this document and in the Cookie Policy.

Users are responsible for any third-party Personal Data obtained, published, or shared through this Website and confirm that they have the third party’s authorisation to provide such data.

Personal Data is collected for the following purposes and using the following services:

Advertising

This type of service allows User Data to be used for advertising communication purposes displayed in the form of banners and other advertisements on this Website, possibly based on the User’s interests.

This does not mean that all personal data is used for this purpose. Information and conditions of use are shown below.

Some of the services listed below may use cookies to identify Users or may use behavioural retargeting techniques, meaning displaying advertisements tailored to the User’s interests and behaviour, including those detected outside this Website. For more information, please consult the privacy policies of the relevant services.

In addition to any opt-out features offered by the services below, Users may opt out of a third-party service’s use of cookies by visiting the Network Advertising Initiative opt-out page.

• 1.

  Google AdSense (Google Inc.)

  Google AdSense is an advertising service provided by Google Inc. This service uses the “DoubleClick” cookie, which tracks the use of this Website and User behaviour relating to advertisements, products, and services offered.

  Users may disable all DoubleClick cookies by visiting: google.com/settings/ads/onweb/optout

  Personal Data collected: Cookies and Usage Data.

  Place of processing: USA – Privacy Policy – Opt Out

• 2.

  Meta Pixel (Meta)

  Meta Pixel is an advertising service provided by Meta Platforms Ireland Limited. This service uses cookies and similar technologies that make it possible to track the use of this Website and User behaviour relating to advertisements, products, and services offered on the Facebook and Instagram platforms.

  Users may disable advertisement personalisation through Meta’s ad settings at: https://www.facebook.com/adpreferences/ad_settings

  Personal Data collected: Cookies and Usage Data.

  Place of processing: EU/USA – Privacy Policy – Opt Out

• 3.

  TikTok Pixel

  TikTok Pixel is an advertising service provided by TikTok Technology Limited. This service uses cookies and similar technologies that make it possible to track the use of this Website and User behaviour relating to advertisements, products, and services displayed on the TikTok platform.

  Users may disable advertisement personalisation through TikTok’s privacy settings at: https://www.tiktok.com/settings/ads

  Personal Data collected: Cookies and Usage Data.

  Place of processing: EU/EEA and other countries – Privacy Policy – Opt Out

Behavioral Analysis

The services in this section allow this Website to monitor and analyze web traffic and can be used to track user behavior.

• 1.

  Google Analytics

  Google Analytics is a web analytics service provided by Google Inc. Google uses the collected data to track and examine the use of this Website, prepare reports on its activities, and share them with other Google services.

  Google may use the collected data to contextualize and personalize the ads of its own advertising network.

  Personal Data: Cookies and Usage Data.

  Place of processing: USA – Privacy Policy – Opt Out

• 2.

  Facebook Analytics for Apps

  Facebook Analytics for Apps is an analytics service provided by Facebook, Inc.

  Personal Data collected: Usage Data and various types of Data, as specified in the service’s privacy policy.

  Place of processing: USA – Privacy Policy

Contacting the User

• 1.

  Contact Form

  By filling out the contact form with their Data, Users authorize this Website to use those details to respond to requests for information, quotes, or any other type of request as indicated by the form’s title.

  Personal Data collected: Company Name, Location, Contact Person, Phone/Mobile, and Email

• 2.

  Mailing List and Newsletter

  When you sign up for the mailing list or newsletter, your email address will be added to the contact list of those who may receive emails containing commercial or promotional information about this Website. Your email address may also be added to this list as a result of your registration on this Website or after making a purchase.

  Personal Data Collected: Name and Email

Displaying content from external platforms

These types of services allow the User to view and interact with content on external platforms directly from the pages of this Website and to interact with them. If such a service is installed, it may collect web traffic data for the pages where the service is installed, even when Users are not actively using them.

• 1.

  Google Fonts (Google Inc.)

  Google Fonts is a font display service provided by Google Inc. that allows this Website to embed such content on its pages.

  Personal Data collected: Usage data and various types of data as specified in the service’s privacy policy.

  Place of processing: USA – Privacy Policy

• 2.

  YouTube video widget (Google Inc.)

  YouTube is a video content viewing service provided by Google Inc. that allows this Website to embed such content on its pages.

  Personal Data collected: Cookies and Usage Data.

  Place of processing: USA – Privacy Policy

Payment processing

Payment processing services allow this Website to process payments via credit card, bank transfer, or other means. To ensure greater security, this Website shares only the information necessary to execute the transaction with the financial intermediaries that manage the transaction.

Some of these services may also enable the sending of scheduled messages to the user, such as emails containing invoices or payment notifications.

• 1.

  PayPal

  PayPal is a payment service provided by PayPal Inc. that allows users to make online payments.

  Personal Data Collected: various types of data, as specified in the service’s privacy policy.

• 2.

  Klarna

  To offer Klarna’s payment methods, at the time of payment, we may transmit to Klarna during the purchase process your personal data included in the contact form and order details, so that Klarna can assess whether you meet the requirements to access its payment methods and to tailor those payment methods to your profile.

  Your personal data is processed in accordance with the provisions of Klarna’s privacy policy.

Location-Based Interactions

• 1.

  Geolocation

  This Website may collect, use, and share the User’s location data in order to provide location-based services.

  Most browsers and devices provide tools to opt out of this feature by default. If explicit consent is provided, the User’s location data may be tracked by this Website.

  Personal Data collected: geographic location.

• 2.

  Country validation via IP – IPStack

  This Website may send your IP address to the company IPStack in order to verify your country.

  Personal Data collected: IP address.

  Place of processing: Vienna, Austria – Privacy Policy

Registration and Authentication

By registering, Users are allowing this service to identify them and grant them access to the service. Depending on what is described below, registration and authentication services may be provided by third parties. In this case, this service may access certain Data stored by these third-party services for registration or identification purposes.

• 1.

  Direct Registration

  The User registers by filling out the registration form and providing Personal Data directly to this service.

  Personal Data collected: name, email, customer type, gender, date of birth, country, address, postal code, city, phone number, mobile phone number, tax ID.

• 2.

  Google OAuth (Google Inc.)

  Google OAuth is a registration and authentication service provided by Google Inc. and is connected to the Google network.

  Personal Data collected: name, unique user ID, and email address.

  Place of processing: USA – Privacy Policy

• 3.

  Windows Live Connect (Microsoft Corporation)

  Windows Live Connect is a registration and authentication service provided by Microsoft Corporation and is connected to the Microsoft network.

  Personal Data collected: name, unique user ID, and email address.

  Place of processing: USA – Privacy Policy

• 4.

  Facebook Authentication (Facebook, Inc.)

  Facebook Authentication is a registration and authentication service provided by Facebook, Inc. and is connected to the Facebook social network.

  Personal Data collected: name, unique user ID, and email address.

  Place of processing: USA – Privacy Policy

Anti-SPAM Protection

These types of services analyze traffic, which may contain Users’ Personal Data, in order to filter out traffic, messages, and content identified as SPAM.

• 1.

  Google reCAPTCHA

  Google reCAPTCHA is an anti-SPAM service provided by Google Inc.

  The use of reCAPTCHA is subject to Google’s privacy policy and terms of use.

  Personal Data collected: Cookies and Usage Data.

  Place of processing: USA – Privacy Policy

Technical Infrastructure and Website Security

Technical infrastructure and security services enable this Website to operate in a stable, secure, and efficient manner, ensuring the protection of users’ personal data against unauthorized access, loss, alteration, or improper disclosure.

• 1.

  Cloudflare (Cloudflare, Inc.)

  Cloudflare is a technical infrastructure and security service provided by Cloudflare, Inc. This service optimizes the performance and enhances the security of this Website by acting as a content delivery network (CDN) and a system to protect against malicious access.

  Cloudflare filters traffic between the User and the Website and may analyze access requests to prevent fraud, cyberattacks, and misuse of the service.

  Users can obtain more information about data processing and privacy settings at: https://www.cloudflare.com/privacypolicy/

  Personal Data collected: Cookies, IP address, and Usage Data.

  Place of processing: USA and other countries – Privacy Policy

Ticket Insurance

Insurance service covering no-shows at events.

• 1.

  RNA

  All personal data processed through RNA Seguros de Assistência’s channels is intended exclusively for the provision of services contracted by Customers and, therefore, for the fulfillment of the contractual relationship.

  In the course of its business activities, the categories of data that RNA Seguros de Assistência collects and/or processes may include the following: Name; Address; Tax ID; Mobile phone number; Email address; Policy number; Vehicle registration number;

  Place of processing: Portugal – Privacy Policy

Retention of Collected Personal Data

Retention periods for personal data

The personal data of BOL users will be retained only for as long as necessary to facilitate ticket purchases, manage the relevant transaction, provide user support, and comply with applicable legal obligations. After the purchase is completed or, where applicable, the usage period associated with the transaction ends, the data may be retained for additional periods whenever required by law or necessary for handling complaints, preventing fraud, validating transactions, complying with tax obligations, or exercising, defending, or proving rights in judicial or administrative proceedings. Relevant retention periods include:

• 7 years: Data related to the prevention of money laundering and terrorist financing, in accordance with Law No. 83/2017 (customer identification records and transaction records).
• 10 years: Data necessary for compliance with tax and accounting obligations, such as those required by the Tax Authority, including commercial bookkeeping and accounting records (Article 40 of the Commercial Code).
• 20 years: Data necessary for the exercise or defense of rights in judicial or administrative proceedings, in accordance with the ordinary statute of limitations under the Civil Code (Article 309)

Once the retention period has expired, personal data will be deleted or anonymized, unless its retention is necessary to comply with new legal obligations or to exercise legal rights.

Data Security

ETNAGA implements high standards of security and protection for personal data, adopting various technical and organizational measures to ensure the confidentiality, integrity, and availability of the data. These measures are designed to protect personal data against destruction, loss, accidental or unlawful alteration, disclosure, or unauthorized access, as well as against any other form of unlawful processing.

The security measures adopted include:

• Retention of data only for the period strictly necessary to fulfill the purpose for which it was collected;
• Logging systems for monitoring;
• Authentication tools;
• Data encryption.

ETNAGA is committed to reviewing and updating its security measures whenever necessary, ensuring the continuous protection of the personal data entrusted to it.

Rights of Data Subjects

Customers or potential customers, as data subjects, have the right to exercise the following rights in accordance with the General Data Protection Regulation (GDPR):

• Right of Access: The right to obtain information about which of your personal data is being processed, the purposes of the processing, retention periods, and other relevant details.
• Right to Rectification: The right to request the correction of your personal data that is inaccurate or to request that incomplete personal data be completed, such as your address, tax ID number, email address, phone numbers, or other details.
• Right to Erasure: The right to have your personal data erased, provided there are no valid grounds for retaining it, such as in cases where ETNAGA is required to retain the data to comply with a legal obligation or because legal proceedings are ongoing.
• Right to Data Portability: The right to receive the personal data you have provided to ETNAGA in a commonly used, machine-readable digital format, or to request that this data be transmitted directly to another entity, where technically feasible.
• Right to Restriction: The right to request the restriction of the processing of your personal data, in the form of:
  • Temporary suspension of processing;
  • Limiting the scope of processing to certain categories of data or specific purposes.
• Right to Withdraw Consent: The right to withdraw consent at any time for the processing of personal data based on the data subject’s consent. Withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal.
• Right to Object: The right to object to the processing of your personal data based on ETNAGA’s legitimate interest, provided there are no compelling or legitimate grounds that override your interests, rights, and freedoms, or for the defense of a legal claim in court proceedings.
• Right to File a Complaint: The right to file a complaint with the supervisory authority, the National Data Protection Commission (CNPD), if you believe your rights have been violated. Data subjects may also contact ETNAGA or the Data Protection Officer (DPO) directly to resolve issues related to the processing of their data.

To exercise any of the above-mentioned rights or to obtain clarification regarding this Privacy Policy, the customer or potential customer should contact ETNAGA in writing using the following contact information:

• Email: [email protected]
• Address: Rua Cesário Verde, 35-E, 2790-491 Queijas, Portugal
• Phone: 214 189 031 (weekdays, between 9:00 a.m. and 6:00 p.m.)

ETNAGA undertakes to respond to requests from data subjects within a maximum of one month, as stipulated by the GDPR, except in cases where the request is complex or there is a high volume of requests, in which case the deadline may be extended by an additional two months, with the data subject being informed of the extension and the reasons for it.

Data Protection Principles

• Principle of Fairness, Lawfulness, and Transparency: ETNAGA processes its customers’ personal data in a clear and objective manner, based on appropriate legal grounds and ensuring that data subjects are informed about the processing carried out.
• Principle of Purpose Limitation: ETNAGA uses personal data exclusively for the purposes specified at the time of collection, ensuring that it is not used for other purposes incompatible with those initially defined.
• Principle of Data Minimization: ETNAGA collects and retains only the personal data strictly necessary to fulfill the specified purposes, avoiding the processing of excessive or irrelevant data.
• Principle of Accuracy: ETNAGA takes all necessary measures to ensure that the personal data processed is accurate and up-to-date, allowing data subjects to request its correction whenever necessary.
• Principle of Data Retention Limitation: Personal data will be retained only for the period necessary to fulfill the purposes for which it was collected or for the periods stipulated by law, and will be deleted or anonymized upon the expiration of that period.
• Principle of Integrity and Confidentiality: ETNAGA implements appropriate technical and organizational measures to ensure the security of personal data, protecting it against unauthorized access, loss, destruction, or unauthorized alteration, as well as against any form of unlawful processing.

Subcontracting

The provision of services by ETNAGA may involve the use of subcontractors who process personal data on behalf of ETNAGA. These subcontractors may be engaged to provide technical support, document management, data storage, or other services related to the company’s activities.

ETNAGA ensures that contracts with subcontractors include appropriate technical and organizational measures to safeguard the protection and confidentiality of the personal data shared and processed. These measures comply with Article 28 of the GDPR, ensuring that subcontractors act solely on ETNAGA’s instructions and strictly adhere to applicable data protection standards.

In addition, ETNAGA periodically monitors its subcontractors to ensure that they maintain high standards of security and data protection, in line with legal and regulatory requirements.

Contact Information for the Data Controller

ETNAGA is the data controller responsible for processing the personal data of its customers and/or potential customers and can be contacted at:

ETNAGA, Consultores Sistemas de Informação, Lda.

Tax ID: 502669730

Address: Rua Cesário Verde, 35-E 2790-491 Queijas, Portugal

Phone: 214 189 031 (weekdays, between 9:00 a.m. and 6:00 p.m.)

Email: [email protected]

Website: http://www.ETNAGA.pt

Contact Information for the Data Protection Officer (DPO)

For any questions regarding this Privacy and Data Protection Policy, the processing of your personal data, or the exercise of your rights, the data subject may contact the DPO through the channels listed below:

Phone: (weekdays, between 9:00 a.m. and 6:00 p.m.)

Email: [email protected]

Updates to the Privacy and Data Protection Policy

ETNAGA reserves the right, at any time, to make adjustments or changes to this Privacy and Data Protection Policy in order to ensure compliance with legislative or regulatory changes, as well as to incorporate improvements related to its data protection practices.

Any changes to the Privacy and Data Protection Policy will be duly published on ETNAGA’s website or digital platforms, ensuring that data subjects are informed in a clear and accessible manner. Customers and users are advised to review this Policy regularly to stay up to date on the terms and conditions applicable to the processing of their personal data.