The collection and processing of our customers’ personal data is carried out through our website at www.quintadoparal.com and complies with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation of the European Union – hereinafter referred to as GDPR) and Law no. 56/2019 of 8 August (Data Protection Law).
Access to our website is subject to the User being of legal age to consume alcoholic beverages.

1. Identity and contact details of the data controller:

The company “HERDADE TINTO E BRANCO, UNIPESSOAL, LDA.”, headquartered at Quinta do Paral, Apartado 31, 7960-131 Vidigueira, Portugal, registered at the Commercial Registry Office of Vidigueira with sole registration and tax identification number 508811880 with a share capital of two hundred and fifty thousand euros is responsible for the processing of personal data, by automated means, or not, (hereinafter also referred to as “Quinta do Paral”) such as the collection, registration, organisation, structuring, conservation, adaptation, or alteration, recovery, consultation, among other operations better identified in Article 4 (2) of the GDPR.
The contact details of the controller are as follows:

• +351 963 831 891
• msilva@quintadoparal.com

2. Information and consent:

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 or GDPR lays down rules on the protection of individuals regarding the processing of personal data and on the free movement of such data.
For the purposes of the GDPR, “personal data” shall mean information relating to an identified or identifiable natural person (data subject) and shall mean an identifiable natural person who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location details, identifiers by electronic means or to one or more elements specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. By making your personal data available, you expressly consent to their collection and processing under the terms defined in this Privacy and Personal Data Protection Policy, which is also applicable, regardless of whether you have completed the registration on our website or not.

3. Need and purposes of the processing of personal data:

The processing of personal data covers data provided directly by the data subject, data collected in the execution of a contract, to which the data subject is a party, or data collected for pre-contractual procedures, at the request of the data subject, and personal data requested from the data subject and processed with their consent.
The personal data collected shall be used, inter alia, for the following purposes:

1. To process orders, online orders and requests, information or clarifications from the respective subject, through the website identified above or applications;
2. To ensure compliance with the purchase and sale agreement or service agreement to be celebrated between the subject and Quinta do Paral;
3. To process requests for information on products, services, direct marketing communications, campaigns, promotions, statistical purposes, and personalised content, subject to prior consent;
4. To create a personal account intended to be used in the purchase of products through our website;
5. To process customer suggestions and complaints;
6. To request comments on products or services purchased;
7. To inform customers about the latest products and offer opportunities via e-mail, written messaging services, and postal mail;
8. To conduct profiles and analyses on customer behaviour;
9. To comply with legal obligations, including tax obligations;
10. To recover debts arising from supplies and services based on the execution of contracts, or their legitimate interest in asserting their right to such recovery.

4. Data transfer:

In addition to the obligations resulting from the GDPR and the Data Protection Law referred to above, regarding data protection or the safeguarding and protection of its own interests, Quinta do Paral will not share any personal data with third parties other than companies in its group, provided that aspects of completeness and security of the respective data are guaranteed.

5. Technical and organisational measures:

Quinta do Paral will continue to promote the implementation of measures that from a technical and organisational point of view are appropriate for the processing of personal data, namely against unauthorised access or any other form of unlawful or illegal processing. Quinta do Paral will continue to promote the guarantee, in addition to the internal protection of its facilities, of the limitation of access to personal data, to its employees only, subject to the duty of secrecy and confidentiality, for the fulfilment of the purposes of the processing.

6. Data retention period:

Quinta do Paral shall make reasonable efforts to ensure that it retains data relating to the data subject for the time necessary to carry out the purposes for which they were collected.
If a purchase and sale or service agreement has been celebrated, it will promote the retention of personal data during the term of the agreement plus the limitation and expiration periods of the associated rights. After this period, Quinta do Paral may retain them for the fulfilment of legal obligations and/or statistical purposes.
When the purpose for which the personal data were initially or subsequently processed ceases, the controller shall destroy or anonymise the data.

7. Exercise of rights of access, amendment, rectification, erasure, restriction of processing, objection, data portability, withdrawal of consent, non-provision (or partial provision):
   • a) The data subject has the right to obtain from the controller confirmation that the personal data relating to them are being processed and, where appropriate, the right to access their personal data and other information, in accordance with the provisions of the GDPR and the Data Protection Act;
   • b) The data subject shall have the right to obtain without undue delay from the controller the rectification of inaccurate personal data relating to them and take into consideration the purposes of the processing, shall have the right to have their incomplete personal data completed, including by means of an additional declaration.
   • c) The data subject shall have the right to obtain the data from the controller of their personal data, without undue delay, in particular where one of the following grounds applies:
     • c1) The personal data are no longer necessary for the purpose for which they were collected or processed;
     • c2) The data subject withdraws the consent on which the processing is based (where the processing is based on consent) and where there is no other legal ground for the processing;
     • c3) The personal data are processed unlawfully;
     • c4) The personal data must be erased in order to fulfil a legal obligation under EU or Member State law to which the controller is subject;
     • c5) The above in (c), (c1), (c2), (c3), and (c4) does not apply to the extent that the processing is necessary, under the terms and conditions provided for in the GDPR and in the Data Protection Act;
   • d) The data subject shall have the right to obtain from the controller the restriction of processing if one of the following applies:
     • d1) If they contest the accuracy of the personal data, during a period enabling the controller to verify their accuracy;
     • d2) The processing is unlawful and the data subject opposes their erasure and requests the restriction of their use instead;
     • d3) The controller no longer needs the personal data for the purposes of processing, but such data are required by the data subject for the purposes of establishment, exercise or defence of legal claims;
     • d4) The data subject objected to the processing under Article 21 (1), pending verification of whether the controller’s legitimate grounds prevail over those of the data subject.
     • d5). Where the processing has been restricted under (d1), (d2), (d3), and (d4), such personal data shall, with the exception of retention, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the EU or a member state;
     • d6) The data subject who has obtained the restriction of processing in accordance with (d1), (d2), (d3), and (d4) shall be informed by the the controller before the restriction on such processing is lifted;
     • e) The controller shall communicate to each recipient to whom the personal data have been transmitted any rectification or erasure of the personal data or restriction of processing carried out in accordance with the GDPR and the Data Protection Act, unless this proves impossible or involves a disproportionate effort;
       • e1) If the data subject so requests, the controller shall provide them with information on those recipients.
     • f) The data subject shall have the right to receive personal data relating to them that they have provided to a controller in a structured, current and machine-readable format, as well as the right to transmit such data to another controller, without the controller’s interference, provided that:
       • f1) The processing is based on consent, for the performance of an agreement to which the data subject is party or in order to carry out pre-contractual procedures at the request of the data subject;
       • f2) The processing is carried out by automated means;
     • g) The data subject shall have the right to object, at any time, on grounds relating to their particular situation, to the processing of personal data concerning them on the basis of their consent or on the basis of an agreement to which the data subject is a party or on the basis of pre-contractual procedures at the request of the data subject, including profiling;
       • g1) The data controller will no longer be able to process the personal data, unless they prove that there are compelling legitimate grounds for processing that data, which take precedence over the interests, rights, and personal freedoms of the data subject, or for the establishment, exercise or defence of rights in legal claims;
     • h) The non-provision or partial provision of personal data by its subject may restrict or make it impossible to perform the services, participate in events, campaigns or any promotional, commercial activities;
     • i) Where the processing of data results from the consent of the data subject or the execution of a contract to which the data subject is party or results from pre-contractual procedures at the request of the data subject, the data subject may withdraw consent at any time without affecting the lawfulness of the processing carried out based on the consent previously given.

8. Non-existence of automated decision-making

Quinta do Paral will not make any commercial decision based on automated decision-making or carry out any action leading to profiling, except under the conditions permitted under the General Regime for Civil Judicial Proceedings and the Data Protection Act.

9. Supervisory authority:

The supervisory authority is the Portuguese National Commission for Data Protection (CNPD) with headquarters at Av. D. Carlos I, 134, 1º, 1200-651 Lisbon, e-mail:: geral@cnpd.pt.