Privacy Policy
1. Mission
This policy aims to define the general principles and rules to be applied by Startup Portugal – Associação Portuguesa para a Promoção do Empreendedorismo (SPAPPE) to the Personal Data it collects and processes, taking into account the applicable legal standards and requirements, as well as serving as specific, explicit and informed notification about the processing of your data, in accordance with and in full compliance with current legislation on the protection and processing of personal data.
2. General principles
Startup Portugal collects and processes Personal Data in accordance with the following principles:
- Personal Data is processed lawfully, fairly and transparently;
- Personal Data is collected for specific, explicit and legitimate purposes, and is not processed in a way that is incompatible with those purposes;
- Personal data is processed under the principle of data minimization, ensuring that its processing is adequate, relevant and limited to what is strictly necessary to achieve the determined purposes;
- Personal Data is accurate and kept up-to-date whenever necessary, with appropriate measures being taken to ensure that inaccurate data is erased or rectified without delay;
- Personal Data is retained only for the period necessary for the specific purposes for which it is processed;
- Personal Data is processed in a way that guarantees its complete security, including its protection against unauthorized or unlawful processing or against accidental loss, destruction or damage.
- SPAPPE imposes the same level of protection for Personal Data and the same processing rules to which it commits in this policy, on all Recipients of Personal Data for whom SPAPPE is the data controller, through contracts and agreements for data processing.
Collection and Processing of Personal Data: Personal Data is considered to be any information relating to an identified or identifiable natural person (“Data Subject”), an identifiable natural person being one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, genetic, mental, economic, cultural or social identity of that natural person.
3. Processing of Personal Data
3.1. Responsible for Treatment
SPAPPE, headquartered at Rua de Salazares, nº 842, 4100-442 Porto, is responsible for the processing of Personal Data collected and processed under this policy, and can be contacted via email at contact@startupportugal.com.
3.2. Categories of Personal Data processed
The categories of data processed by SPAPPE may vary according to the purposes, and are processed strictly in pursuit of those specific purposes. For example, SPAPPE processes:
Identification data;
Contact data;
Health data;
Curriculum, academic and professional data;
Financial, banking and insurance-related data;
Browsing data (data collected by cookies).
3.3. Recipient of Personal Data
The data collected is processed by SPAPPE services or, in exceptional cases and always with a previously identified legal basis, by the data recipients, strictly to the extent necessary for the determined purposes. When personal data is transmitted to a third party, SPAPPE only provides personal data for which the data subject’s consent for transmission to third parties was explicitly obtained at the time of data collection, and imposes the same level of personal data protection and processing rules to which it commits in this policy through data processing agreements.
3.4. Transfer to third countries
SPAPPE undertakes not to transfer any personal data to third countries.
3.5. Purposes of collecting Personal Data
When visiting the SPAPPE website or during any interaction with SPAPPE services, you may be required to provide your Personal Data.
Therefore, SPAPPE informs you that it may collect your Personal Data through the following means:
Through cookies or similar technologies, such as Google Analytics;
When subscribing to communication and dissemination channels for initiatives and services provided by SPAPPE, such as newsletters;
When filling out forms or registering for SPAPPE projects and events;
When you contact SPAPPE for requests, clarifications, complaints, suggestions or information, through the various channels made available by SPAPPE;
Considering the diversity of its areas of activity, SPAPPE processes personal data for the following purposes:
Relationship with the data subject – When you contact SPAPPE and send us personal information, the information collected may be processed for the purposes of the relationship between SPAPPE and the data subject, in compliance with contractual, regulatory and/or legal obligations.
Organization of events and projects: Within the scope of its activity, SPAPPE only processes personal data that is strictly necessary for the execution of the projects and events to be carried out, guaranteeing that any operation of personal data processing is lawful and in accordance with all the requirements imposed by applicable legislation regarding the collection, processing and protection of personal data, and ensuring that such activities, whenever applicable, will be duly regulated through the signing of data processing agreements.
Contractual procedures – SPAPPE may process personal data for the purpose of preparing and executing contracts in which the data subject is a counterparty.
The communication of your personal data is not a legal obligation, but it may be necessary for the conclusion of a service contract, participation in an event or project, or any other case where the provision of personal data is essential. In these cases, failure to provide your data will result in the impossibility of entering into a contract, participating in, or maintaining a relationship with SPAPPE.
3.6. Legality of the Treatment
The processing of personal data of data subjects is carried out based on a legitimate interest in pursuing its activity, the intention to provide the best possible service to data subjects, the need to enter into and execute contracts, or the need to fully comply with applicable legal requirements.
SPAPPE only processes personal data if and to the extent that at least one of the following situations applies:
The data subject has given explicit consent to the processing of their personal data for one or more specific purposes;
The processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract;
The processing is necessary for compliance with a legal obligation, determined by Union law or national law, to which SPAPPE is subject;
The processing is necessary to protect the vital interests of the data subject or of another natural person;
The processing is necessary for the performance of a task carried out in the public interest.
3.7. Personal Data Retention Period
SPAPPE retains personal data only for the period necessary to achieve the purposes for which it is processed, unless another period is established by law or regulation.
If personal data is necessary for SPAPPE to verify compliance with contractual or other obligations, it will be kept until the limitation period for the corresponding rights has expired.
Furthermore, when, given SPAPPE’s status as a Public Utility Legal Entity, the nature and purpose of the processing, particularly for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, do not allow for determining in advance when the data are no longer necessary, SPAPPE retains the data, adopting appropriate technical and organizational measures to guarantee the rights of the data subject, including information regarding its retention.
3.8. Sharing of Personal Data
SPAPPE guarantees that:
Personal Data is not provided to third parties without a valid legal basis, previously identified at the time of data collection, including the prior and express consent of its owners;
It does not sell Personal Data to third parties under any circumstances.
Transfers Personal Data to third parties without observing the need to collect explicit consent, when the request is made by a judicial authority or public authority with legal powers to do so, in accordance with applicable legislation;
Ensures the security of Personal Data during transfer to the aforementioned recipients and guarantees, through data processing agreements, that third parties receiving the data based on the prior and express consent of the data subject ensure the same level of Personal Data protection and the same processing rules to which SPAPPE commits in this policy.
3.9. Rights of Data Subjects
SPAPPE ensures the exercise, under applicable legislation, of a set of rights for holders of personal data:
Right of access of the data subject – The data subject has the right to obtain from SPAPPE confirmation as to whether or not personal data concerning him or her are being processed and, if so, the right to be informed of the purposes for which the data are processed, the categories of data processed and whether there are any recipients or categories of recipients to whom the personal data have been or will be disclosed. Furthermore, the data subject has the right to be informed of the envisaged period for which the data will be stored, where possible, or the criteria used to determine that period where not possible.
Right to rectification – The data subject has the right to obtain from SPAPPE the rectification of inaccurate personal data concerning him or her.
Right to erasure of data (“right to be forgotten”) – The data subject has the right, under applicable law, to obtain the erasure of their data when one of the following grounds applies: (i) the data subject’s data are no longer necessary for the purpose for which they were collected or processed; (ii) the data subject withdraws consent on which the processing is based, exercising their right to withdraw consent, and there is no other legal basis for the processing; (iii) the data subject objects to the processing under the right to object; (iv) the data subject’s data are processed unlawfully; (v) the data subject’s data must be erased to comply with a legal obligation under Union law or national law to which SPAPPE is subject.
Right to restriction of processing – The data subject has the right, under applicable law, to obtain the restriction of the processing of their personal data by SPAPPE if one of the following situations applies: (i) if the accuracy of the personal data is contested, for a period enabling verification of its accuracy; (ii) if the processing is unlawful and the data subject opposes the erasure of the data, requesting instead the restriction of its use; (iii) if SPAPPE no longer needs the data subject’s data for processing purposes, but such data is required by the data subject for the establishment, exercise or defense of legal claims.
Right to object – The data subject has the right, under applicable law, to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her which is processed on the grounds of carrying out tasks carried out in the public interest.
Right to data portability – The data subject has the right, under applicable law, to receive the personal data concerning him or her in a structured, commonly used and machine-readable format, and the right to transmit those data to another controller, if: (i) the processing is based on consent or on a contract to which the data subject is a party and (ii) the processing is carried out by automated means.
Right to withdraw consent – When data processing is based on consent, the data subject has the right, under applicable law, to withdraw their consent at any time.
Right to lodge a complaint with the supervisory authority – The data subject has the right to lodge a complaint with the National Data Protection Commission (CNPD), using the contact details provided by this entity (www.cnpd.pt), in case of violation of the applicable rules regarding the processing and protection of their Personal Data.
The exercise of all stated rights by the holder, with the exception of the right to lodge a complaint with the supervisory authority, must be carried out by communicating with SPAPPE via email at contact@startupportugal.com, which will respond in writing within a maximum period of one month from receipt of the request, except in cases of particular complexity and a high number of requests, in which this period may be extended to two months.
4. Security Measures for the Processing of Personal Data
Taking into account the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risks, of varying likelihood and severity, to the rights and freedoms of natural persons, SPAPPE applies appropriate technical and organisational measures to ensure a level of security appropriate to the risk.
Thus, among other things, SPAPPE ensures the implementation of internal policies for controlling and restricting access, implementing different levels of access to Personal Data by its employees, based on the actual need to access them, as well as the regular evaluation of the effectiveness of the technical and organizational measures specifically adopted to guarantee the security of the processing of personal data.
5. Personal Data Breach
In the event of a personal data breach, and insofar as such a breach is likely to result in a risk to the rights and freedoms of the data subject, SPAPPE shall notify the CNPD of such breach within 72 hours of becoming aware of it.
Whenever a breach is likely to result in a high risk to the rights and freedoms of the data subject, SPAPPE will notify the data subject of the breach within 72 hours of becoming aware of it.
Any breach of personal data, for which SPAPPE is responsible, may be reported via email to contact@startupportugal.com.
6. Cookie Policy
SPAPPE implements a Cookie Policy, complying with the requirements set out in Law No. 41/2004, of August 18, as amended, and whose content is an integral part of this Privacy and Personal Data Protection Policy.
7. Changes to the Privacy Policy
SPAPPE reserves the right to make changes to this Privacy Policy, and such changes will be duly publicized on its website and/or other channels it deems appropriate.
Last updated: December 2024