Helexia II Energy Services, LDA, with Tax ID No. 513 932 704 and head office at Avenida Miguel Bombarda 36, 10th floor 1050-050 Lisbon ("Helexia"), for the purpose of operating the domain www.helexia.pt ("Website"), processes personal data, i.e. information relating to an identified or identifiable natural person ("Data Subject(s)"), an identifiable person being a natural person who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, electronic identifiers, or to one or more specific elements of that natural person's physical, physiological, genetic, mental, economic, cultural or social identity ("Personal Data").
The use of the Website by any user will be governed by the Terms and Conditions of use ("Terms and Conditions"), and their use implies acceptance by the User.
Helexia, when determining the purposes and means of processing Personal Data, shall be qualified as the Controller of Personal Data, ensuring compliance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 and other applicable data protection and privacy legislation ("Data Protection Legislation").
Under the terms of the Data Protection Legislation, HELEXIA strives to process Personal Data in accordance with all applicable principles, namely: i) Principle of Lawfulness, Fairness and Transparency; ii) Principle of Purpose Limitation; iii) Principle of Data Minimization; iv) Principle of Accuracy; v) Principle of Retention; and, vi) Principle of Integrity and Confidentiality.
Accordingly, this Data Protection and Privacy Policy ("Privacy Policy") is hereby established, and Helexia undertakes to perform any and all Personal Data processing operations in accordance with the provisions of the following points:
GROUNDS FOR LAWFULNESS AND PURPOSES OF DATA PROCESSING
The Personal Data of Data Subjects shall be processed by Helexia on the following grounds of lawfulness:
Foundations of Lawfulness What do they consist of?
Consent
The Data Subject may consent to the processing by freely expressing his or her free, specific, informed and explicit will, by which he or she accepts, through a declaration (in writing or orally) or an unequivocal positive act (by filling in an option), that his or her Personal Data be processed.
Pre-contractual due diligence or the execution of a contract
Personal Data may be processed if necessary, but not limited to, for the performance of a contract to provide services and/or supply products to which you are a party as an employee, customer and/or supplier, or to carry out pre-contractual diligence at your request.
Fulfillment of a legal obligation
Personal Data may be processed to ensure and guarantee compliance with legal obligations to which Helexia is bound.
Defense of vital interests of the Data Subject
Personal Data may be processed to ensure the protection of the vital interests of the Data Subject, in particular when processing is essential for his or her life.
Legitimate Interests
Helexia, other controllers or third parties may process Personal Data provided that such processing does not adversely affect your interests or your fundamental rights and freedoms.
PROCESSING OF PERSONAL DATA ON THE WEBSITE
Helexia handles Data Subject Personal Data within the scope of the Website as follows:
| Purpose | Treatment activities | Term foundation lawfulness | Conservation term basis |
| Website Management | Web Browsing Data Analysis and Processing | Execution of the contract, the terms of which are governed by the Website Terms and Conditions | Up to 3 months after the last visit to the Website |
| Making Contacts | Contact a Helexia collaborator | Unequivocal Consent | For a period of 1 year, unless a legal deadline applies |
| Commercial and marketing activities | Newsletter Communication | Consent | Up to 1 year after the last contact |
PERSONAL DATA HANDLED ON THE WEBSITE
For the purposes stated HELEXIA processes the following Personal Data:
| PURPOSE | PERSONAL DATA |
| Website Management | Personally Identifiable Information, Contact Information, Authentication and Access Information [electronic identifier (Mac and IP), connection start date/time, connection end date/time, web browsing source, URL visited, social network address, social network interaction history, or host name] and/or Web Browsing Information (commonly known as Cookies) |
| Making Contacts | Personal Identification Data, Contact Data |
| Commercial and marketing activities | Personal Identification Data, Contact Data |
METHODS OF TREATMENT
The processing of Personal Data will be performed automatically and manually by IT tools, applying logics strictly related to the purposes and, in any case, promoting the security and confidentiality of Personal Data.
DISCLOSURE AND TRANSMISSION OF PERSONAL DATA
Helexia employees will process Personal Data of Data Subjects for the performance of their work duties and will process Personal Data exclusively as specified in this Privacy Policy.
Personal Data may be made available to third parties charged with providing services to Helexia ("Subcontractors") who are bound by a written agreement and will process the data in accordance with this Privacy Policy and may not process it, directly or indirectly, for any other purpose, for their own benefit or for the benefit of any third party.
In the case of compliance with legal obligations, the Personal Data of Data Subjects may be transmitted to third parties for their own purposes, namely banks and insurance companies, judicial, administrative, supervisory or regulatory authorities, and also entities that lawfully carry out data compilation, fraud prevention and anti-fraud actions.
FOREIGN TRANSFERS
Helexia may transfer Data Subject Personal Data outside the European Economic Area ("EEA") to locations that may not guarantee the same level of protection.
However, if applicable, Helexia will only transfer Personal Data outside the EEA in accordance with the following measures:
- When the transfer is made to a location or by a method or under circumstances that the European Commission considers to ensure adequate protection of Personal Data;
- When you have implemented standard contractual data protection clauses approved by the European Commission or a competent supervisory authority; or,
- When none of the previous options apply, but the law nevertheless authorizes such a transfer, for example, if it is necessary for the declaration, exercise or defense of a right in legal proceedings.
You may request detailed information about the security measures Helexia has in place regarding transfers of Personal Data outside the EEA and, where applicable, a copy of Helexia's standard data protection clauses through the contacts provided in Section 10.
RIGHTS OF DATA SUBJECTS
Under the terms of the Data Protection Legislation, current or future, Helexia informs you that the Data Holders have the right to access, rectification, limitation, portability, erasure and the right to object to the processing of Personal Data, in certain circumstances, which may be exercised under the terms of this section of the Privacy Policy.
| RIGHTS | What do they consist of? |
| Right to provide information | The Data Subject has the right to obtain clear, transparent and easily understandable information about how HELEXIA uses his/her Personal Data and what his/her rights are. This is why HELEXIA provides all this information in this Privacy Policy. |
| Right of Access | You have the right to obtain information about what Personal Data Helexia is processing (if any) and certain information (similar to that provided in this Privacy Policy) about how that Personal Data is processed. Helexia may refuse to provide the information requested where to do so would require Helexia to disclose Personal Data of another natural person or where the information would adversely impact the rights of another natural person. |
| Right of rectification | If the Data Subject's Personal Data is incorrect or incomplete (for example, if his or her name or address is wrong), a request may be directed to Helexia to take reasonable steps to correct it. |
| Right to erasure of Personal Data | This right is also known as the "right to be forgotten" and, in simple terms, allows the Data Subject to request the erasure or deletion of their data, provided that there are no valid grounds for Helexia to continue using them or their use is unlawful. This is not a generic right to erasure, as exceptions are possible (for example, where such data is necessary for the defence of a right in legal proceedings). |
| Right to limitation of treatment | You have the right to "block" or prevent further use of your Data while Helexia evaluates a request for rectification or as an alternative to erasure. Where Processing is limited, Helexia may still store your data, but may not use it further. Helexia maintains a list of data subjects who have requested "blocking" of the future use of their data to ensure that this limitation is respected |
| Right to Personal Data Portability | The Data Subject has the right to obtain and re-use certain Personal Data for his/her own purposes in various organizations. This right applies only to own Data provided to HELEXIA and which HELEXIA processes with consent and those processed by automated means. |
| Right to opposition | The Data Subject shall have the right to object to certain types of processing, on grounds relating to their particular situation, at any time when such processing is carried out for the purposes of the legitimate interest of Helexia or a third party. Helexia may continue to process such data if Helexia proves the existence of "compelling legitimate grounds for the processing which override your interests, rights and freedoms" or if such Personal Data are necessary for the establishment, exercise or defence of legal claims |
| Right to file a complaint | The Data Subject has the right to lodge a complaint with the competent supervisory authority, the National Commission for Data Protection (Comissão Nacional de Proteção de Dados - CNPD), if he/she considers that the processing performed on the Personal Data violates his/her rights and/or the Data Protection Legislation. |
Where the lawful ground for processing your personal data is consent or legitimate interest, you may respectively withdraw consent or object to the processing at any time, without this being of any consequence to you, but without this compromising the lawfulness of the processing carried out in the meantime. In the event of consent being withdrawn or express opposition, Helexia shall immediately cease processing your personal data for the purpose in question, unless the data needs to be processed in order to comply with legal and/or contractual obligations.
You may at any time, in writing, exercise the rights enshrined in the Data Protection Legislation and other applicable legislation through the means described in Section 10 of this Privacy Policy.
SECURITY AND CONFIDENTIALITY
To ensure the security and confidentiality of Personal Data, protected databases are used, among others, adequate firewalls and passwords, in accordance with the provisions of the Data Protection Legislation. Access to Personal Data is only possible to authorized employees who have a genuine need to use Personal Data, in accordance with the principles of security and confidentiality. Violations of this Privacy Policy by HELEXIA employees may lead to disciplinary action. Compliance with HELEXIA's standards and procedures is monitored and checked periodically.
COOKIES
HOW TO CONTACT HELEXIA ON PRIVACY AND DATA PROTECTION ISSUES
Data Subjects may exercise their rights by contacting Helexia by sending an email to the saibamais@helexia.eu mailbox.
Data Subjects may also contact the Helexia Personal Data Protection Officer by sending an e-mail to the mailbox at saibamais@helexia.eu.