PRIVACY POLICY
I GENERALITIES
1. INTRODUCTION
This document is an integral part of the normative body for the protection of personal data of The Lost Garden, taking into consideration the General Data Protection Regulations (2016/679), GDPR.
Whenever this document is updated new version will be made available, immediately after its approval.
Monitoring the compliance with this standard will be assured by measuring the indicators of assessment of controls and/or audits (internal or external), at regular time intervals, or when significant changes occur.
Scope and objective
This Privacy Policy has been implemented for the purpose of demonstrating the commitment and respect for the privacy rules and personal data protection.
Why this Privacy Policy?
This Privacy Policy arises because we intend to know the general rules of privacy and treatment of your personal data, which we collect and treat in strict respect and complying with national and community personal data protection law.
The Lost Garden pledges to respect best practices in the domain of personal data security and protection, having to the approved purpose a demanding program, capable of cautioning the protection of the data that are made available to us by all those who in some way relate to The Lost Garden
What covers this Privacy Policy?
This Privacy Policy applies exclusively to the collection and treatment of personal data made by The Lost Garden.
Recipients
This Privacy Policy is intended for the general public and in particular for customers of The Lost Garden and establishes bonds to all employees of the organization.
Definitions
Personal Data – All information regarding an singular person identified or identifiable; is identifiable a singular person identifiable who can be identified, directly or indirectly, such as a name, identification number, location data, electronically identifiers, or to one or more physical identity-specific elements, physiological, genetics, mental , economic, cultural, or social of that singular.
Special Categories of Personal Data – Personal data revealing racial or ethnic origin, political views, religious or philosophical convictions, or the union membership of a singular person, as well as the treatment of genetic data, biometric data to identify a person of unambiguous way, data concerning health or data regarding sexual life or sexual orientation.
Treatment – It is the operation or a set of operations made on personal data or personal data sets, by automated or non-auto-auto-auto-sized means such as collection, registration, organization, structuring, conservation, adaptation or change, the recovery, consultation, use, disclosure by transmission, diffusion, or any other form of provision, comparison or interconnection, limitation, erasure, or destruction.
Treatment Responsible – It is the singular or collective person, the public authority, the agency or other body that, individually or in conjunction with others, determines the purposes and means of handling personal data; whenever the purposes and means of that treatment are determined by the Union right or a Member State, the treatment responsible or the specific criteria applicable to their appointment may be provided by the Union right or a Member State.
Violation of Personal Data – It is a breach of security that causes, accidental or illicit mode, destruction, loss, change, disclosure, or access, unauthorized, personal data transmitted, conserved or subject to any other type of treatment.
Subcontractor (DPO) - Is a singular or collective person, the public authority, agency, or other body treating personal data on account of the treatment officer of theirs.
Third – Is a singular or collective person, public authority, service or body other than the data holder, treatment officer, subcontractor, and persons who, under the direct authority of the treatment or subcontractor officer, are authorized to treat personal data.
2. TITULAR DATA COLLECTION AND TREATMENT
As part of The Lost Garden activity occurs the collection, registration, organization, conservation and consultation of personal data. Other operations or set of operations may still occur which, pursuant to the General Data Protection Regulations are denominated by “personal data treatment”.
The personal data collected respect not only to employees but also to vendors, candidates and customers.
The Lost Garden collects personal data, namely, the data required for the reserves and billing thereof, as well as employees' personal data for legal employability purposes.
At the collection of Personal Data, The Lost Garden provides to data holders detailed information is on the nature of the data collected and the purpose of the purpose and treatment that will be carried out regarding personal data, and, well, the information mentioned in the relative clause to the right of access to personal data.
3.SUBCONTRACTED ENTITIES
As part of the holder's data treatment, The Lost Garden appeals or may appeal to third entities, undercontracted by you, so that in your behalf, and under the instructions given by you, to proceed to the treatment of the holder's data, in strict compliance with the provisions of law and this Privacy Policy.
These subcontracted entities will not be able to transmit the holder's data to other entities without The Lost Garden having, previously and in writing, permission for this, also being hindered from hiring other entities without prior authorization.
The Lost Garden takes a commitment to subcontracting only entities that submit sufficient guarantees of execution of the proper technical and organizational measures in order to ensure the advocacy of the holder’s rights. All subcontracted entities are linked to The Lost Garden through a written contract in which they are regulated, namely, the object and duration of treatment, the nature and purpose of the treatment, the type of personal data, the categories of data holders and the rights and obligations of the parties.
When collecting the personal data, The Lost Garden provides the data holder with information about the categories of subcontracted entity that, in the concrete case, can effect data treatments on their behalf.
4.DATA COLLECTED CANALS
The Lost Garden can collect data directly (i.e., directly from the holder) or indirectly (i.e., through partner entities or third parties).
The collection can be made through the following channels:
. Direct Collection: In-Pentially, by phone or by email;
. Indirect collection: through partners or booking companies and official entities.
5.GENERAL PRINTS APPLICABLE TO TITULAR DATA TREATMENT
In terms of general principles concerning the treatment of personal data, The Lost Garden is committed to ensuring that the holder's data treated by you are:
. Object of a licital, loyal and transparent treatment with respect to the data holder;
. Collected for determined, explicit and legitimate purposes, and is not later treated in a manner incompatible with these purposes;
. Suitable, pertinent, and limited to what is required regarding the purposes for which they are treated;
. Exacts and updated whenever necessary, all adequate measures are adopted for the inexact data, taking into account the purposes for which they are treated, be erased or rectified without delay;
. Conserved in a way that allows the identification of the data holder only for the period required for the purposes for which the data is treated;
. Treaties in a way that ensures its safety, including protection against their unauthorized or illicit treatment and against their loss, destruction, or accidental damage, and appropriate technical or organizational measures being adopted.
The data treatments made by The Lost Garden are lawful when at least one of the following is found:
. The data holder has given its explicit consent to the treatment of data holder data for one or more specific purposes;
. Treatment is necessary for the execution of a contract in which the data holder is a party, or for pre-contractual diligences at the request of the data holder;
. Treatment is necessary for compliance with a legal obligation to which The Lost Garden is subject;
. Treatment is necessary for the defense of vital interests of the data holder or another singular person;
. Treatment is necessary for the purpose of legitimate interests pursued by The Lost Garden or third parties (except if the fundaevered interests or fundamental liberties are prevailing the data holder requiring the protection of personal data).
The Lost Garden is committed to ensuring that the treatment of the holder’s data is done only under the conditions listed above and with respect for the above-mentioned principles.
When the treatment of the holder’s data is carried out based on the consent of the data holder, he has the right to withdraw his consent at any time. The withdrawal of the consent, all, does not compromise the bidding of the treatment made by us based on the consent previously given by the data holder.
The time period during which data is stored and conserved varies according to the purpose for which the information is treated.
Effectively, there are legal requirements that force to conserve the data for a minimum time period. Thus, and whenever there is no legal requirement specifies, the data will be stored and preserved only for the minimum period required for the purposes that have motivated their collection or their later treatment, with which the same will be eliminated.
6. TITULAR DATA TREATMENT USE AND PHINALITIES
In general terms, The Lost Garden uses data holder data for various purposes, namely billing and collecting to personal data holder, for marketing purposes and for human resource management and recruitment of employees.
The incumbent data collected by The Lost Garden is not shared with third parties without the holder consent, with the exception of the situations referred to in the paragraph to follow. However, in the event that the holder hires with The Lost Garden services that are provided by other entities responsible for handling personal data, the holder's data may be consulted or accessed by these entities, to the extent that this is necessary to the provision of said services.
Under applicable legal terms, The Lost Garden may transmit or communicate the holder's data to other entities in the event of such broadcast or communication is necessary for the execution of the contract established between the holder and The Lost Garden, or for pre-contractual; at the holder's request, in case it is necessary for compliance with a legal obligation to which The Lost Garden is subject to or in the event that it is necessary for the purpose of the pursuit of legitimate interests of The Lost Garden or third. A transmission of data from the holder to third parties occurring, the efforts deemed to be reasonable will be made for the transmissary to use the holder data consigned consently with this Privacy Policy.
7. TECHNICAL, ORGANIZATIVE AND SECURITY MEASURES IMPLEMENTED
To ensure the security of the incumbent data and maximum confidentiality, The Lost Garden treats the information provided to it absolutely confidentially, according to its internal security and confidentiality policies and procedures, which are updated periodically depending on the needs, as well as in accordance with the legally envisioned terms and conditions.
As a function of nature, scope, context, and purposes of data treatment as well as risks arising from treatment for the holder's rights and freedoms, The Lost Garden commits to apply, both at the time of defining means of treatment as at the time of the treatment itself, the necessary technical and organizational measures necessary and appropriate to the protection of the holder's data and compliance with the legal requirements.
It is also committed to ensuring that, by default, only the data is treated that is required for each specific treatment purpose and that these data is not made available without human intervention to an indeterminate number of people.
In terms of general measures, The Lost Garden adopts the following:
. Regular audits with a view to adhering to the effectiveness of technical and organizational measures implemented;
. Awareness and training of personnel implicated in data treatment operations;
. Mechanisms capable of ensuring permanent confidentiality, availability and resilience of information systems;
. Mechanisms ensuring the restoration of information systems and access to personal data in a timely manner in the event of a physical or technical incident;
8. DATA TRANSFER FOR OUT OF EUROPEY UNION
Personal data collected and used by The Lost Garden is not made available to third parties established outside the European Union. If, in the future, this transfer happens, The Lost Garden commits to ensuring that the transfer observes the applicable legal provisions, namely as to the determination of such a country's adequacy with respect to data protection and the requirements applicable to such transfers .
II. DATA TITULAR RIGHTS
1. RIGHT TO INFORMATION
Information provided to the holder by The Lost Garden (when data is collected directly from the dataholder):
. The identity and contacts of The Lost Garden, in charge of the treatment, and if applicable, its representative;
. The purposes of the treatment for which personal data is intended, as well as, if applicable, the legal foundation for treatment;
. If treatment of data is based on legitimate interests of The Lost Garden or a third, indication of such interests;
. If applicable, recipients or categories of personal data recipients;
. If applicable, indication that personal data will be transferred to a third country or an international organization, and the existence or not of an adequacy decision adopted by the Commission or the reference to appropriate or appropriate transfer guarantees;
. Personal data conservation term;
. The right to request The Lost Garden for access to personal data, as well as its rectification, erasure, or limitation, the right to oppose treatment and the right to portability of data;
. If the treatment of the data is based on the holder's consent, the right to withdraw consent at any time, without compromising the bidding of the treatment made based on the consent previously given;
. The right to file claim with the CNPD (National Data Protection Commission) or other control authority;
. Indication whether or not personal data communication is a legal or contractual obligation, or a necessary requirement to enter into a contract, as well as if the holder is required to provide personal data and any consequences of not providing that data;
. If applicable, the existence of automated decisions, including the definition of profiles, and information regarding the underlying logic as well as the importance and anticipated consequences of such treatment for the data holder.
In the event that the holder's data is not directly collected by The Lost Garden from the data holder, in addition to the information mentioned above, the holder is additionally informed to the categories of personal data categories and, well so, will accerate the source of the data and eventually come from public-accessible sources.
In the event that The Lost Garden intends to proceed with later treatment of the holder's data for a purpose other than the one for which the data has been collected, before that treatment will provide the holder about that purpose and any other pertinent information, under the above.
Procedures and measures implemented with a view to fulfillment of the right to information:
. The supra information mentioned is provided in writing (including by electronic means) by The Lost Garden to the holder before handling the treatment of personal data concerned. Under the applicable law, The Lost Garden has no obligation to provide the holder this information when and to the extent that the holder is already aware of them.
. The information is provided by The Lost Garden as a free.
2.PERSONAL DATA ACCESS RIGHT
The Lost Garden guarantees the means that allow access, by the data holder, to your personal data.
The data holder has the right to obtain from The Lost Garden the confirmation that personal data concerning it is or not the subject of treatment and being the case, the right to access your personal data and the following information:
. The data treatment purposes;
. The categories of personal data in question;
. The recipients or categories of recipients to whom personal data were or will be disclosed, namely recipients established in third or belonging to international organizations;
. The period of conservation of personal data;
. Right to request rectification, erasure, or limitation of the treatment of personal data, or the right to oppose that treatment;
. Right to file claim with the CNPD or other control authority;
. If the data has not been collected from the holder, the available information about the source of this data;
. The existence of automated decisions, including the definition of profiles, and information regarding the underlying logic as well as the predicted importance and consequences of such treatment for the data holder;
. Right to be informed of appropriate guarantees associated with transfer of data to third countries or international organizations.
Upon request, The Lost Garden will provide the data holder, in a free basis, a copy of their data found in the treatment stage. Providing other copies requested by the holder may carry administrative costs.
3. RIGHT OF PERSONAL DATA RETIFICATION
The data holder has the right to request, at any time, to rectify your Personal data and, well, the right that your incomplete personal data is completed, including by an additional statement.
In the event of data rectification, The Lost Garden communicates to each recipient to whom the data have been transmitted the respective rectification, unless such a communication proves impossible or implying a disproportionate effort for The Lost Garden.
4. RIGHT TO PERSONAL DATA APAYMENT (“RIGHT BE BE HOLDER”)
The data holder has the right to obtain, by The Lost Garden, the erasure of its data when one of the following reasons apply:
. The holder's data is no longer necessary for the purpose that has motivated their collection or treatment;
. The holder to withdraw the consent on which the treatment of the data is based and there is no other legal foundation for said treatment;
. The holder oppose treatment under opposition right and there is no prevailing legitimate interests justifying treatment;
. Should the holder's data be treated idly;
. Should the holder data have to be erased for compliance with a legal obligation to which The Lost Garden is subject.
Under applicable legal terms, The Lost Garden has no obligation to erase the holder's data to the extent the treatment is revealed to be required to comply with a legal obligation to which it is subject or for the purpose of declaration, exercise or advocacy of a right of The Lost Garden in a lawsuit.
In the event of data erasure, The Lost Garden communicates with each recipient/entity to whom the data have been transmitted the respective erasure, unless such communication proves impossible or implying a disproportionate effort for The Lost Garden.
When The Lost Garden has made public the holder's data and is required to erase it under the right to erasure, it is committed to assure measures that are reasonable, including technical character, taking into consideration the available technology and the costs of their application, to inform the effective treatment officers of personal data that the holder has requested them to erase the connections to this personal data as well as the copies or reproductions thereof.
5. LIMITATION LIMITATION OF THE TREATMENT OF THE PERSONAL DATA
The data holder has the right to obtain, by The Lost Garden, the limitation of the holder's data treatment, if one of the following is applied (limitation is to enter a mark in the personal data conserved with the purpose of limiting their treatment in the future):
. If you challenge the accuracy of personal data, during a period to allow The Lost Garden to check your accuracy;
. If the treatment is illicit and the data holder opposes the erasure of the data, in contrast requesting the limitation of its use;.
If The Lost Garden no longer needs the holder's data for treatment purposes, but that data is required by the data holder for the purpose of declaring, exercise or advocacy of a right in a court proceeding;
. In the event the incumbent opposed to treatment, until it is found that The Lost Garden's legitimate reasons prevail over the incumbent's.
Where the holder's data is the subject of limitation, they may only be, to the exception of the conservation, be treated with the holder's consent or for the purposes of declaration, exercise or advocacy of a right in a lawsuit, advocacy for another singular or collective, or for reasons of legally anticipated public interest.
The holder of the data you have obtained the limitation of the treatment of your data in the above cases will be informed by The Lost Garden before the treatment limitation is overruled.
In the event of data treatment limitation, The Lost Garden will communicate to each recipient to whom the data have been transmitted the respective limitation, unless such communication proves impossible or implying a disproportionate effort.
6. PERSONAL DATA PORTABILITY LAW
The data holder has the right to receive personal data that concerns it and has provided The Lost Garden, in a structured, current-using and auto-reading format, and the right to transmit that data to another treatment manager, if:
. Treatment is based on consent or contract that the holder is a party and treatment is conducted by automated means.
The right of portability does not include inferred data or derived data, ie personal data that is generated by The Lost Garden as a consequence or result of the analysis of the data of treatment.
The dataholder has the right that personal data is transmitted directly among those in charge of treatment, where it is technically possible.
7. DIRECT OF TREATMENT OPPOSITION
The incumbent is entitled to oppose at any time, for reasons related to his particular situation, the treatment of the personal data that concerns him that he sits on the exercise of legitimate interests pursued by The Lost Garden or when the treatment is effected for purposes other than those for which personal data was collected, including the definition of profiles, or when personal data is treated for statistical purposes.
The Lost Garden will cease the holder's treatment of data, unless presents imperious and legitimate reasons for that treatment that prevail over the interests, rights and freedoms of the incumbent, or for the purpose of declaration, exercise or defense of a right of The Lost Garden in a lawsuit.
When the holder data is treated for direct marketing purposes, the data holder has the right to oppose any time to the treatment of data that concerns it for the effects of said marketing, which covers the definition of profiles to the extent in which it is related to direct marketing. Should the holder oppose the treatment of his data for direct marketing purposes, The Lost Garden ceases data treatment for that purpose.
The data holder has still the right to not be subject to any decision made exclusively based on automated treatment, including the definition of profiles, which produces effects on its legal sphere or which affects it significantly in a similar way, unless the decision:
. For for the celebration or execution of a contract between the incumbent and The Lost Garden;
. It is authorized by legislation to which The Lost Garden is subject; or
. For based on the explicit consent of the dataholder.
8. PROCEDURE WITH VIEW TO THE EXERCISE OF THE RIGHTS BY TITULAR
The right to access, the right to rectify, the right to erase, the right to limitation, the right of portability, and the right to opposition may be exercised by the holder of the data upon contact with The Lost Garden and completing the respective form.
The Lost Garden will give written response (including by electronic means) to the holder's request at a maximum of one month from the receipt of the application, saved in cases of special complexity, where that deadline can be extended for up to two months.
If the requests filed by the holder are manifestly unfounded or excessive, namely due to their repetitive character, The Lost Garden reserves the right to collect administrative costs or refuse to follow the application.
9. PERSONAL DATA VIOLATIONS
In the event of data infringement and to the extent that such a breach is likely to imply high risk for the holder's rights and freedoms, The Lost Garden commits to communicate the violation of personal data to the CNPD within 72 hours of telling the knowledge of the incident.
In the legal terms, communication to the holder is not required in the following cases:
. In the event that The Lost Garden applied adequate protection measures, both technical and organizational, and these measures have been applied to personal data affected by personal data infringement, especially measures that make personal data incomprehensible for any unauthorized person to access these data, such as ciphering;
. In the event The Lost Garden has taken subsequent steps assuring that the high risk for the holder's rights and freedoms is no longer likely to materialize; or in case the communicating to the incumbent implies a disproportionate effort for The Lost Garden. In that case, The Lost Garden will do a public communication or take a similar move through which the incumbent will be informed.
III. FINAL PART
1.CHANGES TO PRIVACY POLITICS
The Lost Garden reserves the right to change this Privacy Policy to any and all time. In case of Privacy Policy modification, the date of the last change, available in the footer, is also updated.
2. APPLICABLE HANDLE AND
The Privacy Policy as well as the collection, treatment, or transmission of the holder's Data are governed by the provisions of the 2016/679 Regulation (EU) of the European Parliament and the Board, April 27, 2016 and applicable legislation and regulation in Portugal.