Carvalhal da Urra, S.A., a company with its registered office at Rua da Barreta, Nº 12, Casal dos Matos 2410-248 Leiria, with the legal number 508158834 (“Urra House“), in carrying out their activities on the website https://casadaurra.com (“Website”), processes Personal Data, i.e. information relating to an identified or identifiable natural person (“Data Subject(s)“), an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an electronic identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person (“Personal Data”).
The use of the Website by any user shall be governed by the Terms and Conditions of Use (“Terms and conditions“), the use of which implies acceptance by the User. If the User rejects the Terms and Conditions, they must immediately cease using the Website.
A Urra House whenever it determines the purposes and means of processing Personal Data, it will be qualified as an autonomous Data Controller, ensuring compliance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, and other applicable data protection and privacy legislation (“Data Protection Legislation”).
With regard to the Personal Data processing activities carried out through the Website, the Urra House will act as Data Controller, and Data Subjects should use the contact details provided in Section 10 for any questions relating to data protection.
Under the terms of the Data Protection Act, the Urra House strives to process Personal Data in accordance with all applicable principles, namely: i) the Principle of Lawfulness, Fairness and Transparency; ii) the Principle of Purpose Limitation; iii) the Principle of Data Minimisation; iv) the Principle of Accuracy; v) the Principle of Retention; and vi) the Principle of Integrity and Confidentiality.
Accordingly, this Data Protection and Privacy Policy (“Privacy Policy”), and Casa da Urra undertakes to carry out any and all Personal Data processing operations in accordance with the provisions of the following points.
1. Lawfulness and Purposes of Data Processing
The Personal Data of the Data Subjects will be processed by Casa da Urra on the following legal grounds:
| Grounds for Licence | What do they consist of? |
| Consent | The Data Subject may consent to the processing of his/her Personal Data by means of a free, specific, informed and explicit expression of will, whereby he/she accepts, by means of a declaration (in writing or orally) or an unequivocal positive act (by filling in an option), that his/her Personal Data will be processed. |
| Pre-contractual procedures or execution of a contract | Personal Data may be processed if it is necessary, without limitation, for the performance of a contract for the provision of services and/or supply of products to which you are a party as an Employee, Customer and/or Supplier, or to carry out pre-contractual steps at your request. |
| Fulfilment of a legal obligation | Personal Data may be processed to ensure and guarantee the fulfilment of legal obligations to which it is subject under the legislation of a Member State and/or the European Union. |
| Defence of vital interests of the Data Subject | Personal Data may be processed to ensure the defence of your vital interests, namely when such processing is essential to your life. |
| Legitimate Interests | A Urra House, In addition to the processing of Personal Data, other Controllers or Third Parties may process Personal Data provided that such processing does not override their interests or fundamental rights and freedoms. |
In view of the above, the collection of Personal Data based on the above legal grounds will essentially be for purposes related to the development of the company's activities. Urra House and also for the fulfilment of its contracts and legal obligations, whereby failure to collect Personal Data will mean that it will not be possible to fulfil the purposes for which the Personal Data is processed.
2. Processing of Personal Data on the Website
A Urra House processes the Data Subject's Personal Data as follows:
| Purpose | Treatment Activities | Legal grounds | Shelf life |
| Management Website | Analysing and processing navigation data Web | Performance of the contract, the terms of which are governed by the Terms and Conditions of the Website (“Contract”) | Up to 3 months after the last visit to the Website |
| Account creation and access authentication | Period of registration in the Website | ||
| Client Management | Analysing and executing orders | Pre-contractual Diligences or Contract Execution | For the period necessary to fulfil the Contract and/or legal obligations |
| Contacts and complaints | Compliance with legal obligations | For the period necessary to manage complaints, in accordance with the applicable legal deadlines | |
| Commercial and marketing activities | Direct marketing communications | Consent | Up to 1 year after last contact |
| Legitimate Interest for communications under the Contract | Up to 1 year after the end of the contract | ||
| Generalised profiling | Legitimate Interest | Up to 1 year after collection | |
| Individualised profiling | Consent | ||
| Satisfaction surveys | Legitimate Interest | Up to 1 year after last contact |
3. Personal Data Processed on the Website
For these purposes Urra House processes the following Personal Data:
| Purpose | Personal Data | |
| Management Website | Personal Identification Data, Contact Data, Authentication and Access Data and/or Browsing Data Web (such as name, email, user account, username, password, creation date, access validity, log in/log out, electronic identifier (Mac, IP), connection start date/time, connection end date/time, browsing location of origin web, URL visited, social network address, history of interaction on social networks or host name) | |
| Client Management | Personally Identifiable Information, Contact Information, Payment and Transaction Information, Contract Information and/or Complaint Information (such as name, email address, telephone/mobile number, address, preferred delivery time, product delivery point, transaction number, transaction description, transaction date, transaction amount, number of transactions, electronic invoicing, invoice number, contract number, purchase history, customer segments, quantity of products, value of products, date of purchase of products, channel/place of purchase and amounts spent per customer, complaint number, date of complaint, description of complaint, origin of complaint or date of complaint response) | |
| Commercial and marketing activities | Personally Identifiable Information, Contact Information, Payment and Transaction Information, Contract Information and/or Satisfaction Survey Information (such as name, address, preferred delivery time, product delivery point, transaction number, transaction description, transaction date, transaction value, number of transactions, purchase history, customer segments, product quantity, product value, product purchase date, purchase channel/place and amount spent per customer, satisfaction rating, preference factors, opinion or areas of interest). |
4. Treatment methods
The processing of Personal Data will be carried out automatically and manually by computerised instruments, applying logic strictly related to the purposes and, in any case, promoting the security and confidentiality of Personal Data.
5. Disclosure and Transmission of Personal Data
The employees of Urra House will process the Personal Data of Data Subjects for the performance of their labour duties and will process Personal Data exclusively under the terms specified in this Privacy Policy.
Personal Data may be made available to third parties in charge of providing services for the company. Casa da Urra (“Subcontractors”), bound by a written contract and to process the data under the terms of this Privacy Policy, and may not process it, directly or indirectly, for any other purpose, for its own benefit or that of a third party.
Data Subjects have the right to obtain a complete and up-to-date list of the Subcontractors (if any) contracted by Urra House, For this purpose, a specific request must be sent to Urra House under the terms specified in Point 10 of this Privacy Policy.
In fulfilment of legal obligations, the Personal Data of Data Subjects may be transmitted to third parties for their own purposes, namely banks and insurance companies, judicial, administrative, supervisory or regulatory authorities, as well as entities that lawfully carry out data collection, fraud prevention and combating actions.
Your Personal Data may also be processed by the entities that manage the social networks or the functionalities made available on the website. Website, We recommend that you read their privacy policies before browsing the site, such as sharing content or creating an account. Website.
6. International transfers
A Urra House may transfer the Data Subject's Personal Data outside the European Economic Area (“EEA”), to locations that may not guarantee the same level of protection.
However, if applicable, the Urra House will only transfer Personal Data outside the EEA in accordance with the following measures:
- When the transfer is carried out to a location or by a method or in circumstances that the European Commission considers guarantee the adequate protection of Personal Data;
- When it has implemented standard contractual data protection clauses approved by the European Commission or a competent supervisory authority; or,
- When none of the previous options apply, but the law nevertheless authorises the transfer, for example if it is necessary for the declaration, exercise or defence of a right in a case
You can request detailed information on the security measures that the Urra House has in place concerning transfers of Personal Data outside the EEA and, where applicable, a copy of the standard contractual data protection clauses in force in that country. Urra House using the contact details provided in Section 10.
7. Data subjects' rights
Under the terms of current or future Data Protection Legislation, the Urra House informs you that Data Subjects have the right of access, rectification, restriction, portability, erasure and the right to object to the processing of their personal data. Personal Data, This right may be exercised under the terms of this chapter of the Privacy Policy.
| Rights | What do they consist of? |
| Right to information | The Data Subject has the right to obtain clear, transparent and easily understandable information on how the Urra House uses your Personal Data and what your rights are. That is why Urra House provides all this information in this Privacy Policy. |
| Right of access | The Data Subject has the right to obtain information about which Personal Data the Urra House (if it is processing it) and certain information (similar to that provided in this Privacy Policy) about how that Data is processed. This right allows you to know and confirm that we use your Data in compliance with Data Protection Legislation. A Urra House may refuse to supply the information requested where, in order to do so, the Urra House you have to disclose another person's Personal Data or the information negatively impacts another person's rights. |
|
Right to rectification |
If the Data Subject's Personal Data is incorrect or incomplete (for example, if their name or address is wrong), a request may be made to Urra House take reasonable steps to correct them. |
|
Right to erasure of personal data |
This right is also known as the “right to be forgotten” and, in simple terms, allows the Data Subject to request the erasure or deletion of their data, provided there are no valid grounds for the erasure or deletion. Urra House continues to use them or their use is unlawful. This is not a blanket right to erasure, as exceptions are allowed (for example, when this data is necessary for the defence of a right in legal proceedings). |
|
Right to restriction of treatment |
The Data Subject has the right to “block” or prevent future use of their Data for as long as the Urra House evaluates a request for rectification or as an alternative to erasure. Where Processing is limited, the Urra House will still be able to store your data, but will not be able to use it afterwards. A Urra House keeps a list of data subjects who have requested that future use of their data be “blocked” to ensure that this limitation is respected. |
|
Right to portability of personal data |
The Data Subject has the right to obtain and re-use certain Personal Data for his/her own purposes in various organisations. This right applies only to Personal Data provided to Urra House and that Urra House processing with consent and those processed by automated means. |
|
Right to oppose |
The Data Subject has the right to object to certain types of processing, on grounds relating to their particular situation, at any time during which such processing takes place, for the purposes of the legitimate interests of the company. Urra House or third parties. A Urra House may continue to process such Data if it can prove “overriding legitimate reasons".
for processing which overrides your interests, rights and “Freedoms” or if such Data is necessary for the establishment, exercise or defence of legal claims. |
| Right to lodge a complaint | The Data Subject has the right to lodge a complaint with the competent supervisory authority, the Comissão Nacional de Proteção de Dados - CNPD (National Data Protection Commission), if they consider that the Processing of their Personal Data violates their rights and/or the Data Protection Legislation. |
If the lawful basis for processing your personal data is consent or legitimate interest, you can withdraw your consent or oppose the processing at any time, without any consequences, but without jeopardising the lawfulness of the processing carried out in the meantime. If consent is withdrawn or express opposition is expressed, the Urra House will immediately cease processing your personal data for the purpose in question, unless it is necessary to process the data for the fulfilment of legal and/or contractual obligations.
You may at any time, in writing, exercise the rights enshrined in the Data Protection Act and other applicable legislation through the means described in Point 10 of this Privacy Policy.
8. Security and Confidentiality
To guarantee the security and confidentiality of personal data, protected databases are used, among other things, firewalls and passwords, in accordance with the provisions of Data Protection Legislation. Access to Personal Data is only possible for authorised employees who have an actual need to use the Personal Data, in accordance with the principles of security and confidentiality. Violations of this Privacy Policy by employees of Urra House may give rise to disciplinary action. Compliance with the rules and procedures of the Urra House is monitored and checked periodically.
9. Cookies
With regard to the processing of personal data that the Urra House is realised through the use of cookies, please consult the Cookies Policy of Urra House and customise your settings according to your preferences.
10. How to contact Casa da Urra regarding Privacy and Data Protection Matters
Data Subjects may exercise their rights by contacting the Urra House by sending an e-mail to the mailbox privacidade@casadaurra.com
Data Subjects may also contact the Personal Data Protection Officer of the company. Urra House by sending an e-mail to the mailbox for privacidade@casadaurra.com.
Date of publication 15/11/2024