1. Commitment

CHITAS, LDA. commits to complying with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 – General Data Protection Regulation (GDPR) and other applicable data protection legislation, namely the national legislation that complements the GDPR, and as such to transparently communicate the types of personal data processing it performs, to protect the security, privacy, and confidentiality of personal data, to provide the necessary mechanisms for data subjects to exercise their rights over their personal data, to provide security systems designed to prevent unauthorized third parties from accessing, modifying, destroying, or adding to personal data and to detect any information deviations, and to develop organizational measures aimed at maintaining data subjects’ control over their personal data.

2. Who We Are (Data Controller)

CHITAS, LDA. with the unique registration number and NIPC 516202812, registered at the Sintra Commercial Registry Office, headquartered at Rua da Pedra Alta, nº 102, Vila Verde, with a share capital of €2,000.00 (two thousand euros), hereinafter referred to as CHITAS WEBSOLUTIONS, is the business organization responsible for the processing of personal data of employees, clients, potential clients, suppliers, business partners, and other data subjects who interact with it in any capacity. As such, it is the entity that decides on the data to be processed, the means of processing these data, and the purposes for which they are processed.

Data subjects can exercise their legally provided rights regarding personal data protection by contacting CHITAS WEBSOLUTIONS via email at [email protected].

3. What Personal Data We Process

Basic Concepts

Personal Data refers to any information that, regardless of its nature or format, directly or in combination with other data, allows the identification of an individual.

Therefore, Data Subjects are individuals who are identified or identifiable, directly or indirectly, through any information that concerns them.

Some personal data are considered sensitive under the General Data Protection Regulation (GDPR), and are classified as “Special Category Data“.

CHITAS WEBSOLUTIONS does not process any special category data, also referred to as sensitive data.

Below, a table is presented with, on one side, the categories and types of personal data we process, and on the other side, the means and channels of personal data collection.

Categories of Personal Data	Types of Personal Data Processed
Identification and Contact Data	Name, Address, Phone Number, Email Address, Personal Identification Document Number, Tax Identification Number, Signature
Biographical Data	Founded in 2016, CHITAS is a marketing agency that creates solutions to support businesses in digitizing their operations. It offers solutions to meet the needs of both internal and external communication, aiming to create a universal message for organizations.
Website Usage	Visited Pages, Information about the Device Used, IP Address, Browser, Mobile Phone Model, Nationality
Means of Personal Data Collection	Vehicles for Personal Data Collection within each Collection Medium
Data Provided by the Data Subject	Provided directly by the data subjects in electronic communications with CHITAS WEBSOLUTIONS
Cookies	Collected through the use of the CHITAS WEBSOLUTIONS website. For more information about the types of cookies used by CHITAS WEBSOLUTIONS and the data collected, please refer to the cookie policy published on the website www.chitas.pt

Requirement to Provide Personal Data by Data Subjects

In the scope of CHITAS WEBSOLUTIONS’ commercial and contractual relationships, the presentation and collection of certain personal data from employees, clients, potential clients, suppliers, business partners, and other data subjects who interact with it in any capacity are mandatory and necessary for fulfilling contractual obligations, including providing document translation services, pre-contractual diligences, or others mandated by current legislation.

In general, if such data is not provided, CHITAS WEBSOLUTIONS will likely have to refuse the conclusion of a contract that establishes the employment, commercial, or professional relationships between the parties.

4. How We Process Personal Data

Data processing is the operation or set of operations performed on personal data, whether by manual or automated means, including collection, organization, storage, use, rectification, erasure, consultation, copying, and transfer.

CHITAS WEBSOLUTIONS promotes the processing of data in a lawful, legitimate, and transparent manner, strictly necessary for specific purposes.

Below, a table is presented with, on one side, the processing purposes, on the other side, the methods used to achieve these purposes, and finally the basic lawful grounds for the intended purposes.

Processing Purposes	Method Used to Achieve the Purpose	Legal Basis
Provision of Digital Services (including website creation)	Collection, registration, and consultation of personal data	Conclusion, Execution, and Management of Contract
Customer Registration	Collection and registration of personal data of data subjects, customer registration in billing software	Conclusion, Execution, and Management of Contract
Communication in Case of Need	Collection of personal data of data subjects, communication for administrative or operational reasons	Conclusion, Execution, and Management of Contract
Management of Contacts and Complaints	Receipt, analysis, and response to requests for information and complaints from data subjects	Conclusion, Execution, and Management of Contract
Celebração de Contrato Laboral ou Comercial	Recolha e inserção dos dados pessoais necessários a figurar nos contratos de diferentes naturezas	Celebração, Execução e Gestão de Contrato
Accounting	Bookkeeping	Compliance with Legal Obligation
Document Management	Storage and Organization of documents on paper support, in the document archive, which constitute mandatory evidence for possible inspection by the Tax Authority	Compliance with Legal Obligation
Personalization of Website Experience	Use of persistent cookies to record activities and preferences	Prior, Express, Written, Explicit, Informed, Free, and for Specific Purposes Consent
Direct Marketing	Provision of information or conducting campaigns, through phone, SMS, email, to stimulate the use or promote the acquisition or subscription of goods or services	Prior, Express, Written, Explicit, Informed, Free, and for Specific Purposes Consent

Other Legal Bases

CHITAS WEBSOLUTIONS will also process personal data whenever necessary in the context of defending the vital interests of the data subject, in the context of asserting, exercising, or defending a right in a judicial proceeding, or whenever personal data is requested by courts when acting in the exercise of their judicial function.

5. Data Retention Periods for Personal Data Processing

CHITAS WEBSOLUTIONS retains personal data for as long as necessary and as long as the legitimate purposes for which the data are processed based on the appropriate legal grounds subsist.

Below, a table is presented with, on one side, the reasons for retention, and on the other side, the retention periods.

Reasons for Retention	Retention Periods
Fulfillment of Contract	Contractual term. They are only maintained for periods beyond the term of the contract if it is necessary to ensure rights or obligations related to the contract.
Legal, Tax, or Regulatory Obligation	Legal prescription periods associated with legal, tax, or regulatory obligations, or deadlines set forth in special legislation (e.g., 7 years after contractual relationship under the Anti-Money Laundering and Counter-Terrorist Financing Law).

6. Rights of Data Subjects

CHITAS WEBSOLUTIONS ensures the exercise of data subjects’ rights by developing its own procedure for this purpose.

Below, a table is presented listing the rights of data subjects legally provided for, as well as a brief explanatory description of each of the rights contemplated in the current legislation.

Rights of Data Subjects	Description of the Right
Access	This consists of the right to obtain confirmation as to whether personal data concerning the data subject, which have been provided to CHITAS WEBSOLUTIONS, are being processed and, if so, the right to access their personal data and the related processing conditions.
Rectification	This right entitles data subjects to request CHITAS WEBSOLUTIONS to rectify their personal data if they are inaccurate or incomplete.
Opposition	This right allows data subjects to object at any time, for reasons related to their particular situation, to the processing of their personal data by CHITAS WEBSOLUTIONS based on its legitimate interest or the legitimate interest of third parties.
Erasure	This right entitles data subjects to obtain the erasure of their personal data that are no longer necessary for the purpose for which they were collected and processed, or the withdrawal of consent for all personal data if consent was the sole legal basis for the processing of the data.
Portability	It consists of the right to receive personal data provided to CHITAS WEBSOLUTIONS in a structured, commonly used and machine-readable format, and the right to transmit this data to another person responsible for processing
Limitation	It consists of the right to obtain restriction of processing if you contest the accuracy of personal data for a period that allows CHITAS WEBSOLUTIONS to verify its accuracy, if the processing is unlawful and you oppose the erasure of personal data, or if CHITAS WEBSOLUTIONS no longer need personal data for the purposes of processing, but these data are required by the holder for the purposes of declaring, exercising or defending a right in legal proceedings, or even having exercised the right to object, until it is verified that CHITAS’ legitimate reasons WEBSOLUTIONS prevail over those of the data subject
Forget me	It consists of the right to request the deletion of your personal data held by CHITAS WEBSOLUTIONS as long as there are no valid grounds for its retention
Not subject to exclusively automated decision-making	It consists of the right to require human intervention or to challenge decisions based on the processing of personal data that are fully automated and that may have significant effects in their legal or private spheres, except for the exceptions arising from the legislation in force
Complaint to the CNPD	It consists of the right to lodge complaints with the CNPD – Comissão Nacional da Protecção de Dados (www.cnpd.pt) regarding the protection of your personal data and the rights related to them

The subjects of personal data may exercise their legally contemplated rights regarding the protection of personal data by contacting CHITAS WEBSOLUTIONS, by e-mail to the address [email protected]

CHITAS WEBSOLUTIONS will, in accordance with current legislation, respond to the request to exercise the right within 30 (thirty) days.

In the case of particularly complex requests, CHITAS WEBSOLUTIONS will inform the holder of personal data of the need to extend the response period for a maximum additional period of 60 (sixty) days, which will be accompanied by due justification.

The exercise of data holders’ rights is free of charge, except when excessive, anomalous and/or bad faith situations occur, situations in which CHITAS WEBSOLUTIONS will inform data holders in a timely manner about the commissions to be charged and their respective justification.

CHITAS WEBSOLUTIONS will verify and confirm the identity of the data holders with each request to exercise rights, responding to all requests for all rights for which the identity of the holder can be proven, and through a channel that allows evidence of the request to be maintained and the response to it.

7. Shared Personal Data

At CHITAS WEBSOLUTIONS, employees/service providers who need it to comply with CHITAS WEBSOLUTIONS’ contractual, pre-contractual and legal obligations or obligations within the scope of the activity carried out by CHITAS WEBSOLUTIONS have access to personal data.

Additionally, personal data may be made available to third parties, that is, entities other than CHITAS WEBSOLUTIONS, who will process them on behalf of CHITAS WEBSOLUTIONS, as Subcontractor, with respect for the principles of data protection by which they are manages CHITAS WEBSOLUTIONS. CHITAS WEBSOLUTIONS may also be forced, within the scope of compliance with legal obligations, to transmit the personal data for which it is responsible for processing to third parties indicated to it.

Below, some of the third-party entities and the reasons that lead to the sharing of personal data with these same entities are presented in a table.

Third Party Entities	Reasons for sharing personal data with the Third Party
Public Body or Supervision Institute	Whenever there is a legal obligation to share (e.g. in the course of an investigation or report)
Subcontractors	Subcontractors or Service Providers, who act solely and exclusively on behalf of, or under the instructions of, CHITAS WEBSOLUTIONS (e.g. accounting, IT, cleaning, medical and occupational safety service providers, etc…)

8. Protection of Personal Data

For CHITAS WEBSOLUTIONS, the confidentiality and integrity of personal data is considered one of the fundamental pillars in building relationships of trust with employees, customers, potential customers, suppliers, business partners and other holders of personal rights who otherwise share with it relate.

CHITAS WEBSOLUTIONS has therefore implemented appropriate organizational measures, processes and security systems to protect personal data against destruction, undue alteration and even unauthorized access to personal data.

9. Technical and Organizational Measures Adopted

CHITAS WEBSOLUTIONS has implemented technical and organizational measures in order to protect the personal data for which it is Responsible for Processing.

Therefore, it keeps computer systems up to date, and has developed procedures that prevent unauthorized access, accidental loss and/or destruction of personal data.

10. Revisions and Changes to the Privacy and Personal Data Protection Policy

CHITAS WEBSOLUTIONS reserves the right, at any time, to introduce any changes it deems necessary to this policy, in order to better adapt it to best market practices or to legislative or regulatory changes that may arise.

The current version of the policy will always be the one published on its website www.chitas.pt

The policy will be reviewed annually or whenever necessary.

Whenever the changes are relevant and substantive, CHITAS WEBSOLUTIONS will make all appropriate and reasonable efforts, using normal and common channels of communication and contact with data subjects, to bring such changes to their attention.