Privacy Policy

Arcádia® – registered trademark managed and operated by Confeitarias Arca e Arcádia S.A. and Coffee Box-Cafetaria S.A. – is aware of the implications and of its responsibility to comply with the changes introduced in terms of personal data protection, namely with the production of effects on May 25, 2018 of the General Data Protection Regulation, approved by Regulation (EU) 2016/679, of April 26, 2016.

Arcádia® is therefore committed to ensuring the protection of all personal data made available to it, having adopted various security measures, of a technical and organizational nature, in order to protect personal data against any form of processing. illicit.

Arcádia® is also committed to continually improving the set of procedures and techniques implemented for the protection of personal data, also relying for this purpose on all the suggestions that users of this website make to us.

This Privacy Policy applies exclusively to the processing of personal data by Arcádia® collected through its website or commercial and promotional actions.

1. Purpose of processing:

Personal data is collected exclusively for the following purposes:

• Response to contact requests from customers or potential customers;
• Commercial management;
• Contract execution and invoicing;
• Improvement or personalization of our services;
• Sending newsletters and other promotional actions. Customers can unsubscribe from the email newsletter service by clicking on the newsletter link we send by email.

2. Personal data collected:

The data collected is limited to name, email address and telephone number, NIF, address, city, postal code, country, and is used for the purposes set out in this Policy, and can be obtained through:

• Online purchase form;
• Website contact form;
• In-store pickup.

3. Consent:

Before sending the first promotional message or newsletter, the data subject's express consent will be requested to send this type of message.

This consent will be requested via email, online form or physical form and the data subject will only receive messages in accordance with the preferences expressed.

4. Conservation Period:

The personal data collected will be kept as long as there is consent from the holders, in the personal data where its collection requires their consent, all others will be kept as long as their conservation is legally mandatory or necessary for the execution of the contract.

5. Sharing of personal data:

The personal data collected may be shared exclusively for hosting and backup on secure servers, ensuring that Arcádia® regulates its relations with all its partners and providers so that they ensure the appropriate and legally required technical and organizational conditions.

The hosting of the Arcádia® platforms is entrusted to Shopify International Ltd, located in the EEA. However, the data is transferred to Shopify Inc., located in Canada. This data transfer takes place within Shopify's corporate structure, and is also protected by PIPEDA, Canadian privacy legislation, which is considered to meet the standards of Regulation EU/679 (GDPR).

In turn, Shopify Inc. uses a combination of datacenters and cloud service providers to store this data in the U.S.A. and Canada. When personal data is transferred to the United States, all contractual relationships and respective amendments with external providers will be regulated. Additionally, Shopify is in the process of applying for Binding Corporate Rules (BCRs) approval through the Irish Supervisory Authority. Upon your approval, Shopify will rely on these BCRs to protect personal data that is transferred between Shopify corporate entities around the world.

6. Rights of the holders:

In accordance with current legislation on the protection of personal data, we inform that the data subject is guaranteed:

• Right to be informed:

• When collecting personal data:
  • The contact details of the person responsible for the treatment
  • Of the purposes of processing
  • Of the conservation time limit
  • Your rights as holders of personal data
  • The possibility of appealing to the supervisory authority to lodge a complaint (and respective contact details)
  • The (possible) existence of automated decisions and/or profiling.
• Ask what information Arcádia® has about them and why;
• Know where your data is stored and how it is processed;
• Be informed of how Arcádia® fulfills its data protection obligations.

 

• Right of access:

• Confirmation of whether or not your personal data is being processed;
• Ask how to gain access to your data;
• Provision of a copy of the personal data processed, preferably in an exportable format.

 

• Right to correct, delete, and block:

• Be informed about how to keep them updated;
• Obtain rectification of outdated, incorrect or incomplete data;
• Possibility of deleting personal data that is no longer necessary for the purpose;
• Block the processing of this data to verify accuracy or objection.

 

• Right to limitation:

• Challenging the accuracy of personal data, for a period that allows the controller to verify its accuracy.

 

• Right to removal/forgetting:

• Request the removal of your data and the definitive deletion of those that do not conflict with legal obligations.

 

• Right to Portability:

• Request portability of your data;
• Possibility of requesting your personal data in a frequently or commonly used format, in order to transfer it to another organization, even a competitor.

 

The exercise of rights by holders may be done through the email address online@arcadia.pt , also by post, sending a letter with the data below :

 

A/C: Arcadia Privacy

Almada Street, No. 63 4050-036 Porto

 

7. Third Parties:

In general, personal data collected on the Arcádia® website is not transferred to third parties, unless in compliance with a legal obligation.

If data is transmitted to third parties, Arcádia® maintains, together with subcontractors, responsibility for processing personal data in a fair, lawful and transparent manner. The subcontractor may only process personal data in accordance with the instructions defined by Arcádia® and always in strict compliance with the law and the purposes entrusted to it within the scope of the concluded contract.

The transmission of personal data to subcontractors will only be carried out within the scope of contractually established relationships with Arcádia® and only when there is a basis that justifies it.

In order to guarantee the confidentiality and security of data, Arcádia® will take the legally prescribed measures to ensure that the subcontracted entity offers sufficient guarantees for the protection of personal data, that it is a reputable entity and that it adopts technical and organizational security measures. sufficient, in order to protect personal data against accidental or unlawful destruction, accidental loss, alteration, dissemination or unauthorized access and against any other form of unlawful processing, agreed, in particular, through the formalization of a contract between Arcádia® and the subcontracted entity in which the second undertakes to act only upon instructions from the first with regard to the processing of personal data.

Arcádia® subcontractors will only process personal data for the purposes defined and agreed between the parties, and must ensure that data conservation, when necessary and applicable, meets the deadlines established by law and/or contractually.  

Holders of personal data must be informed at the time of collection of their data about their possible sharing with Arcádia® subcontractors, whenever possible with identification of the organization and respective contact, as well as the purpose of this sharing.

If data is transferred to an Arcádia® subcontractor who is in a third country that does not belong to the European Union, the latter must maintain a level of data protection equivalent to the protection afforded by legislation in force in the European space, namely that provided for in Regulation (EU ) 2016/679 Of the European Parliament and Council of 27 April 2016.

In the context of international data transfers, (at least) one of the following procedures must be followed:

• Individual contract or standard contractual clauses adopted directly by the European Commission or by a supervisory authority;
• Participation of the subcontractor in a certification system or standard accredited or recognized by the EU to guarantee an adequate level of protection;
• Recognition that the subcontractor's binding corporate rules guarantee an adequate level of data protection, issued by the supervisory authorities.
• Existence of an adequacy decision regarding the third country, specific territory or sector of that third country, or regarding the international organization in question.

The rules for carrying out cross-border data transfers will not apply whenever operations are occasional and necessary to fulfill a contract or within the scope of contentious proceedings (judicial, administrative, or involving regulatory bodies or similar).

8. Principles, security and rights:

The following are internal security and privacy standards:

- Process data in a lawful and fair manner, collecting only the necessary information relevant to the purpose for which it is intended;

- Do not use the data collected for a purpose incompatible with that of collection;

- Ensure the express consent of the data subject whenever required;

- Guarantee free of charge the right to delete data used when requested by the holder;

- Have security systems that prevent the consultation, modification or destruction of data by anyone not authorized to do so and that allow intentional or unintentional misuse of information to be detected.

9. Links to partner sites

The Arcádia® website may contain links to third party/partner websites. The websites referred to are not under the control of Arcádia®, and therefore it is not responsible for the content of any of these websites.  It is recommended that users of the Arcádia® website, when accessing other websites, consult the pages within these websites that refer to their privacy policies.

10. Cookies:

The use of cookies allows website navigation to be constantly optimized in order to provide a high quality experience that surpasses the quality obtained on the user's previous visit. You can consult our Cookies Policy here.

11. Change of Privacy Policy:

This Privacy Policy may be subject to change or revision, without prior notice, depending on legislative or regulatory requirements in accordance with current law.

Given that this Privacy Policy can be revised at any time, Arcádia® recommends its users to review it periodically.

 

Version: 2.0 (11/06/2020)