Privacy Policy
Arcádia® – a registered trademark managed and operated by Confeitarias Arca e Arcádia S.A. and Coffee Box-Cafetaria S.A. – is aware of the implications and its responsibility to comply with the changes introduced in personal data protection, namely with the effect from May 25, 2018, of the General Data Protection Regulation, approved by Regulation (EU) 2016/679 of April 26, 2016.
Arcádia® thus undertakes to ensure the protection of all personal data made available to it, having adopted various security measures, both technical and organizational, in order to protect personal data against any form of unlawful processing.
Arcádia® also undertakes to continuously improve the set of procedures and techniques implemented for the protection of personal data, also relying on all suggestions that users of this site send us for this purpose.
This Privacy Policy applies exclusively to the processing of personal data by Arcádia® collected through its website or commercial and promotional actions.
- Purpose of processing:
Personal data is collected exclusively for the following purposes:
- Response to contact requests from customers or potential customers;
- Commercial management;
- Contract execution and invoicing;
- Improvement or customization of our services;
- Sending newsletters and other promotional actions. Customers can unsubscribe from the newsletter service by email by clicking the link in the newsletter we send by email.
- Personal data collected:
The data collected is limited to name, email address and phone number, tax identification number, address, city, postal code, country, being used for the purposes set out in this Policy, and may be obtained through:
- Online purchase form;
- Website contact form;
- In-store collection.
- Consent:
Before the first promotional message or newsletter is sent, the explicit consent of the data subject will be requested for sending this type of message.
This consent will be requested via email, online form, or physical form, and the data subject will only receive messages according to the preferences expressed.
- Retention Period:
The personal data collected will be kept as long as there is consent from the data subjects, for personal data whose collection requires their consent, while all others will be kept as long as their retention is legally mandatory or necessary for the execution of the contract.
- Sharing of personal data:
The personal data collected may be shared exclusively for hosting and backup on secure servers, with Arcádia® regulating its relationships with all its partners and providers to ensure they guarantee the necessary appropriate and legally required technical and organizational conditions.
The hosting of the Arcádia® platforms is entrusted to Shopify International Ltd, located in the EEA. However, data is transferred to Shopify Inc., located in Canada. This data transfer occurs within Shopify's corporate structure and is also protected by PIPEDA, the Canadian privacy legislation, which is considered adequate under the EU Regulation 679 (GDPR) standards.
In turn, Shopify Inc. uses a combination of datacenters and cloud service providers to store this data in the U.S.A. and Canada. When personal data is transferred to the United States, all contractual relationships and respective addenda with external providers will be regulated. Additionally, Shopify is in the process of seeking approval for the Binding Corporate Rules (BCRs) through the Irish Data Protection Authority. Once approved, Shopify will rely on these BCRs to protect personal data transferred between Shopify corporate entities worldwide.
- Rights of the data subjects:
Under the current legislation on personal data protection, we inform you that the data subject is guaranteed:
- Right to be informed:
- At the time of collecting personal data:
- On the contacts of the data controller
- On the purpose(s) of processing
- On the retention period
- On your rights as data subjects
- On the possibility of recourse to the supervisory authority for filing a complaint (and respective contacts)
- On the (possible) existence of automated decisions and/or profiling.
- Ask what information Arcádia® holds about you and why;
- Know where your data is stored and how it is processed;
- Be informed about how Arcádia® complies with its data protection obligations.
- Right of access:
- Confirmation of the existence or not of processing of your personal data;
- Ask how to access your data;
- Provision of a copy of the processed personal data, preferably in an exportable format.
- Right to correct, delete, and block:
- Be informed on how to keep them updated;
- Obtain correction of outdated, incorrect, or incomplete data;
- Possibility to delete personal data that is no longer necessary for the purpose;
- Block the processing of such data to verify accuracy or opposition.
- Right to restriction:
- Challenge the accuracy of personal data, during a period that allows the data controller to verify its accuracy.
- Right to removal/forgetting:
- Request the removal of your data and the definitive deletion of those that do not conflict with legal obligations.
- Right to Portability:
- Request the portability of your data;
- Possibility to request your personal data in a frequently or commonly used format, in order to transfer it to another organization, even if a competitor.
The exercise of rights by the holders may be done through the e-mail address online@arcadia.pt , as well as by postal mail, sending a letter with the data below:
Attn: Arcádia Privacy
Rua do Almada, nº63 4050-036 Porto
- Third Parties:
In general, personal data collected on the Arcádia® website is not transferred to third parties, unless in compliance with a legal obligation.
If there is data transmission to third parties, Arcádia® maintains joint responsibility with the subcontractors for the processing of personal data in a fair, lawful, and transparent manner. The subcontractor may only process personal data according to the instructions defined by Arcádia® and always in strict compliance with the law and the purposes entrusted to it under the contract.
The transmission of personal data to subcontractors will only be carried out within the scope of contractually established relationships with Arcádia® and only when there is a justified basis.
In order to ensure the confidentiality and security of the data, Arcádia® will take the legally required measures to guarantee that the subcontracted entity provides sufficient guarantees for the protection of personal data, that it is a reputable entity and that it implements sufficient technical and organizational security measures to protect personal data against accidental or unlawful destruction, accidental loss, alteration, dissemination or unauthorized access, and against any other form of unlawful processing, agreed upon, namely, through a contract formalized between Arcádia® and the subcontracted entity in which the latter commits to act only under the instructions of the former regarding the processing of personal data.
Arcádia® subcontractors will only process personal data for the purposes defined and agreed between the parties, and must ensure that data retention, when necessary and applicable, complies with the deadlines established by law and/or contractually.
Data subjects must be informed at the time of collection of their data about any possible sharing with Arcádia® subcontractors, whenever possible with identification of the organization and respective contact, as well as the purpose of such sharing.
In the case that data is transferred to a subcontractor of Arcádia® located in a third country outside the European Union, it must maintain a level of data protection equivalent to the protection provided by the legislation in force in the European area, namely that provided for in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.
In the context of international data transfers, at least one of the following procedures must be followed:
- Individual contract or standard contractual clauses adopted directly by the European Commission or by a supervisory authority;
- Participation of the subcontractor in a certification system or standard accredited or recognized by the EU to guarantee an adequate level of protection;
- Recognition that the binding corporate rules of the subcontractor guarantee an adequate level of data protection, issued by the supervisory authorities.
- Existence of an adequacy decision regarding the third country, the territory or specific sector of that third country, or regarding the international organization in question.
The rules for carrying out cross-border data transfers will not apply whenever occasional operations are necessary to fulfill a contract or within the scope of contentious proceedings (judicial, administrative, or ongoing with regulatory bodies or similar).
- Principles, security, and rights:
Internal security and privacy rules are:
- Process data lawfully and fairly, collecting only the information necessary and relevant to the purpose for which it is intended;
- Not use the data collected for purposes incompatible with the purpose of collection;
- Ensure the express consent of the data subject whenever required;
- Guarantee free of charge the right to delete the data used when requested by the data subject;
- Have security systems that prevent unauthorized persons from accessing, modifying, or destroying data and that allow detection of intentional or unintentional information deviations.
- Links to partner sites
The Arcádia® website may contain links to third-party/partner sites. These sites are not under the control of Arcádia®, and therefore Arcádia® is not responsible for the content of any of these sites. Users of the Arcádia® website are advised to consult the pages within those sites that refer to their privacy policies when accessing other sites.
- Cookies:
The use of cookies allows the navigation of the website to be constantly optimized in order to provide a high-quality experience that surpasses the quality obtained during the user's previous visit. You can consult our Cookie Policy here.
- Privacy Policy Change:
This Privacy Policy may be subject to change or revision, without prior notice, due to legislative or regulatory requirements in accordance with the law in force.
Since this Privacy Policy may be reviewed at any time, Arcádia® recommends its users to review it periodically.
Version: 2.0 (11/06/2020)
