Privacy policy

CFR Metal, with headquarters at Zona Industrial das Ervosas, Rua Tomé Barros Queirós No. 96, 3830-252 Ílhavo, Portugal, hereby informs that, within the scope of collecting and processing data necessary for the performance of its duties, and taking into account the provisions of the General Data Protection Regulation, it has adopted the following Privacy and Data Protection Policy:

1. Data Controller

The data controller is CFR Metal, which will collect, store, and process the personal data necessary to comply with its legal obligations.

2. Collection and Processing of Data

The collection of personal data provided by the data subject at the time of contact, whether in person or through digital platforms made available by CFR Metal, namely through requests, petitions, complaints, forms, and other means of communication, will result in its internal processing, as well as its external use, always in strict compliance with legal obligations.

3. Purpose of Data Processing

We use personal data, namely, for the following purposes:

Marketing — to provide information about news that may be of interest;
Website user management;
Compliance with legal obligations, including obligations towards our shareholders;
Recruitment of employees for CFR Metal;
Compliance with obligations arising from contracts entered into with our partners.

CFR Metal guarantees that personal data is processed only within the scope of the purposes for which it was collected, and will not be disclosed or shared for other purposes, namely commercial or advertising purposes.

4. Recipients of Personal Data

CFR Metal may, in some cases, communicate or share personal data with other entities within the scope of services provided by them or due to contractual obligations. In such cases, we require each entity to whom data is disclosed to have appropriate security measures in place to protect personal data.

Where required by law, we may also have to disclose personal data to authorities or third parties, in which case our control over how the personal data is protected is limited.

5. Retention Period for Personal Data

Personal data is retained for the minimum period established by law for the archiving and retention of administrative documents, without prejudice to the rights granted to the data subject during the respective period of validity.

6. Rights of Personal Data Subjects

Personal data subjects have the right to:

Request from CFR Metal access to the personal data concerning them, as well as its rectification or erasure, restriction of processing, the right to object to processing, and the right to data portability, in legally admissible cases;
Where data processing has been carried out based on consent, the data subject has the right to withdraw such consent at any time, without affecting the lawfulness of processing carried out under the respective authorisation;
Lodge a complaint with a supervisory authority, without prejudice to any other administrative, extrajudicial, or judicial remedy.

7. Security Measures

CFR Metal undertakes to ensure the security of the personal data provided to it by applying the necessary technical and organisational measures to ensure a level of security appropriate to the risk of destruction, loss, alteration, disclosure, unauthorised access, or any other form of accidental or unlawful processing, in accordance with the legislation in force on this matter.

In the event of a personal data breach, CFR Metal will notify the National Data Protection Commission within the terms and deadlines established by the legislation in force.

8. Changes to the Privacy Policy

CFR Metal reserves the right to amend this Privacy and Data Protection Policy at any time, with any amendment taking effect from the date of its publication.

9. Final Provisions

Any matters not covered by this document shall be governed by the legislation in force, namely the General Data Protection Regulation, adopted by Regulation (EU) 2016/679 of the European Parliament and of the Council.