Privacy Policy - 2rf - Soluções Técnicas para Construção

2RF LDA, a company incorporated in accordance with the laws of Portugal, with the unique legal person number 507235282, headquarters Quinta de Santo Estevão, Rua da Gândara, 3515-149 Viseu, (hereinafter “2RF”), in the execution of its activities commercial sites on the website www.2rf.pt (“Website” or “Online Store”), processes Personal Data, that is, information relating to an identified or identifiable natural person (“Data Holder(s)”), considering an identifiable natural person is a natural person who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, electronic identifiers or one or more specific elements of physical identity , physiological, genetic, mental, economic, cultural or social nature of that natural person (“Personal Data”).

The use of the Website by any user will be governed by the Terms and Conditions of use (“Terms and Conditions”), their use implying acceptance thereof by the user. If the user rejects the Terms and Conditions, they must immediately cease using the Website.

The General Conditions of Purchase and Sale (“Conditions”) constitute an integral part of the Terms and Conditions and establish the Conditions for purchasing products sold by 2RF in the Online Store.

2RF determines the purposes and means of processing Personal Data as Responsible for the processing of Personal Data, ensuring compliance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, and others applicable legislation and matters of data protection and privacy (“Data Protection Legislation”)

Under the terms of Data Protection Legislation, 2RF strives for the processing of Personal Data in accordance with all applicable principles, namely: i) Principle of Lawfulness, Loyalty and Transparency; ii) Purpose Limitation Principle; iii) Data Minimization Principle; iv) Principle of Accuracy; v) Principle of Conservation; vi) and, Principle of Integrity and Confidentiality.

In light of the foregoing, this Data Protection and Privacy Policy (“Privacy Policy”) is hereby established, with 2RF committing to carry out any and all Personal Data processing operations in accordance with the provisions of the following points:

BASIS OF LAWSUIT AND PURPOSES OF DATA PROCESSING

Personal Data of the Data Subjects will be processed by 2RF with the following legal bases:

Legal Bases	What do they consist of?
Consent	The Data Subject may consent to the respective Processing through a free, specific, informed, and explicit expression of will, by which they accept, by declaration (in writing or orally) or unequivocal positive action (by filling out an option), that their Personal Data be subject to processing.
Pre-contractual diligence or execution of a contract	Personal Data may be processed if necessary, without limitation, for the execution of a service and/or product supply contract in which they are a party as an Employee, Client, and/or Supplier, or to carry out pre-contractual diligence at their request.
Compliance with a legal obligation	Personal Data may be processed to ensure and guarantee compliance with legal obligations to which it is subject under the legislation of a Member State and/or the European Union.
Protection of the Data Subject's vital interests	Personal Data may be processed to ensure the protection of their vital interests, namely when such Processing is essential to their life.
Legitimate Interests	2RF, other Controllers, or Third Parties, may process Personal Data provided that such Processing does not prevail over their interests or fundamental rights and freedoms.

Given the aforementioned, the collection of Personal Data based on the exposed legal bases will be essentially for purposes related to the development of 2RF's social object, as well as for the execution of its contracts and legal obligations, and the failure to collect Personal Data will imply the impossibility of executing the purposes for which Personal Data are subject to processing.

PROCESSING OF PERSONAL DATA ON THE SITE

2RF processes the Data Subject's Personal Data as follows:

Purpose	Processing Activities	Legal Basis	Retention Period
Website Management	Analysis and processing of Web Navigation Data	Execution of the contract, which terms are governed by the Website's Terms and Conditions ("Contract")	Up to 3 months after the last visit to the Website
Website Management	Account creation and access authentication		During the registration period on the Website
Customer Management	Order analysis and execution	Pre-contractual diligence or Contract execution	For the period necessary to fulfill the Contract and/or legal obligations
Customer Management	Handling contacts and complaints	Compliance with legal obligations	For the period necessary to manage complaints, in accordance with applicable legal deadlines
Commercial and Marketing Activities	Direct marketing communications	Consent	Up to 1 year after the last contact
	Direct marketing communications	Legitimate Interest for communications under the Contract	Up to 1 year after the termination of the Contract
	Generalized profile definition	Legitimate Interest	Up to 1 year after collection
	Individualized profile definition	Consent	Up to 1 year after collection
	Satisfaction surveys	Legitimate Interest	Up to 1 year after the last contact

PERSONAL DATA PROCESSED ON THE SITE

For the stated purposes, 2RF processes the following Personal Data:

Purpose	Personal Data
Website Management	Personal Identification Data, Contact Data, Authentication and Access Data, and/or Web Navigation Data (such as name, email, user account, username, password, creation date, access validity, login and logout records, electronic identifier (Mac, IP), connection start date/time, connection end date/time, web navigation origin location, visited URL, social network address, social network interaction history, or host name)
Customer Management	Personal Identification Data, Contact Data, Payment and Transaction Data, Contract Data, and/or Complaint Data (such as name, email, phone/mobile number, address, preferred delivery schedule, product delivery point, transaction number, transaction description, transaction date, transaction amount, number of transactions, electronic billing, invoice number, contract number, purchase history, customer segments, product quantity, product value, product acquisition date, acquisition channel/location, and customer spending amounts, complaint number, complaint date, complaint description, complaint origin, or complaint response date)
Commercial and Marketing Activities	Personal Identification Data, Contact Data, Payment and Transaction Data, Contract Data, and/or Satisfaction Survey Data (such as name, address, preferred delivery schedule, product delivery point, transaction number, transaction description, transaction date, transaction amount, number of transactions, purchase history, customer segments, product quantity, product value, product acquisition date, acquisition channel/location, customer spending amounts, satisfaction index, preference factors, opinion, or areas of interest)

DISCLOSURE AND TRANSMISSION OF PERSONAL DATA

2RF employees will process the Personal Data of the Data Subjects for the execution of their work duties and will handle the Personal Data exclusively as specified in this Privacy Policy.

Personal Data may be made available to third parties responsible for providing services to 2RF ("Subcontractors"), bound by a written contract and to process the data under the terms of this Privacy Policy, and may not process them, directly or indirectly, for any other purpose, for their own benefit or that of a third party.

Data Subjects have the right to obtain a complete and updated list of Subcontractors (if any) contracted by 2RF, and for this purpose should submit a specific request to 2RF as specified in Point 10 of this Privacy Policy.

In compliance with legal obligations, the Personal Data of Data Subjects may be transmitted to third parties, for the pursuit of their own purposes, namely banks and insurers, judicial, administrative, supervisory, or regulatory authorities, and entities that lawfully carry out data compilation actions, fraud prevention and combat actions.

Your Personal Data may also be processed by the entities managing the social networks or functionalities available on the Website, such as for the purpose of sharing content or creating an account, in accordance with their respective privacy policies, which we recommend reading before browsing the Website.

INTERNATIONAL TRANSFERS

2RF may transfer the Data Subject's Personal Data outside the European Economic Area ("EEA") to locations that may not guarantee the same level of protection.

However, where applicable, 2RF will only transfer Personal Data outside the EEA according to the following measures:

When the transfer is made to a location or through a method or under circumstances that the European Commission considers to ensure adequate protection of Personal Data;
When it has implemented standard data protection contractual clauses approved by the European Commission or a competent supervisory authority; or,
When none of the above options apply, but the law still authorizes such transfer, for example, if it is necessary for the declaration, exercise, or defense of a right in judicial proceedings.
You may request detailed information about the security measures that 2RF has implemented regarding transfers of Personal Data outside the EEA and, where applicable, a copy of the standard data protection contractual clauses in force at 2RF through the contacts provided in Point 9.

RIGHTS OF DATA SUBJECTS

Under current or future Data Protection Legislation, 2RF informs that Data Subjects have the right to access, rectification, restriction, portability, erasure, and the right to object to the processing of Personal Data, in certain circumstances, which can be exercised under the terms of this chapter of the Privacy Policy.

Rights	What do they consist of?
Right to information	The Data Subject has the right to obtain clear, transparent, and easily understandable information about how 2RF uses their Personal Data and what their rights are. This is why 2RF provides all this information in this Privacy Policy.
Right of access	The Data Subject has the right to obtain information about what Personal Data 2RF processes (if any) and certain information (similar to that provided in this Privacy Policy) about how those Data are processed. This right allows them to be aware and confirm that we are using their Data in accordance with Data Protection Legislation. 2RF may refuse to provide the requested information whenever, to do so, 2RF would have to disclose Personal Data of another person or the information would negatively impact the rights of another person.
Right to rectification	If the Data Subject's Personal Data is incorrect or incomplete (e.g., if their name or address is wrong), a request may be made for 2RF to take reasonable steps to correct them.
Right to erasure of Personal Data	This right is also known as the "right to be forgotten" and, in simple terms, allows the Data Subject to request the deletion or removal of their data, provided there are no valid grounds for 2RF to continue using them or their use is unlawful. This is not a general right to erasure, as exceptions are allowed (e.g., whenever those data are necessary for the defense of a right in legal proceedings).
Right to restriction of processing	The Data Subject has the right to "block" or prevent the future use of their Data while 2RF evaluates a rectification request or as an alternative to erasure. Whenever Processing is restricted, 2RF may still store their data but cannot use them thereafter. 2RF keeps a list of subjects who have requested the "block" of the future use of their data to ensure that this restriction is respected.
Right to data portability	The Data Subject has the right to obtain and reuse certain Personal Data for their own purposes across different organizations. This right only applies to their own Data provided to 2RF and which 2RF processes with consent and those processed by automated means.
Right to object	The Data Subject has the right to object to certain types of processing, on grounds relating to their particular situation, at any time during that processing, for purposes of the legitimate interest of 2RF or third parties. 2RF may continue to process those Data if it can demonstrate "overriding legitimate grounds for the processing which override their interests, rights, and freedoms" or if those Data are necessary for the establishment, exercise, or defense of a right in legal proceedings.
Right to lodge a complaint	The Data Subject has the right to lodge a complaint with the competent supervisory authority, the National Data Protection Commission – CNPD, if they believe that the Processing of Personal Data violates their rights and/or Data Protection Legislation.

If the legal basis for the processing of your personal data is consent or legitimate interest, you may respectively withdraw consent or object to the processing at any time, without any consequence, but without compromising the lawfulness of the processing carried out until then. If consent is withdrawn or there is an express objection, 2RF will immediately cease processing your personal data for the relevant purpose, unless it is necessary to process the data to comply with legal and/or contractual obligations.

You may at any time, in writing, exercise the rights enshrined in Data Protection Legislation and other applicable legislation through the means described in Point 9 of this Privacy Policy.