Scope and Purpose
This Privacy Policy has been implemented to demonstrate the commitment and respect of Dourogás – Participações Sociais, SGPS S.A. (hereinafter “Dourogás”) towards privacy rules and the protection of personal data.

Why this Privacy Policy?
This Privacy Policy is intended to inform you of the general rules regarding privacy and the processing of your personal data, which we collect and process in strict compliance with national and European data protection legislation.

Dourogás is committed to adopting best practices in the field of security and personal data protection, in order to safeguard the data provided by all those who, in any way, interact with it.

What does this Privacy Policy cover?
This Privacy Policy applies to the collection and processing of personal data carried out by Dourogás.

Recipients
This Privacy Policy is intended for the general public and, in particular, for Dourogás customers.

Definitions
Personal Data – Any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Special Categories of Personal Data – Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data for the purpose of uniquely identifying a person, data concerning health or data concerning a person’s sex life or sexual orientation.

Processing – Any operation or set of operations performed on personal data or on sets of personal data, whether by automated means or not, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Controller – The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

Personal Data Breach – A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

Processor – A natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Third Party – A natural or legal person, public authority, agency or body other than the data subject, controller, processor, and persons authorised to process data under the direct authority of the controller or processor.

Collection and Processing of Personal Data
Within the scope of Dourogás’ activity as a Natural Gas Supplier, personal data is collected, recorded, organised, stored, used and consulted. Other operations may also take place which, under the GDPR, are referred to as “processing of personal data”.
The personal data collected may relate to customers and/or former customers, prospective customers, employees, job applicants, suppliers, partners, service providers and their staff.

Use and Purposes of Data Processing
In general terms, Dourogás processes the personal data necessary for the purposes of financial, accounting and administrative management, management of commercial activity (management of contacts and customers), human resources management (selection and recruitment of personnel), litigation management (management of collections and credit recovery, provision of information to judicial, administrative, supervisory and/or regulatory authorities), capture and recording of images by CCTV devices, and compliance with legal and/or contractual obligations (by way of example, maintenance of all infrastructures that integrate the natural gas network – Article 20 of Decree-Law 140/2006 of 26 July, or the handling of requests for information and complaints – Article 46 of Decree-Law 30/2006 of 15 February and Articles 28 onwards of Regulation no. 139-A/2013 of 16 April – Service Quality Regulation).
At the time of collection of Personal Data, Dourogás provides data subjects with detailed information regarding the nature of the data collected and regarding the purpose and the processing that will be carried out in relation to the personal data.

Categories of Personal Data Processed
In the course of its activities, Dourogás processes categories of personal data relating to data subjects, which may include:

• Identification and contact data – for example, name, citizen card number, postal address, telephone/mobile number, email;
• Commercial data for the provision of services – for example, meter reading, universal installation code (CUI), delivery point code (CPE), consumption data, data resulting from information provided in the context of responding to any queries;
• Payment data – for example, tax identification number, credit and/or debit card numbers, payment dates, amounts owed, payments received, billing history;
• Data from the capture and recording of images by CCTV devices – images captured by the video surveillance system;
• Security credential data – for example, user identification, password, authentication security information and access to the customer area

Subcontracted entities
Within the scope of the processing of the data subject’s data, Dourogás uses or may use third-party entities subcontracted by it to, on its behalf and in accordance with the instructions given by it, carry out the processing of the data subject’s data, in strict compliance with the provisions of the law and this Privacy Policy.

These subcontracted entities may not transmit the data subject’s data to other entities without prior written authorisation from Dourogás, and are also prevented from contracting other entities without prior authorisation from Dourogás.

Dourogás undertakes to subcontract only entities that provide sufficient guarantees of implementing appropriate technical and organisational measures, in order to ensure the protection of the data subject’s rights. All entities subcontracted by Dourogás are bound to it by means of a written contract in which, namely, the subject matter and duration of the processing, the nature and purpose of the processing, the type of personal data, the categories of data subjects and the rights and obligations of the parties are regulated.

At the time of collection of personal data, Dourogás provides the data subject with information regarding the categories of subcontracted entities that, in the specific case, may carry out data processing on behalf of Dourogás.
The data subject’s data collected by Dourogás is not shared with third parties without the consent of the data subject.

Notwithstanding, under the applicable legal terms, Dourogás may transmit or communicate the data subject’s data to other entities where such transmission or communication is necessary for the performance of the contract established between the data subject and Dourogás or for pre-contractual measures at the request of the data subject, where it is necessary for compliance with a legal obligation to which Dourogás is subject, or where it is necessary for the purposes of pursuing the legitimate interests of Dourogás or of a third party. Where a transfer of the data subject’s data to third parties occurs, reasonable efforts will be made to ensure that the recipient uses the data subject’s data transmitted in a manner consistent with this Privacy Policy.

General principles applicable to the processing of the data subject’s data
In terms of general principles relating to the processing of personal data, Dourogás undertakes to ensure that the data subject’s data processed by it is:

• Subject to lawful, fair and transparent processing in relation to the data subject;
• Collected for specified, explicit and legitimate purposes, not being further processed in a manner incompatible with those purposes;
• Adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed;
• Accurate and kept up to date whenever necessary, with all appropriate measures being taken to ensure that inaccurate data, having regard to the purposes for which it is processed, is erased or rectified without delay;
• Kept in a form which permits identification of the data subject only for the period necessary for the purposes for which the data is processed;
• Processed in a manner that ensures its security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, with appropriate technical or organisational measures being adopted.

Lawfulness grounds
The data processing carried out by Dourogás is lawful when at least one of the following situations applies:

• The data subject has given explicit consent for the processing of their personal data for one or more specific purposes;
• The processing is necessary for the performance of a contract to which the data subject is party, or for pre-contractual steps at the request of the data subject;
• The processing is necessary for compliance with a legal obligation to which Dourogás is subject;
• The processing is necessary to protect the vital interests of the data subject or of another natural person;
• The processing is necessary for the purposes of the legitimate interests pursued by Dourogás or by a third party (except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data).

Dourogás undertakes to ensure that the processing of the data subject’s data is carried out only under the conditions listed above and in compliance with the aforementioned principles.

Where the processing of the data subject’s data is carried out by Dourogás on the basis of the data subject’s consent, the data subject has the right to withdraw their consent at any time. The withdrawal of consent shall not, however, affect the lawfulness of processing based on consent given before its withdrawal.

The period of time during which data is stored and retained varies according to the purpose for which the information is processed.

Indeed, there are legal requirements that oblige the retention of data for a minimum period of time.

Thus, and whenever there is no specific legal requirement, the data will be stored and retained only for the minimum period necessary for the purposes that motivated its collection or subsequent processing, after which it will be deleted.

Technical, organisational and security measures implemented
To ensure the security of the data subject’s data and maximum confidentiality, Dourogás processes the information provided to it in an absolutely confidential manner, in accordance with its internal security and confidentiality policies and procedures, which are periodically updated according to needs, as well as in accordance with legally established terms and conditions, in order to promote security and integrity, namely with regard to unauthorised or unlawful processing of personal data and its accidental loss, destruction or damage.

Depending on the nature, scope, context and purposes of the data processing, as well as the risks arising from the processing for the rights and freedoms of the data subject, Dourogás undertakes to apply, both at the time of defining the means of processing and at the time of the processing itself, the technical, organisational and logical and physical security measures necessary and appropriate for the protection of the data subject’s data and for compliance with legal requirements. It also undertakes to ensure that, by default, only the data necessary for each specific purpose of the processing is processed.

Transfer of data outside the European Union
The personal data collected and used by Dourogás is not made available to third parties established outside the European Union. If, in the future, such a transfer occurs, Dourogás undertakes to ensure that the transfer complies with the applicable legal provisions, namely regarding the determination of the adequacy of such country in terms of data protection and the requirements applicable to such transfers.

Rights of data subjects
As a data subject whose personal data is processed by Dourogás, you have the right of access, rectification, restriction, portability, erasure and objection, which may be exercised under certain circumstances and conditions.

RIGHT TO INFORMATION
The data subject has the right to obtain clear, transparent and comprehensible information about the way in which Dourogás processes their data, such as:

• The identity and contact details of Dourogás, the controller;
• The purposes of the processing for which the personal data is intended, as well as, where applicable, the legal basis for the processing;
• If the processing of the data is based on the legitimate interests of Dourogás or of a third party, indication of such interests;
• Where applicable, the recipients or categories of recipients of the personal data;
• Where applicable, indication that the personal data will be transferred to a third country or an international organisation, and the existence or absence of an adequacy decision adopted by the Commission or reference to appropriate or suitable transfer safeguards;
• Retention period of the personal data;
• The right to request from Dourogás access to the personal data, as well as its rectification, erasure or restriction, the right to object to the processing and the right to data portability;
• If the processing of the data is based on the consent of the data subject, the right to withdraw consent at any time, without compromising the lawfulness of the processing carried out on the basis of the consent previously given;
• The right to lodge a complaint with the CNPD or another supervisory authority;
• Indication of whether the provision of personal data constitutes a legal or contractual obligation, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and the possible consequences of not providing such data;
• Where applicable, the existence of automated decisions, including profiling, and information relating to the underlying logic, as well as the significance and the envisaged consequences of such processing for the data subject;
• In the event that the data subject’s data is not collected directly by Dourogás from the data subject, in addition to the information referred to above, the data subject shall additionally be informed about the categories of personal data subject to processing and also about the source of the data and, where applicable, whether it comes from publicly accessible sources;
• If Dourogás intends to carry out further processing of the data subject’s data for a purpose other than that for which the data was collected, before such processing Dourogás shall provide the data subject with information on that purpose and any other relevant information, under the terms referred to above;

Procedures and measures implemented with a view to compliance with the right to information
The above-mentioned information is provided to the data subject, in writing (including by electronic means), by Dourogás and prior to the processing of the personal data concerned. Under the applicable law, Dourogás is not obliged to provide the data subject with this information where and to the extent that the data subject already has knowledge of it.

The information is provided by Dourogás free of charge.

Right of access to personal data
Dourogás guarantees the means that allow access by the data subject to their personal data.

The data subject has the right to obtain from Dourogás confirmation as to whether or not personal data concerning them is being processed and, where that is the case, the right to access their personal data and the following information:

• The purposes of the data processing;
• The categories of personal data in question;
• The recipients or categories of recipients to whom the personal data has been or will be disclosed, namely recipients established in third countries or belonging to international organisations;
• The retention period of the personal data;
• The right to request from Dourogás the rectification, erasure or restriction of the processing of personal data, or the right to object to such processing;
• The right to lodge a complaint with the CNPD or another supervisory authority;
• If the data has not been collected from the data subject, the available information about the source of that data;
• The existence of automated decisions, including profiling, and information relating to the underlying logic, as well as the significance and the envisaged consequences of such processing for the data subject;
• The right to be informed about the appropriate safeguards associated with the transfer of data to third countries or international organisations.

Upon request, Dourogás shall provide the data subject, free of charge, with a copy of their data undergoing processing. The provision of other copies requested by the data subject may entail administrative costs.

Right to rectification of personal data
The data subject has the right to request, at any time, the rectification of their personal data and, likewise, the right to have their incomplete personal data completed, including by means of an additional statement.

In the event of rectification of the data, Dourogás shall communicate such rectification to each recipient to whom the data has been transmitted, unless such communication proves impossible or involves a disproportionate effort for Dourogás.

Right to erasure of personal data (“Right to be forgotten”)
The data subject has the right to obtain from Dourogás the erasure of their data where one of the following grounds applies:
• The data subject’s data is no longer necessary for the purpose that motivated its collection or processing;
• The data subject withdraws the consent on which the processing of the data is based and there is no other legal basis for such processing;
• The data subject objects to the processing under the right to object and there are no overriding legitimate interests justifying the processing;
• The data subject’s data is processed unlawfully;
• The data subject’s data has to be erased for compliance with a legal obligation to which Dourogás is subject.

Under the applicable legal terms, Dourogás is not obliged to erase the data subject’s data to the extent that the processing proves necessary for compliance with a legal obligation to which Dourogás is subject or for the establishment, exercise or defence of a right of Dourogás in judicial proceedings.

In the event of erasure of the data, Dourogás shall communicate such erasure to each recipient/entity to whom the data has been transmitted, unless such communication proves impossible or involves a disproportionate effort for Dourogás.

Where Dourogás has made the data subject’s data public and is obliged to erase it under the right to erasure, Dourogás undertakes to ensure such measures as are reasonable, including of a technical nature, taking into account the available technology and the cost of its application, in order to inform the controllers actually processing the personal data that the data subject has requested from them the erasure of links to such personal data, as well as copies or reproductions thereof.

Right to restriction of the processing of personal data
The data subject has the right to obtain from Dourogás restriction of the processing of the data subject’s data if one of the following situations applies (restriction consists in inserting a mark on the personal data stored with the aim of limiting its processing in the future):
• If they contest the accuracy of the personal data, for a period enabling Dourogás to verify its accuracy;
• If the processing is unlawful and the data subject opposes the erasure of the data, requesting, in return, the restriction of its use;
• If Dourogás no longer needs the data subject’s data for processing purposes, but such data is required by the data subject for the establishment, exercise or defence of a right in judicial proceedings;
• If the data subject has objected to the processing, until it is verified that the legitimate grounds of Dourogás override those of the data subject.

Where the data subject’s data is subject to restriction, it may, with the exception of storage, only be processed with the consent of the data subject or for the establishment, exercise or defence of a right in judicial proceedings, for the defence of the rights of another natural or legal person, or for reasons of public interest laid down by law.

The data subject who has obtained restriction of the processing of their data in the cases referred to above shall be informed by Dourogás before the restriction on processing is lifted.

In the event of restriction of the processing of the data, Dourogás shall communicate such restriction to each recipient to whom the data has been transmitted, unless such communication proves impossible or involves a disproportionate effort for Dourogás.

Right to portability of personal data
The data subject has the right to receive the personal data concerning them and which they have provided to Dourogás in a structured, commonly used and machine-readable format, and the right to transmit that data to another controller, if:

• The processing is based on consent or on a contract to which the data subject is party; and
• The processing is carried out by automated means.

The right to portability does not include inferred data or derived data, i.e., personal data generated by Dourogás as a consequence or result of the analysis of the data subject to processing.

The data subject has the right to have the personal data transmitted directly between controllers, whenever technically possible.

Right to object to processing
The data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them which is based on the pursuit of legitimate interests pursued by Dourogás or where the processing is carried out for purposes other than those for which the personal data was collected, including profiling, or where the personal data is processed for statistical purposes.

Dourogás shall cease processing the data subject’s data, unless it presents compelling and legitimate grounds for such processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of a right of Dourogás in judicial proceedings.

Procedures with a view to the exercise of rights by the data subject
The right of access, the right of rectification, the right of erasure, the right to restriction, the right to portability and the right to object may be exercised by the data subject by contacting Dourogás and completing the respective form.

Dourogás shall respond in writing (including by electronic means) to the request of the data subject within a maximum period of one month from receipt of the request, except in cases of particular complexity, in which case that period may be extended by up to two months.

If the requests submitted by the data subject are manifestly unfounded or excessive, namely due to their repetitive nature, Dourogás reserves the right to charge administrative costs or refuse to act on the request.

Personal data breaches
In the event of a data breach and insofar as such breach is likely to result in a high risk to the rights and freedoms of the data subject, Dourogás undertakes to notify the personal data breach to the National Data Protection Commission (“CNPD”) within 72 hours of becoming aware of the incident.

Under the legal terms, communication to the data subject is not required in the following cases:

• Where Dourogás has implemented appropriate protection measures, both technical and organisational, and those measures have been applied to the personal data affected by the personal data breach, especially measures that render the personal data unintelligible to any person not authorised to access that data, such as encryption;
• Where Dourogás has taken subsequent measures which ensure that the high risk to the rights and freedoms of the data subject is no longer likely to materialise; or
• Where communication to the data subject would involve a disproportionate effort for Dourogás, in which case it shall make a public communication or take a similar measure through which the data subject will be informed.

Newsletter subscription
Dourogás GNV informs that, by subscribing to our newsletter, you will also be allowing the sending of communications from the Group of which the company forms part – Dourogás SGPS.
The Dourogás SGPS Newsletters address topics such as the future of energy and the gas sector in Portugal, constituting a way of remaining close to the entire Dourogás community.
Subscribers may, at any time, cancel their registration through the option present in the footer of all Newsletters.

 

Contacts
Responsible for Processing: Dourogás Natural: Comércio de Gás Natural e Energia, S.A.
Rua 31 de Agosto nº12, 5000-305 Vila Real
808 500 950

You may at any time, in writing, exercise the rights enshrined in the applicable data protection legislation, through the email: protecaodedados@dourogas.pt

It is further informed that, as data subject, you have the right to lodge a complaint with the CNPD (Av. D. Carlos I, 134 – 1.º 1200-651 Lisboa – Tel: +351 213928400 – Fax: +351 213976832 – email: geral@cnpd.pt) regarding the data processing carried out by Dourogás, in its capacity as Controller.

Changes to the privacy policy
Dourogás reserves the right to amend this Privacy Policy at any time. When it does so, it shall publish the updated Privacy Protection Policy, and you are therefore advised to consult it regularly.

Applicable law and jurisdiction
The Privacy Policy, as well as the collection, processing or transmission of the data subject’s Data, are governed by the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 and by the legislation and regulations applicable in Portugal.