Privacy policy

This Privacy Policy was developed to support Pink Store, Lda, a company with tax identification number 509431240, with tax headquarters in Quinta das Courelas - Rua da Imprensa, Nº 1, Lote 6, Loja 1 - B 3200-149 Lousã – hereinafter PINK, owner of the website www.pinkstore.pt in adapting its activity to the General Data Protection Regulation, approved by Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (“GDPR”).

This policy is complemented by others on security, which are relevant to the company's business, jointly describing PINK's approach to information security and privacy.

This policy applies to all PINK Professionals and Partners and, when identified, to third parties who access the company's assets.

The terms 'Privacy', 'Data Privacy' and 'Data Protection' can be used in the same sense as they are associated with a complex set of legal requirements that apply to Personal Data, which goes beyond data security and confidentiality. For example, it includes requirements on the transparency of data use and its conservation.

Compliance with this policy is mandatory and, therefore, all Professionals and Partners have the individual responsibility for ensuring their compliance with it and, if necessary, must request clarification from the leaders of their respective teams.

It is PINK's responsibility to define the appropriate mechanisms to achieve compliance with this policy, being responsible for the operational implementation of the teams, with the support of the Privacy Officer.

Compliance with this policy can be monitored through inspections, audits and/or requests for written confirmation of compliance, with all areas being responsible for regularly evaluating their compliance with it within their area of responsibility.

Accordingly, any employee who has violated this policy is subject to disciplinary action.

This policy is based on the principles set out in the GDPR. However, there are national differences in the applicability of PINK data protection and privacy when processing personal data outside the EU, when receiving personal data from outside the EU or when processing personal data of non-EU citizens.

If in doubt, contact PINK using the contact details provided.

 

Data Protection Principles

As part of our activity, we process Personal Data: whether we receive personal data in the course of our business opportunities, our engagements with customers, marketing activities or a series of other related and support activities. Data may be received directly from a Data Subject (e.g. in person, via post, email, telephone or other sources), namely from our customers, partners, subcontractors, joint data controllers, support service providers and credit reference agencies.

All professionals and partners should only request personal data from a Data Subject that is relevant and necessary to fulfill a certain business purpose and task.

PINK is committed to complying with the personal data protection principles defined by the GDPR, namely:

• Lawfulness, loyalty and transparency: means that we must have a legitimate reason for processing Personal Data, for example, consent of the Data Subject, compliance with a legal obligation to which we are subject. It also means that we must clearly inform the Data Subject about the processing;
• Limitation of Purposes: we must only request Personal Data for specific, explicit and legitimate purposes and not process them beyond the purpose for which they were requested;
• Data minimization: Personal Data subject to processing must be adequate, relevant and limited to what is necessary;
• Accuracy: we are obliged to ensure that Personal Data is accurate and update it whenever necessary;
• Limitation of retention: we must not retain Personal Data for a period longer than necessary for the purposes for which they are processed, although we may retain some for historical and statistical purposes;
• Integrity and Confidentiality: we must have adequate security controls in place to protect data against unauthorized and illegal processing, loss, destruction or damage, including technical and organizational measures, such as defined processes, training and awareness;
• Lawful transfer outside the European Economic Area: we only transfer Personal Data outside the EEA provided that there are appropriate safeguards, such as a contractual basis;
• Data Subject Rights: Data Subjects have several rights that we must respect (for example, the right to access a copy of the data we have archived and the right to withdraw consent given for direct marketing purposes).

 

Lawfulness and loyalty in treatment

Whenever Personal Data is collected, it is necessary to have a legal basis for the inherent processing. According to the GDPR, we must identify at least one of the following reasons for processing Personal Data:

• Consent: The Data Subject has given consent for the Data to be processed for one or more specific purposes;
• Contractual: Processing is necessary for the execution of a contract to which the Data Subject is party or for pre-contractual measures;
• Legal: Processing is necessary to comply with a legal obligation, to which the Data Controller is subject;
• Vital interests: Processing is necessary to protect the vital interests of the Data Subject;
• Public interest: Processing is necessary for the performance of a task carried out in the public interest;
• Legitimate interests: Processing is necessary for the legitimate interests of the Data Controller, except when the interests or fundamental rights and freedoms of the Data Subject prevail.

 

When we act as Data Controller, we must ensure that we have a legitimate basis for collecting and processing Personal Data.

In some situations, we may act as a Processor on behalf of our client, in which case it is their responsibility to ensure that they have a correct reason for processing Personal Data, which they must share with us. However, we must take steps to ensure that our contract is clear about our responsibilities in this regard and that, if we collect Personal Data directly from Data Subjects on behalf of the customer, we have the basis to do so legitimately.

When a Special Category of Data is processed there is an additional set of conditions that must be met. Please contact PINK for further guidance.

The GDPR requires that Data Subjects be provided with information about the processing in order to ensure fair and transparent treatment. Whenever we collect Personal Data we must ensure that we appropriately explain why we need the information and how we will treat it. When information is gathered through our website this information is given through a ‘Privacy Notice’.

Any other information to be provided when collecting personal data must also be provided on the internet. Please see our Privacy Policy and Cookies Policy for more information.

 

Processing for specific purposes only

Whenever we collect and process Personal Data, we must ensure that we only use it for the specific purposes that were communicated to the respective holder.

PINK must never process Personal Data for additional purposes that have not been communicated to the Data Subject. Only then will we be clear about the purpose of the processing and we must understand the purposes for which our customers may have collected Personal Data or contact the Privacy Officer.

 

Adequate, pertinent and limited treatment

When we collect and process Personal Data we must follow the principle of data minimization. This means that we must collect only the minimum Personal Data necessary to carry out a specific task.

Additionally, we must ensure that we have an adequate amount of personal data to adequately carry out a specific task. For example, collecting data necessary only to identify a person.

This also applies to any sharing and other processing activities. It is important to minimize the data maintained and processed; We must ensure that if we share data internally or externally or if we use it in activities such as testing, we should only use/share the minimum amount in each case.

 

Accuracy of personal data

We have an obligation to ensure that Personal Data is kept accurate and up to date. We must ensure that adequate processes are in place to maintain accurate data whenever necessary (for example, from professionals or current and potential clients held by the relevant areas).

When acting as Data Controller in relation to a customer, we will not be obliged to implement mechanisms to keep this data up to date; This will be the responsibility of the Data Controller, that is, our client.

 

Conservation of Personal Data

Personal Data should not be kept for longer than necessary. This means that we must define and apply maximum retention periods for the Personal Data we process and implement processes to delete them when they expire. Therefore, the following conservation periods may apply:

(i) for as long as necessary for the relevant activity or services;

(ii) any retention period required by law;

(iii) the end of the period in which disputes or investigations may arise in relation to the Services; or

(iv) for the minimum period provided for in the contract.

 

Rights of Data

The GDPR requires us to inform people about the Personal Data we collect, the purposes and means for which it is processed. Such information is given in the form of a ‘Privacy Notice’.

1. a) Right of Access

• The Data Subject has the right to request to see the Personal Data we have about them, the purpose of the processing and the categories of data in question.
• We must notify the Data Subject of the recipients with whom we will share their data, especially if the recipient is in another country or belongs to an international organization.
• Where possible, we will define the data retention period to meet commercial objectives.
• We must communicate to the Data Holder the existence of the right to object to the processing and their right to rectification and erasure.
• We must communicate to the Data Subject the existence of their right to complain to a Control Authority.
• When data is collected from someone other than the Data Holder, we must inform the Data Holder of the source of that data.
• We must ensure that we have processes in place to identify and respond to Data Subject access concerns, without undue delay, and within a maximum period of one month.

1. b) Right to rectification

• Data Holders have the right to rectify inaccurate data, and PINK must make every effort to do so immediately.

1. c) Right to erasure

• The Data Subject has the right to obtain from the Data Controller the erasure of their data (‘right to be forgotten’). PINK is responsible for doing its best to immediately delete the data kept, except when there is a legal requirement for its conservation. If you receive a request from a Data Subject, please first contact the Privacy Officer before deleting any data.

1. d) Children's rights

• All individuals, including children, are protected by the GDPR. For children under 13 years of age, we must not process their Personal Data based on their consent, unless authorized by the respective holders of parental responsibilities.

1. e) Marketing

• We may sometimes send our customers and partners marketing material to inform them of services, upcoming events or other activities of interest to them, in which case we must indicate their right to withdraw consent at any time if they wish not to be contacted again in these terms.
• We must also ensure that we have processes in place to ensure that all participation preferences are recorded and respected.

 

 

Security of Retained Data

PINK will maintain data security by protecting the Confidentiality, Integrity and Availability of Personal Data, as follows:

• Confidentiality means that only authorized people can access the data;
• Integrity means that Personal Data must be accurate and suitable for the purposes inherent to the processing;
• Availability means that authorized users must be able to access data if they need it for authorized purposes.

 

 

 

Data Disclosure

All professionals and partners must avoid any inappropriate disclosure of Personal Data and comply with our general duties regarding Confidentiality.

It's allowed:

1. a) Disclose Personal Data to third parties only upon instruction or when we have a legitimate basis for doing so, and there are no restrictions in place.
2. b) Disclose Personal Data to third parties if we sell or buy any business or assets, or where we are a joint Controller as part of a joint venture.
3. c) Share Personal Data with a third party who is processing data on our behalf, which may include transferring data to a third country.

Generally, Personal Data may be disclosed:

1. a) To Professionals or agents so that they can perform their functions as such.
2. b) In cases where non-disclosure may prejudice the prevention or detection of crimes, the prosecution of offenders, or the assessment or collection of any tax or fee. PINK must have adequate reasons to disclose data under this category in order to avoid criminal prosecution. All disclosures must be justified and documented.

For legal purposes, data may be disclosed if:

1. a) Required by law, statute or court order.
2. b) For the purpose of obtaining legal advice;
3. c) Within the scope or for the purposes of legal proceedings or when necessary to defend a legal right.
4. d) To safeguard national security.

 

International Transfer of Personal Data

PINK may transfer any Personal Data to a third country or international organization. The Personal Data we hold may also be processed by employees operating in a third country or for one of our suppliers.

We must ensure that at least one of the following conditions applies:

1. a) The country to which Personal Data is transferred guarantees an adequate level of protection for the rights and freedoms of Data Subjects, as decided by the EU Commission.
2. b) Appropriate safeguards are provided (e.g. standard data protection clauses).
3. c) The Data Subject has given explicit consent to the transfer after being informed of the possible risks.
4. d) The transfer is necessary for one of the reasons set out in the GDPR, including the performance of a contract between PINK and the Data Subject, or protection of the Data Subject's vital interests.
5. e) The transfer is legally required for important reasons of public interest or for the filing of legal actions or defense thereof.

 

Log information, cookies and web beacons

The PINK website uses cookies to distinguish its users. PINK collects standard Internet log information, including the user's IP address, browser type and language, access times and referring website addresses.

To ensure that our website is well managed and to facilitate navigation, PINK or its service providers may also use cookies (small text files stored in the user's browser) or web beacons (electronic images that allow our website to count visitors who access a website and certain cookies) to collect aggregated data.

 

Professional Information

Collection and Conservation

• PINK, as an employer, collects, processes and stores personal data of workers, contractors, consultants and candidates. The Human Resources Department and other departments that process Personal Data of professionals must verify and document the legal basis inherent to the processing they carry out. The Personal Data of professionals should only be processed when there is a valid and legitimate purpose for this purpose.
• The collection of personal data related to our employees occurs through different channels and formats, such as: registration forms; electronic web forms, (e.g. during the recruitment process); data records; CCTV images; Team photographs, including identification cards; data from other sources (e.g. previous employers); credit checks and security checks; etc.
• The creation and storage of personal data related to our professionals occurs through various channels and formats, such as: payment receipts; evaluation records; Employment contracts; emails; illness records; etc.

Training and Awareness

• We are committed to providing adequate training on personal data protection to all professionals. If necessary we will provide personalized training and awareness for people taking into account their roles.

Process design and change

• For all proposed new systems and business procedures involving Personal Data, consideration should be given to whether an impact assessment on privacy and information security is necessary to identify risks and controls.

 

 

 

COOKIE POLICY

This website uses cookies to provide a better experience for its visitors and to ensure that it is fully functional. This Cookie Policy is part of our Privacy Policy, which you should refer to for more information about us and how we protect user information. In order to provide a personalized and efficient service to our users, it is necessary to memorize and store information about how this website should be used. To do this, we use small text files called cookies that contain small amounts of information downloaded to the computer or other devices of our users through a server. Your internet browser subsequently sends these cookies back to the website on each subsequent visit, allowing the recognition and memorization of the identity of our visitors, including the usage preferences of our users. You can find more detailed information about cookies and how they work here. Browsing this website allows the collection of information using cookies and other technologies. By using this site, you accept the use of cookies as described in this Cookie Notice.

 

Types of Cookies Used and Why?

Some of the cookies we use are necessary to enable navigation on this website and take advantage of its features, such as accessing secure areas and content exclusive to registered users. Our website also uses functional cookies to record information about our users' choices and to tailor our website to their needs; for example, remembering the language of origin or region or that a user has completed a survey. The recorded information is anonymous and is only intended for the purpose mentioned above. We may use, directly or indirectly, web analytics services to assess the effectiveness of our content and the preferences of our users, allowing us to contribute to optimizing the operation of this website. Additionally, we use web beacons or tracking pixels to count the number of visitors and performance cookies to monitor how individual users access our website and how often. This information is used only for statistical purposes without identifying any particular user. However, for registered users who are logged into the website, we may combine this information with data collected via web analytics services and cookies to analyze how visitors use this website in more detail. This website does not use targeting cookies to promote targeted advertising to our visitors. Whenever you want detailed information about the cookies used on our website, please contact us via email.

 

How to Control Cookies?

Users of the website accept the introduction of cookies on their computers or devices as indicated above, without prejudice to the available control and management. We inform users that removing or blocking cookies may affect their user experience and may limit access to some areas of the website.

 

Browser Controls

The vast majority of browsers allow our users to view stored cookies and delete them individually, or alternatively, block cookies on a specific website or all websites in general. Please note that set preferences, including auto-exclusion, are lost whenever cookies are deleted. For further clarification, users should refer to the websites or visit cookiecentral.com.

 

Management of Analytics Cookies

Our users have the option to choose to disable their anonymity in their browsing activity within websites monitored by analytics cookies. We use the following service providers where you can obtain more information about their privacy policies and how to disable their cookies by clicking on the following links:

Shopify: www.shopify.com/legal/privacy

Google Analytics: google.com/analytics/learn/privacy.html

Facebook Pixel: facebook.com/business/help/742478679120153

 

Management of Local Shared Objects or Flash Cookies

A local shared object or flash cookie resembles other browser cookies but differs in its ability to store more types of information. These cookies cannot be controlled through the mechanisms identified above. Some areas of our website use this type of cookie to store user preferences for media player functionalities, and without them, the content of some videos may not be viewed properly. These cookies can be manually controlled by visiting the Adobe website.
Social Buttons

We utilize social buttons to enable our users to share or bookmark pages. These buttons are associated with social networks that may obtain information about our visitors' activities on the Internet, including on our website. Understanding how the information is used and how users can opt out of its collection should be obtained by reviewing the respective Terms of Use and Privacy Policies of these websites.

 

Email Communications

To assess the relevance of our communications, we may use monitoring technologies to determine if our visitors have read, clicked on links, or forwarded specific email communications sent by us. In case of disagreement with this procedure, our users should reverse their subscription (unsubscribe) since it is not possible to send these emails without these active monitoring mechanisms. Registered subscribers can update their communication preferences at any time by contacting us via email, or they can unsubscribe by following the instructions in the email communication sent to their email address.

This Cookie Policy may be revised at any time, at our discretion. When such changes are made, the revision date at the top of the page will be updated. The revised Cookie Policy will take effect from the revision date. We recommend that users of our website periodically review the Cookie Policies to stay informed about our cookie management.

 

Updated on May 16, 2024