Grupo JAP

This Privacy Policy establishes how Grupo JAP uses the personal data of its customers and potential customers

.We understand that the use of your personal data requires your trust. We adhere to the highest standards of privacy and will only use your personal data for clearly identified purposes and in accordance with your data protection rights.The confidentiality and integrity of your personal data is one of our main concerns.

1. GENERAL PART

1.1 COLLECTION AND PROCESSING OF USER DATA

The Personal Data collected and processed includes information relating to name, email, and address, although other personal data may be collected if necessary or convenient for the provision of services by Grupo JAP.

After collecting Personal Data, Grupo JAP provides the User with detailed information about the nature of the data collected, the purpose, and the processing to be carried out concerning the Personal Data.

Grupo JAP also collects and processes information about the characteristics of your hardware device and browser/software, as well as information about the pages visited by the User on the Site. This information may include your browser type, domain name, access times, and hyperlinks through which the User accessed the Site ("Usability Information"). We use this information solely to improve the quality of your visit to our Site.

Usability Information and Personal Data are referred to in this Privacy Policy as "User Data."

For the purposes of this Privacy Policy, a contractual relationship is understood as any contract established between Grupo JAP and the entities with which it relates, regardless of the respective object.

1.2 SUBCONTRACTED ENTITIES

In the context of User Data processing, Grupo JAP may use third-party entities, subcontracted by it, to process User Data on behalf of Grupo JAP and in accordance with the instructions given by it, following the law and this Privacy Policy.

These subcontracted entities cannot transfer User Data to other entities without Grupo JAP's prior written authorization. They are also prohibited from hiring other entities without Grupo JAP's prior authorization.

Grupo JAP is committed to subcontracting only entities that offer maximum security in implementing the necessary technical and organizational measures to ensure User rights protection. All entities subcontracted by Grupo JAP are bound to this through a written contract regulating the object and duration of the processing, the nature and purpose of the processing, the type of personal data, the categories of data subjects, and the rights and obligations of the parties.

After collecting personal data, Grupo JAP provides the User with information about the categories of subcontracted entities that, in the specific case, may carry out data processing on behalf of Grupo JAP.

1.3 CHANNELS FOR DATA COLLECTION

Grupo JAP can collect data directly (i.e., directly from the User) or indirectly (i.e., through partner entities or third parties). The collection can be done through the following channels:

» Direct collection: in person, by telephone, by email, and through the Site;

» Indirect collection: through partners or group companies and official entities.

2. GENERAL PRINCIPLES APPLICABLE TO USER DATA PROCESSING

In terms of general principles relating to the processing of personal data, Grupo JAP is committed to ensuring that the User Data it processes is:

» Processed lawfully, fairly, and transparently concerning the User;» Collected for specific, objective, and legitimate purposes and not processed subsequently in a manner incompatible with those purposes;

» Adequate, justified, and limited to what is necessary for the purposes for which it is processed;

» Accurate and updated whenever necessary, with all necessary measures being taken to delete or correct inaccurate data promptly, considering the purposes for which it is processed;

» Stored in a way that allows the identification of the User only during the period necessary for the purposes for which the data is processed;

» Processed in a manner that ensures its security, including protection against unauthorized or illegal processing and against accidental loss, destruction, or damage, using appropriate technical or organizational measures.»

Data processing carried out by Grupo JAP is permitted and legal when at least one of the following situations occurs:

» The User has given their clear and unequivocal consent for the processing of their Data for one or more specific purposes;

» Processing is necessary for the performance of a contract to which the User is a party, or for pre-contractual procedures requested by the User;

» Processing is necessary for compliance with a legal obligation to which Grupo JAP is subject;

» Processing is necessary to protect the vital interests of the User or another individual;

» Processing is necessary for the purposes of legitimate interests pursued by Grupo JAP or by third parties (except where such interests are overridden by the interests or fundamental rights and freedoms of the User). Grupo JAP is committed to ensuring that the processing of User Data is only carried out under the conditions listed above and in compliance with the aforementioned principles.

When the processing of User Data is based on the User's consent, the User has the right to withdraw their consent at any time. However, the withdrawal of consent does not compromise the legality of the processing carried out by Grupo JAP based on the consent previously given by the User.

The period during which data is stored and retained varies according to the purpose for which the information is processed.In fact, there are legal requirements that mandate retaining data for a minimum period. Therefore, whenever there is no specific legal obligation, the data will be stored and retained only for the minimum period necessary for the purposes that justified its collection or subsequent processing, after which it will be deleted.

3. USE AND PURPOSES OF USER DATA PROCESSING

In general terms, Grupo JAP uses User Data for the following purposes:

» Managing communication with the User;

» Informing the User, upon their request, about new products and services available on the Site, special offers and campaigns, updated information about Grupo JAP’s activities, and, in general, for marketing purposes through any communication channel, including electronic support or social networks;

» Providing access to restricted areas of the Site, such as the online store;

» Ensuring that the Site meets the User's needs by developing and publishing content as tailored as possible to the User’s requests and type, improving the Site’s search capabilities and features, and obtaining associated or statistical information regarding the User’s profile type (consumer profile analysis);

» Providing services, including newsletters, opinion surveys, or other information or products requested or purchased by the User;

» Sending satisfaction surveys;

» Grupo JAP may combine Usability Information with anonymous demographic information for research purposes and use the results to provide more relevant content on the Site. In certain restricted areas of the Site, Grupo JAP may combine Personal Data with Usability Information to deliver more personalized content to the User.

User Data collected by Grupo JAP is not shared with third parties without the User's consent, except in the situations described in the following paragraph. However, if the User contracts services from Grupo JAP that are provided by other entities responsible for processing personal data, the User's Data may be accessed by those entities to the extent necessary for the provision of such services, and the User will be informed accordingly.

Under applicable legal terms, Grupo JAP may transmit or communicate User Data to other entities if such transmission or communication is necessary for the performance of the contract between the User and Grupo JAP, for pre-contractual procedures requested by the User, to comply with a legal obligation to which Grupo JAP is subject, or to achieve the legitimate interests of Grupo JAP or a third party. If User Data is transmitted to third parties, reasonable efforts will be made to ensure that the recipient uses the transmitted User Data appropriately in line with this Privacy Policy.

4. TECHNICAL, ORGANIZATIONAL, AND SECURITY MEASURES IMPLEMENTED

To ensure the security of User Data and maximum confidentiality, Grupo JAP processes the information you provided in strict confidence, in accordance with its internal security and confidentiality policies and procedures, which are periodically updated according to needs, as well as with the legally established terms and conditions.

Given the nature, scope, context, and purposes of data processing, as well as the risks arising from the processing for the rights and freedoms of the User, Grupo JAP is committed to applying, both at the moment of defining processing means and at the moment of actual processing, the necessary and appropriate technical and organizational measures to protect User Data and comply with legal requirements.

It also commits to ensuring that, by default, only the data necessary for each specific processing purpose is processed, and that such data is not made available without human intervention to an indefinite number of people.

Communication between the User's device and Grupo JA is carried out through secure channels and communications that use the HTTPS protocol and the SSL security standard. Additionally, in terms of general measures, Grupo JAP adopts the following:

» Regular audits to assess the effectiveness of the implemented technical and organizational measures;

» Awareness-raising and training for personnel involved in data processing operations;

» Pseudonymization and encryption of personal data;

» Mechanisms to ensure the confidentiality, availability, and resilience of information systems;

» Mechanisms that ensure the rapid restoration of information systems and access to personal data in the event of a physical or technical incident.

5. DATA TRANSFER OUTSIDE THE EUROPEAN UNION

The Website does not transfer your personal data to recipients located in countries outside the European Union.

6. USE OF COOKIES

When you visit our website, a small text file (Cookie) is created and saved on your computer's disk. Therefore, by browsing the Site, you are accepting the installation of this text file on your device. This file will allow you easier and faster access to the Site, as well as customization according to your preferences.

If you wish to delete them or automatically set their blocking, you can find instructions on how to make these settings in the "Help" menu of your browser. However, if you do not allow the use of cookies, some features of the Site may not be available to you.

By browsing our Site, you are allowing the collection and storage of small text files called cookies, which contain information and are downloaded to the computer or other devices of Users through a server. These text files will provide a more personalized and efficient browsing experience. Each time you visit the Site, your internet browser sends these cookies back to the Site, allowing the recognition and memorization of Users' identities, as well as their usage preferences.

For more information, please refer to our cookie policy here.

7. USER RIGHTS (DATA SUBJECTS)

7.1 RIGHT TO INFORMATION

7.1.1. Information provided to the User by Grupo JAP (when data is collected directly from the User):

» The identity and contact details of Grupo JAP and the data controller;

» The contact details of the Data Protection Officer;

» The purposes for which the personal data will be processed, as well as, where applicable, the legal grounds for the processing;

» If the processing of the data is based on the legitimate interests of Grupo JAP or a third party, an indication of such interests;

» Where applicable, the recipients or categories of recipients of the personal data; » Where applicable, an indication of whether the personal data will be transferred to a third country or an international organization, and whether there is an adequacy decision adopted by the Commission or a reference to appropriate or adequate transfer safeguards;

» The retention period of the personal data;

» The right to request Grupo JAP to access the personal data, as well as its correction, deletion, or limitation, the right to object to the processing, and the right to data portability;

» If the processing of the data is based on the User’s consent, the right to withdraw it at any time, without affecting the legality of processing based on consent given prior to withdrawal;

» The right to file a complaint with the CNPD or another supervisory authority;

» Whether the provision of personal data is a legal or contractual obligation, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide personal data and the possible consequences of not providing such data;

» If applicable, the existence of automated decisions, including profiling, and information related to the logic involved, as well as the significance and consequences of such processing for the data subject.

If the User’s Data is not collected directly by Grupo JAP from the User, in addition to the above information, the User will also be informed about the categories of personal data being processed, as well as the origin of the data and, if applicable, whether they are from publicly accessible sources.

If Grupo JAP intends to further process the User’s Data for a purpose other than that for which the data was collected, Grupo JAP will provide the User with information about that purpose and any other relevant information, as outlined above, before proceeding with the processing.

7.2. Procedures and measures implemented to comply with the right to information.

The information referred to in 7.1. is provided in writing (including by electronic means) by Grupo JAP to the User prior to the processing of the personal data in question. Under applicable law, Grupo JAP is not obligated to provide the User with the information mentioned in 7.1 when and to the extent that the User is already aware of it.

The information is provided by Grupo JAP at no cost to the User.

8. RIGHT OF ACCESS TO PERSONAL DATA

Grupo JAP ensures the means for the User to consult their Personal Data. The User has the right to obtain confirmation from Grupo JAP as to whether or not their personal data is being processed and, if so, the right to access their personal data and the following information:

» The purposes of data processing;

» The categories of personal data in question;

» The recipients or categories of recipients to whom the personal data has been or will be disclosed, including recipients in third countries or international organizations;

» The retention period for the personal data;

» The right to request Grupo JAP to correct, delete, or restrict the processing of personal data, or the right to object to such processing;

» The right to file a complaint with the CNPD or another supervisory authority;

» If the data was not collected from the User, information regarding the origin of the data;

» The existence of automated decisions, including profiling, and information related to the underlying logic, as well as the significance and expected consequences of such processing for the data subject;

» The right to be informed about the appropriate safeguards associated with the transfer of data to third countries or international organizations.

Upon request, Grupo JAP will provide the User with a free copy of the User’s Data that is being processed. Providing additional copies requested by the User may incur administrative costs.

9. RIGHT TO RECTIFY PERSONAL DATA

The User has the right to request, at any time, the rectification of their Personal Data and, also, the right to have their incomplete personal data completed, including through an additional statement.

In the event of data rectification,Grupo JAP will communicate the rectification to each recipient to whom the data has been disclosed, unless such communication is deemed impossible or would involve disproportionate effort for Grupo JAP.

10. RIGHT TO ERASURE OF PERSONAL DATA (“RIGHT TO BE FORGOTTEN”)

The User has the right to obtain the erasure of their data by Grupo JAP when one of the following grounds applies:

» The User's Data is no longer necessary for the purpose for which it was collected or processed;

» The User withdraws the consent on which the data processing is based and there is no other legal basis for the processing;

» The User objects to the processing under the right to object, and there are no overriding legitimate interests justifying the processing;

» If the User's Data is being processed unlawfully;

» If the User's Data must be erased to comply with a legal obligation to which Grupo JAP is subject;

» Under applicable legal terms, Grupo JAP is not obliged to erase the User's Data to the extent that the processing is necessary for compliance with a legal obligation to which Grupo JAP is subject or for the declaration, exercise, or defense of a legal claim by Grupo JAP in a judicial process.

In the event of erasure of the data, Grupo JAP will inform each recipient/entity to whom the data has been disclosed of the erasure, unless such communication is impossible or would involve disproportionate effort for Grupo JAP.

When Grupo JAP has made the User’s Data publicly available and is required to erase it under the right to erasure, Grupo JAP commits to taking reasonable measures, including technical measures, considering the available technology and the cost of implementation, to inform the data controllers about the User's request to delete links to those personal data, as well as copies or reproductions of them.

11. RIGHT TO RESTRICT THE PROCESSING OF PERSONAL DATA

The User has the right to obtain, from Grupo JAP, the restriction of processing of their Personal Data if one of the following situations applies (restriction consists of marking the personal data stored to limit its processing in the future):

» If the accuracy of the personal data is contested, for a period that allows Grupo JAPto verify its accuracy;

» If the processing is unlawful and the User opposes the erasure of the data, requesting instead the restriction of its use;

» If Grupo JAP no longer needs the User's Data for processing purposes, but such data is required by the User for the declaration, exercise, or defense of a right in a legal process;

» If the User has objected to the processing, until it is verified whether the legitimate reasons of Grupo JAP override those of the User.

When the User’s Data is subject to restriction, it may only, except for storage, be processed with the User's consent or for the purpose of declaring, exercising, or defending a right in a judicial process, protecting the rights of another individual or legal entity, or for public interest reasons legally provided.

The User who has obtained the restriction of processing of their data under the above circumstances will be informed by Grupo JAP before the restriction is lifted.

In case of restriction of processing, Grupo JAP will communicate the restriction to each recipient to whom the data has been disclosed, unless such communication is impossible or would involve disproportionate effort for Grupo JAP.

12. RIGHT TO DATA PORTABILITY

The User has the right to receive their personal data, which concerns them and has been provided to Grupo JAP, in a structured, commonly used, and machine-readable format, and the right to transmit such data to another data controller, if:

» The processing is based on consent or a contract to which the User is a party; and

» The processing is carried out by automated means.

The right to portability does not include inferred or derived data, i.e., personal data generated by Grupo JAP as a consequence or result of the analysis of the data subject to processing.

The User has the right to have their personal data transmitted directly between data controllers, whenever technically feasible.

13. RIGHT TO OBJECT TO PROCESSING

The User has the right to object at any time, for reasons related to their particular situation, to the processing of personal data concerning them, when the processing is based on the legitimate interests pursued by Grupo JAP, or when the processing is carried out for purposes other than those for which the personal data was collected, including profiling, or when the personal data is processed for statistical purposes.

Grupo JAP will cease processing the User's Data unless it presents urgent and legitimate reasons for such processing that override the interests, rights, and freedoms of the User, or for the declaration, exercise, or defense of a legal claim by Grupo JAP in a judicial process.

When the User's Data is processed for direct marketing purposes, the User has the right to object at any time to the processing of their data for such marketing purposes, which includes profiling insofar as it is related to direct marketing. If the User objects to the processing of their data for direct marketing purposes, Grupo JAP will cease processing the data for that purpose.

The User also has the right not to be subject to any decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision:

» Is necessary for the conclusion or performance of a contract between the User and Grupo JAP;

» Is authorized by legislation to which Grupo JAP is subject; or

» Is based on the explicit consent of the User.

14. PROCEDURES FOR EXERCISING THE USER'S RIGHTS

The right of access, right of rectification, right of erasure, right to restriction, right to portability, and right to object can be exercised by the User by contacting the Data Protection Officer of Grupo JAP or by email at dpo@grupojap.pt.

Grupo JAP will respond in writing (including electronically) to the User's request within a maximum of one month from the receipt of the request, except in cases of special complexity, in which the period may be extended up to two months.

If the requests made by the User are manifestly unfounded or excessive, particularly due to their repetitive nature, Grupo JAP reserves the right to charge administrative fees or refuse to follow up on the request.

15. PERSONAL DATA BREACHES

In the event of a data breach, and to the extent that such breach is likely to result in a high risk to the rights and freedoms of the User, Grupo JAP is committed to notifying the affected User of the personal data breach within 72 hours from the moment it becomes aware of the incident.

Under the applicable law, notification to the User is not required in the following cases:

» If Grupo JAP has implemented adequate protection measures, both technical and organizational, and these measures have been applied to the personal data affected by the data breach, particularly measures that make the personal data unintelligible to any unauthorized person accessing the data, such as encryption;

» If Grupo JAP has taken subsequent measures that ensure the high risk to the rights and freedoms of the User is no longer likely to occur; or

» If notifying the User would involve disproportionate effort for Grupo JAP.

In such cases, the Grupo JAP will make a public announcement or take a similar action through which the User will be informed.

16. FINAL SECTION

16.1. CHANGES TO THE PRIVACY POLICY

Grupo JAP reserves the right to modify this Privacy Policy at any time. In the event of a modification to the Privacy Policy, the date of the last update, available at the end of this page, will also be updated. If the change is substantial, a notice will be posted on the Website.

17. APPLICABLE LAW AND JURISDICTION

This Privacy Policy, as well as the collection, processing, or transmission of the User's Data, is governed by Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, and by the applicable legislation and regulations in Portugal, namely Law 58/2019.

Any disputes arising from the validity, interpretation, or enforcement of this Privacy Policy, or related to the collection, processing, or transmission of the User's Data, must be exclusively submitted to the jurisdiction of the courts of the Porto Este district, without prejudice to the applicable mandatory legal provisions.

Grupo JAP