1. GENERAL PART

 

1.1. COLLECTION AND PROCESSING OF USER DATA

As part of the provision of the website hosted at (https://www.iberfar.pt) (from now on referred to as the “Site”), and the supply of information, content, and login areas (collectively, the “Services”), the company IBERFAR, Indústria Farmacêutica, S.A. (from now on “IBERFAR”), headquartered at Rua Consiglieri Pedroso 123, Barcarena, Portugal, is the entity responsible for collecting and processing your personal data, which allow you to be identified and contacted (“Personal Data”), for the purposes mentioned in this privacy policy.

 

Personal Data is typically requested when the User registers on the Site or requests contact.

 

The Personal Data collected and processed includes information related to name, email, phone number, and company.

 

Upon collection of the Personal Data, IBERFAR provides the User with detailed information about the nature of the data collected, the purpose, and the processing that will be performed concerning the Personal Data, as well as the information mentioned in clause 7.

 

Usability Information and Personal Data are referred to in this Privacy Policy as “User Data.”

 

1.2. SUBCONTRACTED ENTITIES

 

As part of the processing of User Data, IBERFAR may rely on subcontracted third parties, to process User Data on behalf of and according to instructions provided by IBERFAR, in strict compliance with the law and this Privacy Policy.

 

These subcontracted entities are not permitted to transfer User Data to other entities without prior written consent from IBERFAR, nor are they allowed to subcontract other entities without prior authorization.

 

IBERFAR undertakes to subcontract only entities that provide sufficient guarantees for the implementation of appropriate technical and organizational measures to ensure the protection of User rights. All subcontracted entities are bound to IBERFAR through a written contract regulating the scope and duration of the processing, the nature and purpose of the processing, the type of Personal Data, the categories of data subjects, and the rights and obligations of the parties.

 

Upon collection of Personal Data, IBERFAR informs the User about the categories of subcontracted entities that may process data on behalf of IBERFAR.

 

1.3. CHANNELS OF DATA COLLECTION

 

IBERFAR may collect data directly (i.e., directly from the User) or indirectly (i.e., through partners or third parties). The collection can occur through the following channels:

– Direct collection: in person, by phone, by email, and through the Site;

– Indirect collection: through partners or group companies and official entities.

 

2. GENERAL PRINCIPLES APPLICABLE TO USER DATA PROCESSING

 

In terms of general principles related to the processing of Personal Data, IBERFAR undertakes to ensure that User Data is:

 

– Processed lawfully, fairly, and transparently concerning the User;

– Collected for specified, explicit, and legitimate purposes, not processed in a manner incompatible with those purposes;

– Adequate, relevant, and limited to what is necessary about the purposes for which it is processed;

– Accurate and updated when necessary, with all appropriate measures taken to ensure that inaccurate data is erased or rectified without delay;

– Stored in a manner that permits the identification of the User only for as long as necessary for the purposes for which the data is processed;

– Processed in a way that ensures its security, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, with appropriate technical or organizational measures in place.

 

IBERFAR’s data processing is lawful if at least one of the following conditions is met:

 

– The User has given explicit consent for processing User Data for one or more specific purposes;

– The processing is necessary for the performance of a contract to which the User is a party, or for pre-contractual steps taken at the User’s request;

– The processing is necessary for compliance with a legal obligation to which IBERFAR is subject;

– The processing is necessary to protect the vital interests of the User or another individual;

– The processing is necessary for legitimate interests pursued by IBERFAR or by third parties, except where such interests are overridden by the interests or fundamental rights and freedoms of the User that require protection of Personal Data.

 

IBERFAR undertakes to ensure that User Data is processed only under the conditions listed above and in compliance with the aforementioned principles.

 

When User Data processing is based on the User’s consent, the User has the right to withdraw consent at any time. However, the withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

 

The duration of data storage varies depending on the purpose for which the information is processed. There are legal requirements that mandate data to be stored for a minimum period. Therefore, when there is no specific legal requirement, data will be stored only for the minimum period necessary for the purposes that justified its collection or further processing, after which it will be deleted.

 

3. USE AND PURPOSES OF USER DATA PROCESSING

 

Generally, IBERFAR uses User Data for the following purposes:

 

– User registration on the Site;

– Allowing access to restricted areas of the Site under pre-established terms;

– Contacting the User at their request;

– In certain restricted areas of the Site, IBERFAR may combine Personal Data with Usability Information to provide more personalized content to the User.

 

User Data collected by IBERFAR is not shared with third parties without the User’s consent, except in the following situations. However, if the User contracts services with IBERFAR provided by other entities responsible for processing Personal Data, User Data may be accessed by those entities to the extent necessary for the provision of those services.

 

By applicable law, IBERFAR may transmit or disclose User Data to other entities if such transmission or disclosure is necessary for the performance of a contract established between the User and IBERFAR, for pre-contractual steps at the User’s request, for compliance with a legal obligation to which IBERFAR is subject, or for the pursuit of legitimate interests of IBERFAR or third parties. In such cases, reasonable efforts will be made to ensure that the recipient uses User Data in a manner consistent with this Privacy Policy.

 

4. TECHNICAL, ORGANIZATIONAL, AND SECURITY MEASURES IMPLEMENTED

 

To ensure the security of User Data and maximum confidentiality, IBERFAR processes the information you provide in strict confidence, by its internal security and confidentiality policies and procedures, which are periodically updated as needed, and in compliance with legally established terms and conditions.

 

Given the nature, scope, context, and purposes of the data processing, as well as the risks arising from processing for User rights and freedoms, IBERFAR undertakes to apply, both at the time of determining the processing means and during the processing itself, the necessary and appropriate technical and organizational measures to protect User Data and comply with legal requirements.

 

Furthermore, it commits to ensuring that, by default, only the data necessary for each specific processing purpose is processed and that this data is not made available to an indeterminate number of people without human intervention.

 

In general terms, IBERFAR adopts the following measures:

– Regular audits to assess the effectiveness of the technical and organizational measures implemented;

– Awareness and training of personnel involved in data processing operations;

– Pseudonymization and encryption of Personal Data;

– Mechanisms to ensure the confidentiality, availability, and resilience of information systems;

– Mechanisms that ensure timely restoration of information systems and access to Personal Data in the event of a physical or technical incident.

 

5. TRANSFER OF DATA OUTSIDE THE EUROPEAN UNION

 

Personal Data collected and processed by IBERFAR is not made available to third parties established outside the European Union. If such a transfer happens in the future for the reasons mentioned above, IBERFAR undertakes to ensure that the transfer complies with applicable legal provisions, particularly concerning the adequacy of the recipient country’s data protection laws and the applicable requirements for such transfers.

 

6. USE OF COOKIES

 

By browsing the Site, you are consenting to the creation and storage of a text file (Cookie) on your computer. This file will allow you quicker and easier access to the Site, as well as personalization based on your preferences. Most browsers accept these files (Cookies), but you may delete or block them automatically. In your browser’s “Help” menu, you can find instructions on how to adjust these settings. However, if you block cookies, some features of the Site may not be available.

 

 

2. USERS’ RIGHTS (DATA SUBJECTS)

 

7. RIGHT TO INFORMATION

7.1. Information Provided to the User by IBERFAR (when data is collected directly from the User):

The identity and contact details of IBERFAR, the data controller, and, if applicable, of its representative;  

The contact details of the Data Protection Officer;  

The purposes of the processing for which the Personal Data is intended, as well as, if applicable, the legal basis for the processing;  

If the processing of data is based on legitimate interests of IBERFAR or a third party, an indication of such interests;  

If applicable, the recipients or categories of recipients of the Personal Data;  

If applicable, an indication of whether Personal Data will be transferred to a third country or an international organization, and whether there is or is not an adequacy decision adopted by the Commission or a reference to appropriate or adequate transfer safeguards;  

Retention period of the Personal Data;  

The right to request from IBERFAR access to Personal Data, as well as its rectification, deletion, or limitation, the right to object to processing, and the right to data portability;  

If the processing of data is based on the User’s consent, the right to withdraw consent at any time, without affecting the lawfulness of the processing based on consent prior to withdrawal;  

The right to lodge a complaint with the CNPD or another supervisory authority;  

Indication of whether the communication of Personal Data is a legal or contractual obligation, or a necessary requirement for entering into a contract, as well as whether the data subject is obliged to provide Personal Data and the possible consequences of not providing such data; 

If applicable, the existence of automated decision-making, including profiling, and information regarding the underlying logic, as well as the significance and expected consequences of such processing for the data subject.  

In the case that the User’s Data is not collected directly by IBERFAR from the User, in addition to the information mentioned above, the User is additionally informed about the categories of Personal Data being processed and, if applicable, about the source of the data, and whether it comes from publicly accessible sources.  

If IBERFAR intends to further process the User’s Data for a purpose other than that for which the data was collected, IBERFAR will provide the User with information about that purpose and any other pertinent information as mentioned above before that processing.  

 

7.2. Procedures and Measures Implemented to Comply with the Right to Information. 

The information referred to in 7.1. is provided in writing (including electronically) by IBERFAR to the User prior to the processing of the relevant Personal Data. Under applicable law, IBERFAR is not obliged to provide the User with the information mentioned in 7.1 when and to the extent that the User is already aware of them.  

The information is provided by IBERFAR free of charge.

 

8. RIGHT OF ACCESS TO PERSONAL DATA

IBERFAR ensures means for the User to access their Personal Data.  

The User has the right to obtain confirmation from IBERFAR as to whether Personal Data concerning them is being processed or not, and if so, the right to access their Personal Data and the following information: 

The purposes of the data processing;  

The categories of Personal Data in question; 

The recipients or categories of recipients to whom the Personal Data has been or will be disclosed, including recipients located in third countries or belonging to international organizations;  

The retention period of the Personal Data;  

The right to request from IBERFAR rectification, deletion, or limitation of the processing of Personal Data, or the right to object to such processing;  

The right to lodge a complaint with the CNPD or another supervisory authority;  

If the data has not been collected from the User, the information available about the source of that data;  

The existence of automated decision-making, including profiling, and information regarding the underlying logic, as well as the significance and expected consequences of such processing for the data subject;  

The right to be informed about the appropriate safeguards associated with the transfer of data to third countries or international organizations.  

Upon request, IBERFAR will provide the User, free of charge, with a copy of the User’s Data undergoing processing. The provision of additional copies requested by the User may incur administrative costs.

 

9. RIGHT TO RECTIFICATION OF PERSONAL DATA 

The User has the right to request at any time the rectification of their Personal Data and also the right to have incomplete Personal Data completed, including by means of an additional statement.  

In the event of rectification of the data, IBERFAR will communicate the rectification to each recipient to whom the data has been transmitted, unless such communication proves impossible or involves a disproportionate effort for IBERFAR.

 

10. RIGHT TO ERASURE OF PERSONAL DATA (“RIGHT TO BE FORGOTTEN”) 

The User has the right to obtain from IBERFAR the erasure of their data when one of the following grounds applies:  

The User’s Data is no longer necessary for the purpose for which it was collected or processed;  

The User withdraws consent on which the processing is based and there is no other legal basis for the processing;  

The User objects to the processing under the right to object and there are no overriding legitimate interests justifying the processing; 

The User’s Data has been unlawfully processed;  

The User’s Data must be erased to comply with a legal obligation to which IBERFAR is subject;  

Under applicable legal terms, IBERFAR is not obliged to erase the User’s Data to the extent that the processing proves necessary for compliance with a legal obligation to which IBERFAR is subject or for the declaration, exercise, or defense of a right of IBERFAR in legal proceedings.  

In the event of erasure of the data, IBERFAR will communicate the erasure to each recipient/entity to whom the data has been transmitted, unless such communication proves impossible or involves a disproportionate effort for IBERFAR.  

When IBERFAR has made the User’s Data public and is required to erase it under the right to erasure, IBERFAR commits to ensure reasonable measures, including technical measures, considering the available technology and the costs of its application, to inform those responsible for the actual processing of the Personal Data that the User has requested the erasure of links to those Personal Data, as well as copies or reproductions thereof.

 

11. RIGHT TO LIMITATION OF PROCESSING OF PERSONAL DATA 

The User has the right to obtain from IBERFAR the limitation of the processing of their Data if one of the following situations applies (limitation consists of marking the stored Personal Data with the aim of limiting its future processing):  

If they contest the accuracy of the Personal Data, for a period enabling IBERFAR to verify its accuracy;  

If the processing is unlawful and the User opposes the erasure of the data, requesting instead the limitation of its use;  

If IBERFAR no longer needs the User’s Data for processing purposes, but such data is required by the User for the declaration, exercise, or defense of a right in legal proceedings;  

If the User has objected to the processing, until it is verified that the legitimate grounds of IBERFAR prevail over those of the User.  

When the User’s Data is subject to limitation, it may only be processed, except for storage, with the User’s consent or for the declaration, exercise, or defense of a right in legal proceedings, for the protection of the rights of another natural or legal person, or for reasons of public interest as legally provided.  

The User who has obtained the limitation of the processing of their data in the cases mentioned above will be informed by IBERFAR before the limitation is lifted.  

In the event of limitation of the processing of the data, IBERFAR will communicate the limitation to each recipient to whom the data has been transmitted, unless such communication proves impossible or involves a disproportionate effort for IBERFAR.

 

12. RIGHT TO DATA PORTABILITY

The User has the right to receive the Personal Data concerning them that they have provided to IBERFAR in a structured, commonly used, and machine-readable format, and the right to transmit such data to another data controller, if:  

The processing is based on consent or a contract to which the User is a party; and  

The processing is carried out by automated means. 

The right to portability does not include inferred data or derived data, i.e., Personal Data generated by IBERFAR as a result of the analysis of the data subject to processing.  

The User has the right to have the Personal Data transmitted directly between data controllers whenever technically feasible.

 

13. RIGHT TO OBJECT TO PROCESSING

The User has the right to object at any time, on grounds relating to their particular situation, to the processing of Personal Data concerning them that is based on the exercise of legitimate interests pursued by IBERFAR or when the processing is carried out for purposes other than those for which the Personal Data was collected, including profiling, or when the Personal Data is processed for statistical purposes.  

IBERFAR will cease the processing of the User’s Data unless it presents compelling legitimate grounds for such processing which override the interests, rights, and freedoms of the User, or for the declaration, exercise, or defense of a right of IBERFAR in legal proceedings.  

When the User’s Data is processed for direct marketing purposes, the User has the right to object at any time to the processing of their data for such marketing purposes, which includes profiling insofar as it is related to direct marketing. If the User objects to the processing of their data for direct marketing purposes, IBERFAR will cease processing the data for that purpose.  

The User also has the right not to be subject to any decision based solely on automated processing, including profiling, which produces legal effects concerning them or significantly affects them in a similar way, unless the decision:  

Is necessary for entering into or performing a contract between the User and IBERFAR;  

Is authorized by legislation to which IBERFAR is subject; or  

Is based on the explicit consent of the User.

 

14. PROCEDURES FOR EXERCISING RIGHTS BY THE USER 

The rights of access, rectification, erasure, limitation, portability, and objection may be exercised by the User by contacting the Data Protection Department of IBERFAR via email at dadospessoais@iberfar.pt and/or by registered letter sent to Rua Consiglieri Pedroso 123, 2730-056 Barcarena.  

IBERFAR will respond in writing (including electronically) to the User’s request within a maximum of one month from the receipt of the request, unless in cases of special complexity, in which case this period may be extended by up to two months.  

If the requests made by the User are manifestly unfounded or excessive, notably due to their repetitive nature, IBERFAR reserves the right to charge administrative costs or refuse to follow up on the request.

 

15. PERSONAL DATA BREACHES

In the event of a data breach and to the extent that such breach is likely to result in a high risk to the rights and freedoms of the User, IBERFAR undertakes to communicate the breach of Personal Data to the affected User within 72 hours of becoming aware of the incident.  

Under legal terms, notification to the User is not required in the following cases:  

If IBERFAR has implemented appropriate protective measures, both technical and organizational, and these measures have been applied to the Personal Data affected by the data breach, especially measures that render the Personal Data unintelligible to any unauthorized person, such as encryption;  

If IBERFAR has taken subsequent measures that ensure that the high risk to the rights and freedoms of the User is no longer likely to materialize; or  

If notification to the User would involve a disproportionate effort for IBERFAR. In this case, IBERFAR will make a public communication or take a similar measure through which the User will be informed.

16. LEI APLICÁVEL E JURISDIÇÃO 

Esta Política é regida pelo Regulamento (UE) 2016/679 e pela legislação portuguesa. Eventuais litígios serão submetidos aos tribunais da comarca de Oeiras.  

Quaisquer litígios decorrentes da validade, interpretação ou execução da Política de Privacidade, ou relacionados com a recolha, tratamento ou transmissão de Dados do Utilizador, serão submetidos exclusivamente à jurisdição dos tribunais do distrito de Oeiras, sem prejuízo das normas legais obrigatórias aplicáveis.