This data protection policy applies to users of ANACOM’s website - https://www.anacom.pt/.
Through its website, ANACOM may collect personal data from users, by means of the completion of forms available on the website, for various purposes, as set out below.
This data protection policy aims to provide users with information on how their personal information is collected and used by ANACOM, in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016https://www.anacom.pt/render.jsp?contentId=1436006 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation - GDPR) and Law No 58/2019, of 8 Augusthttps://www.anacom.pt/render.jsp?contentId=1478101.
Controller
Where information of a personal nature is collected and processed, the collected data is processed by ANACOM, with registered office at Rua Ramalho Ortigão, 51, 1099-099 Lisbon, Legal Person ID No 502017368, telephone No 217211000 and email address epd@anacom.pt, as the controller.
Personal data we may collect and use through the website
The collected personal data is processed by ANACOM in compliance with data protection requirements set out in GDPR and Law No 58/2019 of 8 August. The personal data collected and purposes for which they are processed vary according to the services requested or subscriptions made by the user through the website:
- newsletter subscription: name and email address;
- event registration: name, body, position, address, country, email address, telephone;
- public and reserved electronic services: user name, e-mail address, civil ID number, tax ID number, bank ID number, telephone and address.
Personal data collected and processed by ANACOM is obtained directly from the data subject.
Purposes and legitimacy for processing
Personal data is solely used for the provision of services requested and to meet the needs of users of the website. ANACOM collects and processes users’ personal data for one or more of the following reasons:
1. because it is required to do so to comply with legal obligations;
2. because the processing of personal data is necessary for the performance of a contract;
3. because personal data is found to be of particular relevance to ANACOM and there is a legitimate interest in its processing, under the law;
4. because the consent of data subjects was obtained (in which case consent may be withdrawn at any time).
|
Purpose |
Legal basis for legitimacy |
|
Newsletter subscription: ANACOM collects and processes your personal data in order to send you “ANACOM News” (informative content about news related to the electronic communications sector) to the email address you provided us when you subscribed to the newsletter. |
The processing of personal data for this purpose occurs when the data subject has given his or her consent by expressly subscribing to the newsletter on the website. You may refuse to receive the newsletter at any time, by clicking on the field “refuse to receive new newsletters”, available in each communication sent to you, or by sending the request to the address epd@anacom.pt. The revocation of your consent does not affect the processing carried out until then with your consent, but prevents us from further processing your personal data for this purpose. |
|
Registration in events: ANACOM collects and processes your personal data as this is required for managing the event and your participation in it, as well as for contacts regarding your participation (e.g. management of available places). |
The processing of personal data for this purpose takes place when the data subject has given his/her consent by means of an express subscription in the event registration form. You may revoke your consent at any time by sending a communication to the address epd@anacom.pt. The revocation of your consent does not affect the processing carried out until then with your consent, but prevents us from further processing your personal data for this purpose, which may make it impossible for you to take part in the event concerned. |
|
Public and reserved electronic services |
Processing is carried out for the purpose of compliance with a legal obligation in accordance with the powers and duties assigned to ANACOM, as well as, where applicable, to exercise the public authority vested in ANACOM. The processing of personal data for this purpose occurs when the data subject has given his/her consent by expressly registering/applying for/subscribing this body’s public and reserved services. You may revoke your consent at any time by sending a communication to the address epd@anacom.pt. The revocation of your consent does not affect the processing carried out until then with your consent, but prevents us from further processing your personal data for this purpose, which may make it impossible for you to fully register/apply for /subscribe these services. |
Disclosure of personal data
As part of its activity, ANACOM may rely on third parties (service providers), for example, IT service provision companies, companies which own videoconferencing platforms used for webinars, which may have access to personal data required for registration at these events on behalf of ANACOM.
These service providers are subject to a contract which requires them to implement and maintain appropriate information security measures in respect of all personal data which they process on behalf of and in accordance with guidelines issued by ANACOM.
In the case of newsletter subscriptions, personal data is shared with the Rocket Science Group, based in the United States of America, as a processor, so that this body is able to send the newsletter on behalf of ANACOM.
ANACOM may share some of your personal data with third parties where this is required by law.
Transfer of personal data
Where ANACOM needs to transfer personal data, such transfer shall be made in compliance with the obligations arising from applicable legislation on personal data.
Specifically, ANACOM ensures that the transfer is carried out, in most cases, based on standard contractual clauses https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32010D0087 approved by the European Commission. Otherwise, ANACOM ensures that appropriate data protection measures are implemented.
Security
ANACOM takes the appropriate measures to protect personal data in accordance with applicable data protection legislation, in particular:
1. the communication of the personal information you provide to us is carried out through a secure connection via a Transport Layer Security (TLS) communication with the user’s browser;
2. user account information is password protected to ensure your security and privacy;
3. all ANACOM employees involved in data processing are bound by the duty of secrecy and confidentiality as regards such data.
Storage
ANACOM stores personal data for such a period as is required for the purposes described in this data protection policy, unless a longer storage period is required or permitted by law.
The criteria used to determine the storage period include:
1. the withdrawal of consent by data subjects (where appropriate);
2. whether storage is compulsory in order to comply with a legal obligation which falls upon ANACOM;
3. as recommended taking into account ANACOM’s legal standing (e.g. where prescription periods, limitation periods, ongoing administrative/judicial proceedings, investigations/inspections by regulatory bodies are concerned).
Rights related to personal data
1. Right of access to and correction of your personal data
ANACOM ensures the correction of all personal data. The data subject has the right, but also the responsibility, to ensure that changes to his/her personal data are reported to ANACOM so that ANACOM may permanently ensure that data is up-to-date.
The data subject may also access his/her personal data and obtain the following information:
1. Purposes for which the personal data are processed;
2. Type of personal data that are processed;
3. Bodies to whom the personal data may be communicated, including bodies located in countries outside the European Union or international organisations, in which case information is provided to the data subject on the guarantees applied to the transfer of data and on the means by which to obtain a copy of them or where they have been made available;
4. Period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;
5. Rights of the data subject with regard to the processing of his/her personal data;
6. Where personal data have not been collected from the data subject, information on their origin and the type of data concerned;
7. Existence of automated decision-making, including profiling, and, in this case, information about the logic involved, as well as the significance and consequences of such processing for the data subject.
Data subjects must keep their personal data up-to-date and inform ANACOM of any significant changes thereto, by means of a written request to epd@anacom.pt.
ANACOM reserves the right to suspend or cancel a user’s account should it find that the information provided is false, incorrect, out-of-date or incomplete. Suspension or cancellation of a given account will only occur after the user has been notified. ANACOM will grant the user a period of thirty days to correct or update the information.
2. Right to erasure
The data subject has the right to obtain the erasure of personal data concerning him or her without undue delay, where one of the following grounds applies:
1. Personal data are no longer necessary in relation to the purposes for which they were collected or processed;
2. The data subject withdraws consent on which the processing is based, where there is no other legal ground for the processing;
3. Personal data have been unlawfully processed;
4. Personal data need to be erased for compliance with a legal obligation to which the controller is subject;
3. Portability of personal data.
Where ANACOM invokes, as a legal basis for the processing, the consent of the data subject or the fact that the processing is required to fulfil a contract, and where the processing of personal data is carried out by automated means, the data subject has the right to receive the personal data provided to ANACOM in a structured, commonly used and machine-readable format, as well as to require ANACOM to transmit them to another controller where this is feasible from a technical point of view.
4. Right to restriction of processing
The data subject has the right to obtain from ANACOM restriction of processing where:
- The accuracy of personal data is contested, until ANACOM has adopted adequate measures to correct them or to check their accuracy;
- The processing is unlawful, but the data subject refuses to have ANACOM erase the data;
- ANACOM no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
- The data subject has objected to processing for reasons of legitimate interest (see below) pending the verification whether ANACOM has compelling legitimate grounds to continue processing.
Where personal data is subject to these restrictions, ANACOM shall only process such personal data with the data subject’s consent or for the establishment, exercise or defence of legal claims.
5. Right to object
The data subject has the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her, where:
- The processing of the data is not based on ANACOM’s legitimate interest;
- Data are processed for purposes other than, but compatible with, those for which they were collected;
- Data are processed for direct marketing purposes, including profiling.
In such cases, ANACOM will stop processing personal data, except where it has legitimate reasons for doing so and these override the interests of the respective data subjects.
6. Right not to be subject to individual decisions based solely on automated processing
ANACOM shall not take decisions that affect the data subject based solely on automated processing.
7. Right to withdraw consent
In cases where ANACOM invokes consent as the legal basis for processing, the data subject has the right to withdraw consent at any time.
The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. In the event that consent is withdrawn, the personal data will no longer be processed, unless there are other grounds, such as a contract, legal and regulatory obligations or ANACOM’s legitimate interest, which justify such processing.
8. Right to lodge complaints
The data subject also has the right to lodge a complaint with Comissão Nacional de Proteção de Dados (the National Data Protection Commission - www.cnpd.pt) where he or she considers that the processing of his or her personal data is in breach of applicable law.
Contacts and exercise of rights
The data subject may contact ANACOM for any privacy-related issue or to exercise his/her rights, by sending an email to the email address epd@anacom.pt.
The exercise by the data subject of rights listed above shall be free of charge, unless the request is clearly unjustified or excessive, in which case a reasonable fee may be charged in view of the associated costs.
Amendments to this data protection policy
ANACOM may amend or update this data protection policy at any time, informing data subjects of these amendments or updates by publishing the updated data protection policy on its website.
