GF CORK COMMITMENT

Protecting privacy and personal data is a fundamental commitment of GF Cork towards its customers (“Customers”) of its products and services.
GF Cork recommends reading this Privacy Policy and any updates thereto.

DATA CONTROLLER AND DATA PROTECTION OFFICER

The entity responsible for collecting and processing your personal data is GF Cork, which provides the service or product to you and, in this context, determines which data are collected, the processing methods, and the purposes for which the data are used.

PERSONAL DATA, DATA SUBJECTS, AND CATEGORIES OF PERSONAL DATA

What is personal data?
Personal data means any information, of any nature and in any form, relating to an identified or identifiable natural person. A person is considered identifiable if they can be directly or indirectly identified, for example through a name, identification number, location data, electronic identifier, or other elements that allow identification of that individual.

Who are the data subjects?
The data subject is the individual to whom the personal data relate and who has used GF Cork’s services or products.
For example, a GF Cork Customer is someone who has entered into a contract for the supply of a good or the provision of a service. A potential Customer is someone targeted by GF Cork advertising campaigns or promotional offers, as well as anyone requesting information about GF Cork products and services.
GF Cork ensures that personal data are equally protected and respects Customers’ rights.

Which categories of personal data do we process?

• Identification Data
• Contact Information
  Examples: Name; e-mail; company name; country.

LEGAL BASIS, PURPOSES, AND DURATION OF PERSONAL DATA PROCESSING

On what legal basis can GF Cork process your personal data?

• Consent: When you have given your express consent – in writing, orally, or by validating an option – which is prior, free, informed, specific, and unambiguous.
  For example, consent is required to send newsletters offering products and services.

For what purposes and how long does GF Cork process your personal data?
Your personal data are processed by GF Cork only for the time necessary to achieve the defined purpose or, where applicable, until you exercise your right to object, right to be forgotten, or withdraw consent.
After the retention period expires, GF Cork will delete or anonymize the data whenever they are no longer required for a different legitimate purpose.

Purposes:

• Media Center: Example: Provision of documents upon user request.

When there is a legal or contractual obligation to fulfill, failure to provide personal data may result in non-compliance with that obligation.

Retention periods of personal data:
GF Cork processes and retains personal data according to the purposes for which they are collected. In some cases, the law requires processing and retention for a minimum period, e.g., 10 years for tax or accounting purposes, 7 years for anti-money laundering and counter-terrorism purposes.

Where no specific legal obligation exists, data are processed only for the period necessary to achieve the purposes for which they were collected, in compliance with law and CNPD guidelines.

• GF Cork will process and retain your personal data for the duration of any contractual relationship.
• Regarding video surveillance of its facilities, GF Cork will retain footage and associated personal data for a maximum of 30 days.
• GF Cork may retain other personal data beyond the contractual relationship duration, based on consent, to safeguard contractual rights, or for legitimate interests, always strictly for the necessary period and in accordance with CNPD guidance.

FORM AND TIMING OF PERSONAL DATA COLLECTION

When and how do we collect your personal data?
We collect personal data with your consent or within the scope of commercial relationships established with GF Cork.
Collection may be oral, written, or via GF Cork’s website.

Personal data collected are processed electronically and stored in databases, in strict compliance with applicable data protection legislation and information security standards.

We only process personal data for specific and legitimate purposes determined at the time of collection. Data will not be processed in a manner incompatible with those purposes, except for public interest archiving, scientific or historical research, or statistical purposes, in which cases, under GDPR, no incompatibility occurs.

RIGHTS OF THE DATA SUBJECT

What are your rights?

• Right of Access: Obtain confirmation of which personal data are processed and information about them, e.g., purposes, retention periods, copies of invoices, contracts, or recorded calls.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Erasure / Right to Be Forgotten: Request deletion of personal data unless there are legitimate grounds for retention (legal obligation, ongoing judicial process).
• Right to Data Portability: Receive your data in a digital, machine-readable format, or request direct transmission to another controller, if technically feasible.
• Right to Withdraw Consent / Right to Object: Withdraw consent or object to data processing, e.g., marketing, unless legitimate interests override your rights.
• Right to Restriction of Processing: Request limitation, e.g., suspension or restriction to specific categories or purposes.
• Profiling and Automated Decisions: GF Cork may profile stakeholders based on preferences or interests to provide services, improve quality, or tailor marketing, provided processing is necessary for contract performance or based on consent.
  If automated processing significantly affects your legal rights or interests, you have the right not to be subject to such decisions, to request human intervention, to express your opinion, or to contest the decision.
• Right to Lodge a Complaint: You can submit a complaint to the supervisory authority (CNPD) in addition to GF Cork or the DPO.

How to exercise your rights:
Exercising your rights is free, except for manifestly unfounded or excessive requests, in which case a reasonable fee may apply.
Requests should be submitted in writing or, if requested, orally (identity verification required).
Responses are provided within 30 days unless the request is complex.
Contact: geral@granoflexcork.pt

TRANSFER OF PERSONAL DATA

Under what circumstances are personal data disclosed to third parties or subcontractors?
Data may be transmitted to subcontractors for processing on behalf of GF Cork, under contractual obligations ensuring compliance with personal data protection.

Data may also be disclosed to third parties (other than GF Cork or subcontractors) if consent is given or if legally required, e.g., tax authorities.

Under what circumstances does GF Cork transfer data to third countries?
GF Cork may transfer personal data outside the EU to countries without an adequacy decision. Such transfers will comply strictly with applicable legal requirements.