Pepper – Brand Taste (hereinafter simply “Pepper”) values the relationship of trust it maintains with its clients and has therefore made every effort to implement technical and organisational measures designed to safeguard their privacy and respect their rights and freedoms in relation to the processing of Personal Data.
This Privacy Policy is intended to explain how Pepper processes your Personal Data and ensures its privacy, security and integrity in the course of carrying out its activities.
1. Data Controller Responsible for Processing Your Personal Data
The Data Controller responsible for processing your Personal Data is Pepper, which provides services and/or products to you and determines, without limitation:
- The Personal Data to be processed in connection with the provision of services and/or products;
- The purposes for which the Personal Data is processed; and
- The means used to process the Personal Data.
2. Principles Applicable to the Processing of Your Personal Data
Your Personal Data is processed in accordance with the general principles set out in the General Data Protection Regulation and other data protection legislation, namely:
- In the context of its relationship with you, Pepper ensures that your Personal Data is processed lawfully, fairly and transparently.
- Pepper collects your Personal Data for specified, explicit and legitimate purposes and does not subsequently process that Data in a manner incompatible with those purposes.
- Pepper ensures that only Personal Data that is adequate, relevant and limited to what is strictly necessary for the purposes for which it is processed is processed.
- Pepper takes appropriate measures to ensure that Personal Data identified as inaccurate is erased or rectified without delay.
- Pepper retains Personal Data only for the period necessary for the purposes for which it is processed.
- Pepper ensures that your Personal Data is processed in a manner that guarantees its security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage.
3. Personal Data, Personal Data Processing and Data Subjects
Personal Data means any information and/or elements which, regardless of their medium, identify you or make you directly or indirectly identifiable to Pepper, particularly by reference to an identifier such as a name, an identification number, location data and/or electronic identifiers.
Personal Data Processing means any operation or set of operations performed on the Personal Data of Data Subjects by automated or non-automated means, from the collection of the information through to its destruction. This cycle includes, among other operations, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, comparison or interconnection, restriction and erasure.
In the context of Pepper’s activities, the term “Data Subject” may include, without limitation, current, former and prospective clients, employees of associates, partners, job applicants, current and former employees, employees of partners, suppliers and service providers and their employees, applicants and complainants, visitors, and all individuals who have a relationship with Pepper and to whom the Personal Data relates.
Pepper does not voluntarily or directly request or collect Personal Data from individuals under the age of 18. If Pepper discovers that it has inadvertently collected Personal Data from an individual under the age of 18, it will immediately delete the records containing that individual’s Personal Data. Pepper may, however, collect Personal Data relating to individuals under the age of 18 when it is provided by their parents or by a legal guardian who expressly consents to that collection.
4. Categories of Personal Data Processed by Pepper
In carrying out its activities, Pepper processes Personal Data relating to a significant number of categories of Data Subjects.
The Personal Data collected by Pepper always depends on the nature of the interaction, but may include the following:
- Personal contact data;
- Commercial data for the provision of services and/or products;
- Payment data;
- Account data;
- Preference data; and
- Information technology usage data.
You are not required to share your Personal Data with Pepper. However, if you decide not to share your personal information, Pepper may, in some cases, be unable to provide the services or products you require, ensure certain specialised features or respond effectively to a question you may have.
5. Purposes for Processing Your Personal Data
The development and performance of Pepper’s activities entail a set of specific, explicit and legitimate purposes for processing your Personal Data, such as:
- Accounting, tax and administrative management;
- Commercial activity and marketing;
- Profile definition and analysis;
- Human resources management;
- Electronic communications management;
- Litigation management; and
- Compliance with legal obligations.
6. Lawful Bases
In accordance with the principle of lawfulness enshrined in applicable data protection laws, Pepper processes your Personal Data in the course of carrying out its activities only where there is a lawful basis that legitimises such processing, namely:
Consent
Pepper will process your Personal Data only if you consent to that processing through a freely given, specific, informed and explicit indication of your wishes by which, through a statement or clear affirmative action, you agree to the processing of your Personal Data.
Pre-contractual steps or performance of a contract
Pepper may process your Personal Data where it is necessary for the performance of a contract for the provision of services and/or products to which you are a party as an Employee, Client and/or Supplier, or in order to take pre-contractual steps at your request.
Compliance with a legal obligation
Pepper may process your Personal Data to ensure and guarantee compliance with legal obligations to which it is subject under the law of a Member State and/or the European Union.
Protection of vital interests
Pepper may process your Personal Data to protect your vital interests, particularly where such processing is essential to your life.
Legitimate interests
Pepper, other Data Controllers or Third Parties may process your Personal Data provided that the interests or fundamental rights and freedoms of the Data Subject do not override the interests pursued by that processing.
Retention period for your Personal Data
Pepper retains your Personal Data only for the period necessary to fulfil the specific purposes for which it was collected. However, Pepper may be required to retain certain Personal Data for a longer period, taking into account factors such as:
- Legal obligations under applicable laws to retain Personal Data for a specified period;
- Limitation periods under applicable laws;
- Potential disputes; and
- Guidance issued by the competent data protection authorities.
Throughout the period during which your Personal Data is processed, Pepper ensures that it is processed in accordance with this Data Protection and Privacy Policy. As soon as your Data is no longer required, Pepper will securely delete it.
7. Sharing Your Personal Data
In the course of its activities, Pepper may share your Data with third parties, but will do so only under the terms set out in this section of the Privacy Policy.
Data Processors
Your Personal Data may be shared with companies that provide services to Pepper. These service providers are bound to Pepper by written contract, may process your Personal Data only for the specifically defined purposes and are not authorised to process your Personal Data, directly or indirectly, for any other purpose or for their own benefit or that of a third party.
Other Data Controllers and/or Third Parties
Your Personal Data may be shared internally with other entities associated with Pepper, which will comply with the data protection rules applicable to the purposes assigned to the processing performed.
At your request and/or with your consent, your Personal Data may be shared with other entities.
In compliance with legal and/or contractual obligations, Personal Data may also be disclosed to judicial, administrative, supervisory or regulatory authorities, as well as to entities that lawfully carry out data compilation activities, fraud prevention and counter-fraud activities, and market or statistical studies.
8. Rights and Exercise of Rights
As the Data Subject whose Personal Data is processed by Pepper, you have the rights of access, rectification, restriction, portability and erasure, and the right to object to the processing of Personal Data in certain circumstances.
- Right to be informed: obtain clear, transparent and easily understandable information about how Pepper uses your Personal Data and what your rights are.
- Right of access: obtain information about the Personal Data processed by Pepper and how that Data is processed.
- Right to rectification: ask Pepper to take reasonable steps to correct your Personal Data where it is inaccurate or incomplete.
- Right to erasure: request the erasure or deletion of your Data where there are no valid grounds for Pepper to continue using it or where its use is unlawful.
- Right to restriction of processing: block or prevent the future use of your Data while Pepper assesses a rectification request, or as an alternative to erasure.
- Right to data portability: obtain and reuse certain Personal Data for your own purposes.
- Right to object: object to certain types of processing on grounds relating to your particular situation.
- Right to lodge a complaint: lodge a complaint with the Portuguese Data Protection Authority – CNPD if you consider that the processing of Personal Data infringes your rights and/or applicable data protection laws.
You may exercise the rights established in the Personal Data Protection Law and other applicable legislation at any time, in writing, by emailing geral@pepper.pt.
9. Security and Integrity
Your Personal Data will be processed by Pepper only for the purposes identified in this Policy, in accordance with Pepper’s internal policies and using technical and organisational measures designed according to the risks associated with the specific processing of the Personal Data.
The technical and organisational measures implemented ensure, to the fullest extent possible, the security and integrity of Personal Data, particularly in relation to the unauthorised or unlawful processing of your Personal Data and its accidental loss, destruction or damage.
However, Pepper cannot guarantee the security of Data transmitted over an open network, as the transmission of information over the Internet is not completely secure.
10. Confidentiality
Pepper acknowledges that the information you provide may be confidential in nature. In the course of its activities, Pepper does not sell, rent, distribute or otherwise make Personal Data commercially available to any third party, except where it needs to share information with Service Providers for the purposes set out in this Privacy Policy or with Third Parties for the purpose of complying with its legal obligations.
Pepper preserves the confidentiality and integrity of your Data and protects it in accordance with this Privacy Policy and all applicable laws.
11. Changes to This Data Protection and Privacy Policy
Pepper will update this Privacy Policy periodically. Whenever it does so, the new version will be published on the website and will take effect immediately; we therefore recommend that you review it regularly.
