The General Data Protection Regulation, hereinafter "GDPR", in force since May 25, 2018, establishes the rules applicable to the processing of personal data by companies and public entities with a view to guaranteeing the defense of the fundamental rights and freedoms of natural persons and, in particular, the protection of their personal data. This is understood as information relating to an identified or identifiable natural person - the data subjects - with an identifiable natural person being one who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, online identifiers, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

With this in mind, the Lusiaves Group respects the privacy of its employees, customers, suppliers, and website users.

Accordingly, the Lusiaves Group is qualified as the Data Controller whenever it determines the purposes and means of processing, ensuring compliance with all provisions of the GDPR and other applicable legislation on data protection and privacy.

In line with our commitment to comply with all legislation regarding data protection and privacy, this Data Protection and Privacy Policy has been established, with the Lusiaves Group committing to always act in accordance with this Policy.

What data is collected?

The Lusiaves Group may collect and process the following categories of personal data:

• Identification data;
• Contact details;
• Banking details;
• Among others.

‍How is data collected?

The Lusiaves Group may collect your personal data through various means:

• When you contact us for any reason via our website, our telephone line, or by email;
• When you fill out the application forms on our website;
• When you physically submit your application for a job position;
• When you use or view our website, through your browser's cookies;
• When an employment relationship is established;
• Google Signals;
• Among others.

The Lusiaves Group website uses "Google Signals." Google Signals is a feature provided by Google as part of Google Analytics that enables cross-device tracking only for users who are signed in to their Google account and have enabled "Ad personalization" in their Google account settings. By using aggregated data from Google Signals, users of the site who are signed in to their Google account and have enabled "Ad personalization" are included in Google Analytics reports. Because the data that Google Signals generates for the Lusiaves Group is aggregated, the Lusiaves Group cannot identify any individual user from this data. In an aggregated form, Google Signals provides the Lusiaves Group with information on how a visitor interacts with the Lusiaves Group website across multiple browsers and devices.

Google account users can control their advertising experience and can disable "Ad personalization" at any time in their Google account settings.

‍Why do we need personal data and what are the legal grounds and purposes for processing it?

• Processing means any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
• To carry out its activities, the Lusiaves Group processes personal data in accordance with the GDPR, for several reasons. Since there are various reasons, the legal grounds for processing also vary, which may include:
• Consent - The data subject may consent to the respective processing through a free, specific, informed, and explicit expression of will, by which they accept via a declaration (written or oral) or a clear affirmative action (filling out/selecting an option) that their personal data may be processed.
• Pre-contractual measures or contract execution - Personal data may be processed if necessary for the performance of a contract to which the data subject is a party as an employee, customer, and/or supplier, or to take steps at your request prior to entering into a contract.
• Compliance with a legal obligation - Personal data may be processed to ensure and guarantee compliance with legal obligations to which we are subject under national and/or European Union law.
• Protection of the data subject's vital interests - Personal data may be processed to ensure the protection of your vital interests, particularly when such processing is essential to your life.
• Legitimate interests - The Lusiaves Group may process personal data provided that such processing does not override your interests or fundamental rights and freedoms.

How is personal data processed?

The processing of personal data by the Lusiaves Group complies with the principles defined by law. Personal data is collected for specific, determined, explicit, and legitimate purposes, which are communicated to the data subject, and may not be used for purposes incompatible with those for which its collection was authorized.

We will only request personal data that is adequate and relevant for the purposes of processing.

Personal data is kept accurate and updated whenever necessary.

Personal data is kept for as long as necessary to fulfill the purpose for which it was collected. Grupo Lusiaves will take all measures to ensure the security of personal data and to prevent its loss, destruction, damage, or illicit or unauthorized processing.

Can I withdraw my consent?

Whenever the collection and processing of personal data is based on the data subject's consent, they may withdraw that consent at any time.

To do so, simply inform Grupo Lusiaves of the withdrawal of consent by sending a communication to the Data Protection Officer via email at rgpd@grupolusiaves.pt or by standard mail to Zona Industrial da Zicofa, Lote 4, 2415-314 Leiria.

What rights can I exercise?

• Under the GDPR, Data Subjects have several rights, namely:
• Right of access to your data;
• Right to rectification of your data;
• Right to restrict the processing of your data;
• Right to erasure/deletion of data;
• Right to data portability (where technically feasible);
• Right to object to processing.

To exercise these rights, the data subject simply needs to submit a request to the Data Protection Officer via email at rgpd@grupolusiaves.pt or by standard mail to Zona Industrial da Zicofa, Lote 4, 2415-314 Leiria.

You also have the right to lodge a complaint with the National Data Protection Commission (Comissão Nacional de Proteção de Dados).

By providing your personal data to Grupo Lusiaves, you acknowledge and accept that it will be processed in accordance with this "Data Protection and Privacy Policy" document.

How is the security of my personal data guaranteed?

To ensure the security and confidentiality of Personal Data, we use protected databases, including appropriate firewalls and passwords, in compliance with Data Protection legislation.

Access to Personal Data is restricted to authorized employees who have a genuine need to use it, in accordance with security and confidentiality principles.