The General Data Protection Regulation, hereinafter "GDPR", in effect since May 25, 2018, establishes the rules applicable to the processing of personal data by companies and public entities to ensure the protection of the fundamental rights and freedoms of natural persons, and in particular, the protection of their personal data. Personal data is defined as information relating to an identified or identifiable natural person - the data subjects. A natural person is considered identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, online identifiers, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

With this in mind, the Lusiaves Group respects the privacy of its employees, customers, suppliers, and website users.

Accordingly, the Lusiaves Group is classified as the Controller for the processing of personal data whenever it determines the purposes and means of processing, ensuring compliance with all provisions of the GDPR and other applicable legislation regarding data protection and privacy.

In accordance with the commitment to comply with all legislation regarding data protection and privacy, this Data Protection and Privacy Policy is established, with the Lusiaves Group committing to always act in compliance with and in accordance with this Policy.

What data is collected?

The Lusiaves Group may collect and process the following categories of personal data:

• Identification data;
• Contact data;
• Banking data;
• Among others.

How is the data collected?

The Lusiaves Group may collect your personal data through various means:

• When you contact us for any reason via our website, our telephone line, or by email;
• When you fill out application forms on our website;
• When you physically submit your application for a job position;
• When you use or view our website, through your browser's cookies;
• When an employment relationship is established;
• Google Signals;
• Among others.

The Lusiaves Group website uses "Google Signals". Google Signals is a feature provided by Google as part of Google Analytics that allows for cross-device tracking only for users who are signed in to their Google account and have enabled "Ads Personalization" in their Google account settings. By using aggregated data from Google Signals, users of the Site who are signed in to their Google account and have enabled "Ads Personalization" in their Google account are included in Google Analytics reports. Since the data that Google Signals generates for the Lusiaves Group is aggregated, the Lusiaves Group cannot identify any individual user from this data. In an aggregated form, Google Signals provides the Lusiaves Group with information on how a visitor interacts with the Lusiaves Group website across various browsers and devices.

Google account users can control their advertising experience and can disable "Ad personalization" at any time in their Google account settings.

Why do we need personal data, and what are the legal bases and purposes for processing it?

• Processing means any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
• To carry out its business activities, the Lusiaves Group processes personal data in accordance with the GDPR. There are several reasons why this processing is necessary. Since there are various reasons, the respective legal bases for processing also vary, which may include:
• Consent - The data subject may consent to the respective processing through a free, specific, informed, and explicit expression of will, by which they accept through a declaration (written or oral) or a clear affirmative action (filling out/checking an option) that their personal data may be processed.
• Pre-contractual measures or contract performance - Personal Data may be processed if necessary for the performance of a contract to which the data subject is a party as an Employee, Customer, and/or Supplier, or to take steps at the request of the data subject prior to entering into a contract.
• Compliance with a legal obligation - Personal Data may be processed to ensure and guarantee compliance with legal obligations to which we are subject under national and/or European Union legislation.
• Protection of the data subject's vital interests - Personal Data may be processed to protect their vital interests, particularly when such processing is essential to their life.
• Legitimate interests - The Lusiaves Group may process Personal Data provided that such processing does not override the data subject's interests or fundamental rights and freedoms.

How is personal data processed?

The processing of personal data by the Lusiaves Group adheres to the principles defined in the legislation. Personal data is collected for specific, explicit, and legitimate purposes, communicated to the data subject, and may not be used for purposes incompatible with those for which its collection was authorized.

Only personal data that is adequate and relevant to the purposes of the processing will be requested.

Personal data is kept accurate and updated whenever necessary.

Personal data is stored for the time necessary to fulfill the purpose for which it is intended, and the Lusiaves Group will adopt all measures to ensure the security of personal data and prevent its loss, destruction, or damage, as well as illicit or unauthorized processing.

Can I withdraw my consent?

Whenever the collection and processing of personal data are based on the data subject's consent, they may withdraw that consent at any time.

To do so, simply inform the Lusiaves Group of the withdrawal of consent by communicating with the Data Protection Officer via email at rgpd@grupolusiaves.pt or by letter sent via standard mail to Zona Industrial da Zicofa, Lote 4, 2415-314 Leiria.

What rights can I exercise?

• In accordance with the GDPR, Data Subjects have several rights, namely:
• Right of access to your data;
• Right to rectification of your data;
• Right to restriction of processing of your data;
• Right to erasure/deletion of data;
• Right to data portability (where technically feasible);
• Right to object to processing.

To exercise these rights, the data subject simply needs to submit a request to the Data Protection Officer via email at rgpd@grupolusiaves.pt or by standard mail to Zona Industrial da Zicofa, Lote 4, 2415-314 Leiria.

You also have the right to lodge a complaint with the National Data Protection Commission.

By providing your personal data to Grupo Lusiaves, you acknowledge and accept that the processing of such data is carried out in accordance with this "Data Protection and Privacy Policy" document.

How is the security of my personal data guaranteed?

To ensure the security and confidentiality of Personal Data, protected databases are used, including, among others, appropriate firewalls and passwords, in accordance with the provisions of Data Protection Legislation.

Access to Personal Data is only permitted to authorized employees who have an actual need to use it, in accordance with the principles of security and confidentiality.