Regulation (EU) 2016/679 – General Data Protection Regulation (GDPR)[1], applicable since 25 May 2018, establishes the rules applicable to the processing of personal data by companies and public entities with a view to guaranteeing the defense of the fundamental rights and freedoms of natural persons and, in particular, the protection of their personal data.

What is personal data?

Personal data is all personal information relating to an identified or identifiable natural person, the data subject.

What is meant by “treatment”?

Treatment is the operation or set of operations performed on personal data or sets of personal data, whether by automated means or not, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

ANI – Agência Nacional de Inovação, S.A. (ANI), as a public company, is implementing the necessary technical and organizational measures to comply with the GDPR in order to ensure the confidentiality, integrity, security and accuracy of the personal data transmitted to it.

In what situations is data processed?

For the purpose of carrying out its activities, ANI processes personal data, in accordance with the provisions of the GDPR, when necessary for

• the performance of contracts to which it is a part,
• of compliance with the legal obligations to which it is subject,
• of the performance of duties in the public interest,
• the pursuit of a legitimate interest which is not overridden by the data subject’s interests or fundamental rights and freedoms requiring the protection of personal data.

Apart from the cases set out above, ANI will ask for your consent to process your personal data.


How is personal data processed?

ANI’s processing of personal data complies with the principles of transparency and fairness towards the data subject.

Personal data is collected for specific purposes, which must be defined, explicit and legitimate, and communicated to the data subject; it may not be used for purposes incompatible with those for which its collection was authorised.

We will only request personal data that is appropriate and relevant to the purposes of the processing.

Personal data is accurate and kept up to date whenever necessary, and appropriate measures are taken to ensure that any inaccurate data, having regard to the purposes for which it is processed, is erased or rectified as soon as possible.

Personal data is retained for as long as is necessary to fulfil the purpose for which it was collected.
ANI will implement the technical and organisational measures necessary to ensure the security of personal data and to prevent its accidental loss, destruction or damage, as well as unlawful or unauthorised processing.

Withdrawal of Consent
Where the collection and processing of personal data is based on the data subject’s consent, the data subject may withdraw their consent at any time.
To do so, they need only inform ANI of the withdrawal of consent by sending a message to the Data Protection Officer, either by email to epd@ani.pt or by letter sent by standard post.

Rights of the data subject
The data subject has

• The right to be informed about relevant aspects of the processing;
• Right of access to your data;
• The right to have your data rectified;
• The right to restrict the processing of your data;
• Right to erasure;
• Right to data portability (where technically feasible);
• Right to object to processing.

To exercise these rights, the data subject need only submit a request by contacting the Data Protection Officer, either by email to epd@ani.pt or by letter sent by standard post.

By providing their personal data to ANI, data subjects acknowledge and accept that such data will be processed in accordance with the provisions set out in this document, “Privacy and Personal Data Processing Policy”.

Data Protection Officer
The Data Protection Officer is responsible, amongst other things, for managing relations between ANI and data subjects in matters covered by the GDPR and related legislation.
The Data Protection Officer at ANI will provide any clarifications requested regarding the protection of personal data, receive requests relating to the exercise of data subjects’ rights, and also handle complaints submitted in this regard.


National Data Protection Commission
The National Data Protection Commission is responsible for overseeing the implementation of the GDPR in order to safeguard the fundamental rights and freedoms of natural persons with regard to data processing and to facilitate the free movement of data within the European Union.
Data subjects may lodge any complaints regarding ANI’s privacy policy and the processing of personal data with the National Data Protection Commission.

[1] As corrected by the Corrigendum to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.

CONTACTS

info@ani.pt

The contact details for the Data Protection Officer at ANI are:
Email: epd@ani.pt;
Address: Edifício NET, Rua de Salazares, 842, 4149-002 Porto, Portugal.

National Data Protection Commission
Rua de São Bento, n.º 148 – 3.º
1200-821 Lisboa,
Email: geral@cnpd.pt

Tel.: +351 21 423 21 00