Data protection regulation

Personal data, holders and categories

What is personal data? Personal data is any information relating to an identified or identifiable natural person, collected on any medium. Information that may lead to identification includes references to an identifier such as an identification number or location data.

Whom do we collect personal data from? While most of the data we process relates to legal persons, Holos may collect data from natural persons, including:

• Clients/investors and collaborators
• Service providers and collaborators
• Candidates and trainees
• Candidates and clients of Holos-promoted programmes
• Event participants
• Facility visitors

What personal data do we process, and how do we collect it?Holos collects only data that is appropriate, relevant and necessary for the purpose of processing. Collection occurs orally, in writing (forms, contracts) and through the website. Data types include:

• Identification data (name, place of birth, citizen's card, date of birth)
• Contact information (phone, address, email)
• Qualification and professional data (level of education, CV)
• Banking and financial data (IBAN, tax identification)
• Location data (IP address)

Holos generally does not collect special categories of data, such as health or criminal records.

Grounds and purposes of processing

Processing operates under one of the following conditions of legitimacy:

• Consent: processing preceded by express, specific and informed consent in writing or online - for example, newsletter subscriptions and participation in Holos-sponsored actions.
• Performance of a contract: processing necessary for the performance of a contract or pre-contractual procedures, such as programme management and service provision.
• Legal obligations: processing necessary to fulfil legal obligations, including communication to public, tax or judicial bodies.
• Legitimate interest: processing necessary to pursue the legitimate interests of the controller or third parties without prejudicing the rights and freedoms of customers or users.

Personal data is processed only for specific, explicit and legitimate purposes identified at the moment of collection, including the management of cooperation programmes and events, the execution of supply and service contracts, the distribution of newsletters and publications, and the security of our facilities and personnel.

Controller and data protection officer

Holos is the entity responsible for the collection and processing of personal data, stored in automated and non-automated form. Holos employs a Data Protection Officer, reachable atdpo@holos.pt, who monitors compliance with the applicable legal and regulatory standards and acts as the point of contact between Holos and the national supervisory authority, customers and users on data-processing matters.

Retention period

Holos retains data only for as long as necessary to fulfil the purpose of processing, complying with the maximum periods required by contractual, legal or regulatory obligations. Where there is a contractual basis, data is retained for the duration of the relationship; other circumstances - such as tax obligations, which require invoicing data to be kept for up to ten years - may justify longer retention. After the applicable period, Holos eliminates the data.

Rights of data subjects

• Right of access to information about the processing and its characteristics.
• Right of rectification of data that is incomplete or out of date.
• Right to erasure ("right to be forgotten") when there is no longer a valid basis for retention.
• Right to restriction of processing for certain categories or purposes.
• Right to portability - to receive the data in a digital format or have it transmitted to another controller.
• Right to object to certain purposes, such as direct marketing.
• Right to withdraw consent where consent is the sole basis for processing.

These rights may be exercised through a written request sent todpo@holos.pt, subject to applicable legal limitations.

Data sharing

Depending on our functions and the purposes of processing, data may be shared with third parties, including national and international public bodies and private entities, to fulfil legal, regulatory or contractual obligations or functions of public interest. Service providers - for information-security and archiving services - may access data only with guarantees that they implement the necessary technical and organisational measures to protect it. Holos may, exceptionally, transfer personal data to third countries outside the European Economic Area, ensuring strict compliance with the applicable legal standards.

Cookie policy

Cookies are small text files placed on access devices (computers, smartphones, tablets) by web browsers when users visit a site, storing information about the visit. Depending on their duration, cookies are classified as session cookies (which expire when the browser closes) or permanent cookies. Holos's cookies do not collect personal identification information; holos.pt uses analytical cookies that collect anonymous data about the browsing experience in order to analyse how the site functions. All browsers allow users to accept, reject or delete cookies through their settings, although disabling cookies may prevent some services from working properly.

Legislation

Holos's processing of personal data and electronic commercial communications complies with the applicable national and Community legislation, in particular the General Data Protection Regulation.