This Privacy and Personal Data Protection Policy, hereinafter referred to as “Privacy Policy” or simply “Policy”, has been prepared in accordance with applicable legislation, namely Law no. 22/11 of 17 June – Personal Data Protection Law and applies, generally, to the collection and processing of personal data provided by customers, suppliers, users of social media pages and others, namely data collected through forms, documents or other means intended to allow contact with MINHATUGA.

Since we will be connected to European websites and stores, our data protection policy is also based on the standards of European legislation on the same subject.

In accordance with European legislation, in this Privacy Policy we explain who we are, for what purposes we use your data, how we process it, with whom we share it, for how long we keep it, as well as the ways to contact us and exercise your rights.

Personal data is processed in strict compliance with personal data protection legislation, in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and Council of 27 April 2016, which came into effect on 25 May 2018, hereinafter referred to as the General Data Protection Regulation or GDPR and/or any legislation that regulates, supplements or replaces said legislation.

 

MINHATUGA is committed to protecting the personal data of all those with whom it comes into contact in all situations in which personal data is processed, and has, in this context, drawn up this Policy, which is based on its commitment to respecting personal data protection rules as well as best practices in this sector.

 

As we operate physically on Angolan soil, we have also adopted the Angolan data protection policy legislation, making this Policy easier to understand. The definitions used are those contained in Law No. 22/11 of 17 June – Personal Data Protection Law of the Republic of Angola:

 

Controller of Personal Data

The Company is the entity responsible for processing the personal data provided by the respective holder when filling in forms, as well as other personal data that has been or will be provided in any other medium, directly or through third parties, or that has been generated by the Company, either within the scope of prior contacts or in the conclusion, execution, renewal or termination of contracts with the Company or with affiliated entities, and their representatives, hereinafter “Personal Data”.

 

The provision to the Company of personal data collected within the scope of pre-contractual procedures or during the contracting process, in addition to cases where it corresponds to information necessary to comply with the Company’s legal obligations, will also be processed for the purposes of this policy.

Personal data will be processed by the Company, the entity responsible for processing the data, for the purposes listed in point 4 below, in strict compliance with the provisions of the legislation in force regarding the protection of personal data.

 

Data Protection Officer

The Personal Data Protection Officer can be contacted in writing at the following addresses:

Av. Miramar – Luanda, Angola

Priv.minhatuga@minhatuga.com

 

Processing of Personal Data

The data provided in the relationship established with the Company are processed in accordance with the legally applicable provisions, namely:

– Processed lawfully, fairly and transparently;

– Collected for specific, explicit and legitimate purposes and will not be further processed in a manner incompatible with those purposes;

- Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;

– Accurate and, where necessary, kept up to date, with appropriate measures being taken to ensure that inaccurate or incomplete data can be erased or rectified, taking into account the purposes for which they were collected or for which they are further processed;

– Stored in a manner that allows the identification of their data subjects only for the period strictly necessary and within the legally permitted period for the purposes of collection or further processing.

 

Purpose of Processing Personal Data

The personal data provided by the data subject or generated in connection with the service provided will be processed and stored electronically and are intended for use by the Company.

The Company collects and processes strictly necessary data, which are only requested when related to the purpose in question, and for legitimate purposes, such as:

 

– Provide an appropriate and targeted response to requests for information/proposals;

- Communicate better with the holders of personal data, on relevant matters and only as frequently as necessary, according to the characterisation of their data and their preferences;

- Comply with business purposes, namely, statistical data to improve the performance of the various services provided;

- Comply with the assumptions of human resources management;

- Comply with legal or regulatory requirements, on which the validity of certificates for some of the services provided depends, namely training courses;

Invoice services/products.

 

 

Data Sharing

The Company may transmit data to companies with which it is directly or indirectly linked, in a controlling or group relationship, ensuring the confidentiality of the data, compliance with the privacy policy implemented in accordance with applicable legal requirements, its use in accordance with the corporate purpose of the companies and always in a manner compatible with the purposes determining the processing.

 

The Company may also transmit data to companies that provide services to it, ensuring the confidentiality of the data, compliance with the privacy policy implemented in accordance with applicable legal requirements, its use in accordance with the corporate purpose of the companies and always in a manner compatible with the purposes determining the processing.

The transmission of personal data outside Angola will only occur after the consent of the data subject, when this is necessary for the execution of orders or requests transmitted to the Company, by legal requirement or for the convenience/internal organization of the Company.

If it uses financial service providers from countries outside the European Economic Area, Caixa only uses entities that comply with legal obligations regarding data protection.

The Company may also transmit the personal data of Customers in compliance with legal obligations and/or court orders, in particular under the legal duties of collaboration with public institutions and authorities.

Recording of telephone calls

In telephone contacts established between the data subject and the Company, within the scope of its activity, the Company may record calls, after prior information to the data subject and with his/her consent, for the management of the pre-contractual and contractual relationship, namely, as a means of proof of information or instructions transmitted and, also, to improve the services offered or contracted and, also, to control their quality. Call recordings will be kept for the periods indicated in this policy and as amended from time to time.

Disclosure of Data

Personal data may be communicated to other affiliated companies, whose identification and contact details may be requested at any time from the Personal Data Protection Officer, and may be processed by other entities to whom the Company has subcontracted their processing.

Personal Data may also be processed by third parties, duly authorized, in the event that the Company provides a service or supplies a product on behalf of and in representation of that third party.

 

For the purposes described and in compliance with legal obligations, personal data may be transmitted to judicial, administrative, supervisory or regulatory authorities, and also to entities, particularly of an associative nature, that lawfully frame or carry out data compilation actions, fraud prevention and combating actions, market studies or statistical or technical-actuarial studies.

 

Collection of Data from Other Sources

The Company may collect other information regarding the data subject that is relevant to assessing the data subject with a view to entering into any contractual relationship, from publicly accessible sources, public bodies, sector associations or specialist companies, to complement or confirm the information provided by the data subject, within the scope of the purpose of managing the pre-contractual and contractual relationship between the parties.

 

Data Subject Rights

The Company guarantees all rights of data subjects in relation to the processing of their data at any time, in particular those set out in applicable legislation and which are subsumed under the following:

- Lawfulness of processing and conditions applicable to consent

- Right of access by the data subject

Right to object

Right to update/rectify

Right to delete data

Right to restrict data processing

Personal data subjects may exercise the above-mentioned rights by means of written communication addressed to the Personal Data Protection Officer or at any commercial establishment of the Company.

Personal data subjects also have the right to lodge a complaint with the competent authorities in matters relating to the exercise of their rights and the protection of their personal data.

 

Obligation to Provide Personal Data

Within the scope of the commercial relationship to be concluded with the Company, the holder of the personal data will have to present the same in order to establish and create a commercial relationship and to comply with the pre-contractual and contractual obligations and diligences and also those that are legally obliged to collect. Without this data, the Company will, as a general rule, have to refuse to conclude the contract or, furthermore, will not be able to maintain the contract, having to terminate it.

 

Automated processes

Within the scope of the contract subscription and renewal processes, or when updating data on the Company’s various platforms, the Company may use automated decision-making solutions that are necessary for the conclusion and execution of the contract, using information regarding the customer, obtained in the pre-contractual phase or during the execution of a contract, so that a decision can be made on contractual matters. The holder of Personal Data may also request more detailed information from the Personal Data Protection Officer on the logic underlying the processes in question, within the scope of the subscription and renewal of contracts, in particular on the information taken into account for the making of exclusively automated decisions and the way in which this information is integrated into the decision-making process. In all cases where the Company makes decisions exclusively based on automated data processing, the respective processes will include, at least, mechanisms that give the data subject the possibility of: (i) expressing his or her point of view; (ii) contesting the decision; and (iii) request and obtain from the Society human intervention in the decision-making review process.

 

Security Measures

The Company guarantees adequate levels of security and protection of the personal data of data subjects. To this end, it adopts various security measures of a technical and organisational, logical or physical nature, in order to protect personal data against loss, dissemination, alteration, unauthorised processing or access, as well as against any other form of unlawful processing.

 

 

Data retention

The Company complies with the legal standards regarding the retention periods for personal data, and may retain them:

 

a) Up to ten years after the end of the contractual relationship;

b) As long as obligations arising from the contractual relationship remain in force;

c) As long as a right can be enforced against the Company.

 

The Company retains personal data for the necessary period and as long as the legitimate purposes for which the data are processed remain in force, in compliance with the legal, regulatory and contractual obligations to which it is subject.

 

Changes to the Privacy Policy

The Company may update or make adjustments to this Privacy Policy, and such changes will be duly publicized internally and in the Company’s communication channels.