CUSTOMER SERVICE

A - Introduction

B - General Section

2. Data communication

The personal data collected is not shared with third parties without the user's consent, except in the following situations: Communications required by law, in compliance with a legal obligation; Suppliers providing services as Subcontractors.

3. General principles applicable to the processing of user data

Regarding the processing of personal data, Ribeiro e Meireles Lda is committed to ensuring that the user data processed by it is:

1. 1. Subject to lawful, fair, and transparent processing with respect to the user;
2. 2. Collected for specified, explicit, and legitimate purposes, and not processed in a manner incompatible with those purposes;
3. 3. Adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed;
4. 4. Accurate and up to date whenever necessary, with appropriate measures taken to ensure that inaccurate data, in light of the purposes for which they are processed, are erased or corrected without delay;
5. 5. Kept in a form which allows identification of the user only for as long as necessary for the purposes for which the data are processed;
6. 6. Processed in a manner that ensures their security, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, with appropriate technical or organizational measures taken.

4. Legitimacy for the processing of personal data

The data processing carried out by Ribeiro e Meireles Lda is lawful when at least one of the following situations occurs:

1. 1. The user has given their explicit consent for the processing of their data for one or more specific purposes;
2. 2. The processing is necessary for the performance of a contract in which the user is a party, or for pre-contractual steps at the user's request;
3. 3. The processing is necessary for compliance with a legal obligation to which Ribeiro e Meireles Lda is subject;
4. 4. The processing is necessary for the protection of vital interests of the user or another individual;
5. 5. The processing is necessary for the legitimate interests pursued by Ribeiro e Meireles Lda or by third parties (except where such interests are overridden by the interests or fundamental rights and freedoms of the user which require the protection of personal data);
6. 6. Ribeiro e Meireles Lda is committed to ensuring that the processing of user data is only done under the conditions listed above and with respect to the principles mentioned above.
7. 7. When the processing of user data is carried out by Ribeiro e Meireles Lda based on the user's consent, the user has the right to withdraw their consent at any time. However, the withdrawal of consent does not affect the lawfulness of the processing carried out by Ribeiro e Meireles Lda based on the consent previously given by the user.

5. Retention period of personal data

Personal data is stored and retained temporarily, according to the purpose for which the information is processed. There are legal requirements that oblige the retention of data for a minimum period of time. Thus, and whenever there is no specific legal requirement, the data will be stored and retained only for the minimum period necessary for the purposes that motivated its collection or subsequent processing, after which it will be deleted.

6. Purposes of processing personal data

In the context of the data processing operations of this website, Ribeiro e Meireles Lda uses user data for the following purposes:

1. 1. Maintenance and proper functioning of the website;
2. 2. Load balancing and scalability;

7. Technical, organizational, and security measures implemented

To ensure the security of user data and maximum confidentiality, Ribeiro e Meireles Lda treats personal data with absolute confidentiality, in accordance with its internal security policies and document classification procedures, which are periodically updated based on needs, as well as according to legally established terms and conditions.

Depending on the nature, scope, context, and purposes of data processing, as well as the risks arising from processing for the rights and freedoms of the user, Ribeiro e Meireles Lda is committed to applying, both when defining processing methods and during the actual processing, the necessary and appropriate technical and organizational measures to protect user data and ensure legal compliance.

It is also committed to ensuring that, by default, only the data necessary for each specific purpose of processing is processed and that this data is not made available without human intervention to an indefinite number of people.

In terms of general measures, Ribeiro e Meireles Lda adopts the following:

1. 1. Regular audits to assess the effectiveness of the technical and organizational measures implemented;
2. 2. Raising awareness and training of staff involved in data processing operations;
3. 3. Pseudonymization and encryption of personal data;
4. 4. Mechanisms capable of ensuring the confidentiality, availability, and resilience of information systems;
5. 5. Mechanisms to ensure the restoration of information systems and access to personal data in a timely manner in the event of a physical or technical incident.

8. Data transfers outside the European Union

The personal data collected and used by Ribeiro e Meireles Lda is not made available to third parties established outside the European Union.

If, in the future, such a transfer occurs for the aforementioned reasons, Ribeiro e Meireles Lda is committed to ensuring that the transfer complies with applicable legal provisions, particularly regarding the adequacy of such a country's data protection measures and the requirements applicable to such transfers.

C - Data Subject Rights

9. Right of access to personal data

Ribeiro e Meireles Lda ensures the means for users to access their personal data.

Users have the right to obtain from Ribeiro e Meireles Lda confirmation as to whether or not personal data concerning them is being processed and, if so, the right to access their personal data.

Upon request, Ribeiro e Meireles Lda will provide the user, free of charge, with a copy of the user’s data that is being processed. The provision of additional copies requested by the user may incur administrative costs.

10. Right to rectification of personal data

The user has the right to request, at any time, the rectification of their personal data and, likewise, the right to have their incomplete personal data completed, including through an additional statement.

In the event of data rectification, Ribeiro e Meireles Lda will notify each recipient to whom the data has been disclosed of the rectification, unless such communication proves impossible or entails a disproportionate effort for Ribeiro e Meireles Lda

11. Right to erasure of personal data (“right to be forgotten”)

The user has the right to obtain from Ribeiro e Meireles Lda the erasure of their data when one of the following grounds applies:

1. 1. The user’s data is no longer necessary for the purpose for which it was collected or processed;
2. 2. The user withdraws the consent on which the data processing is based, and there is no other legal basis for such processing;
3. 3. The user objects to the processing under the right to object, and there are no overriding legitimate interests justifying the processing;
4. 4. The user’s data is processed unlawfully.

Under applicable legal terms, Ribeiro e Meireles Lda is not obliged to erase the user’s data to the extent that processing is necessary for compliance with a legal obligation to which Ribeiro e Meireles Lda is subject or for the purposes of declaration, exercise, or defense of a right by Ribeiro e Meireles Lda in judicial proceedings.

In the event of data erasure, Ribeiro e Meireles Lda will notify each recipient/entity to whom the data has been disclosed of the erasure, unless such communication proves impossible or entails a disproportionate effort for Ribeiro e Meireles Lda

When Ribeiro e Meireles Lda has made the user’s data public and is obliged to erase it under the right to erasure, Ribeiro e Meireles Lda undertakes to implement reasonable measures, including technical ones, considering the available technology and the cost of implementation, to inform the controllers processing the personal data that the user has requested the erasure of any links to, or copies or replications of, such personal data.

12. Right to restriction of personal data processing

The user has the right to obtain from Ribeiro e Meireles Lda the restriction of the processing of their data if one of the following situations applies (restriction consists of marking stored personal data with the aim of limiting their processing in the future):

1. 1. If they contest the accuracy of the personal data, for a period that allows Ribeiro e Meireles Lda to verify its accuracy.
2. 2. If the processing is unlawful and the user opposes the erasure of the data, requesting instead the restriction of its use.
3. 3. If Ribeiro e Meireles Lda no longer needs the user’s data for processing purposes, but the data is required by the user for the establishment, exercise, or defense of a legal claim.
4. 4. If the user has objected to the processing, until it is verified that Ribeiro e Meireles Lda’s legitimate reasons override those of the user.

When the user’s data is subject to restriction, it may only be processed, except for storage, with the user’s consent or for the establishment, exercise, or defense of legal claims, for the protection of the rights of another natural or legal person, or for reasons of public interest as legally provided.

In case of restriction of processing, Ribeiro e Meireles Lda will communicate the restriction to each recipient to whom the data has been disclosed, unless such communication proves impossible or entails disproportionate effort for Ribeiro e Meireles Lda

13. Right to data portability

The user has the right to receive the personal data concerning them and which they have provided to Ribeiro e Meireles Lda in a structured, commonly used, and machine-readable format, and the right to transmit such data to another data controller if:

The processing is based on consent or a contract to which the user is a party and, at the same time, the processing is carried out by automated means.

The right to portability does not include inferred or derived data, i.e., personal data generated by Ribeiro e Meireles Lda as a consequence or result of the analysis of the data being processed.

The user has the right to have personal data transmitted directly between controllers, whenever technically feasible.

14. Right to object to processing

The user has the right to object at any time, for reasons related to their particular situation, to the processing of personal data concerning them based on the pursuit of legitimate interests by Ribeiro e Meireles Lda or when the processing is carried out for purposes other than those for which the personal data was collected, including profiling, or when the personal data is processed for statistical purposes.

Ribeiro e Meireles Lda will cease processing the user’s data unless it presents compelling and legitimate reasons for such processing that override the interests, rights, and freedoms of the user, or for the establishment, exercise, or defense of a legal claim by Ribeiro e Meireles Lda

If the user objects to the processing of their data for direct marketing purposes, Ribeiro e Meireles Lda will cease processing the data for that purpose.

The user also has the right not to be subject to any decision based solely on automated processing, including profiling, that produces effects on their legal sphere or significantly affects them in a similar manner, unless the decision:

1. 1. Is necessary for the conclusion or execution of a contract between the user and Ribeiro e Meireles Lda;
2. 2. Is authorized by legislation to which Ribeiro e Meireles Lda is subject;
3. 3. Is based on the explicit consent of the user.

15. Procedures for Exercising Users' Rights

The right of access, the right to rectification, the right to erasure, the right to restriction, the right to portability, and the right to object may be exercised by the data subject by contacting Ribeiro e Meireles Lda’s Data Protection Officer at the email geral@oficinadasmotas.com

Ribeiro e Meireles Lda will respond to the user's request via email within a maximum period of one month from the receipt of the request, except in cases of special complexity, where this period may be extended by up to two months.

If the requests submitted by the user are manifestly unfounded or excessive, particularly due to their repetitive nature, Ribeiro e Meireles Lda reserves the right to charge administrative costs or refuse to follow up on the request.

Additionally, the user may always file a complaint with the Supervisory Authority with jurisdiction over the specific case:

Portugal: Data Protection – Comissão Nacional de Proteção de Dados, located at Av. D. Carlos I, 134 – 1.º 1200-651 Lisbon, with the phone number (+351) 213928400 and email: geral@cnpd.pt.

16. Personal Data Breaches

In the event of a data breach, insofar as such a breach is likely to result in a high risk to the rights and freedoms of the user, Ribeiro e Meireles Lda undertakes to communicate the personal data breach to the user without undue delay.

Under legal terms, communication to Ribeiro e Meireles Lda is not required in the following cases:

1. 1. If Ribeiro e Meireles Lda has implemented appropriate protection measures, both technical and organizational, and these measures have been applied to the personal data affected by the breach, particularly measures that make the personal data incomprehensible to any unauthorized person, such as encryption.
2. 2. If Ribeiro e Meireles Lda has taken subsequent measures to ensure that the high risk to the rights and freedoms of the user is no longer likely to materialize.
3. 3. If communication to the user involves a disproportionate effort for Ribeiro e Meireles Lda In this case, Ribeiro e Meireles Lda will make a public communication or take a similar measure through which the user will be informed.

D - Final Part

17. Changes to the Privacy Policy

Ribeiro e Meireles Lda reserves the right to change this privacy policy at any time.

In the event of a change to the privacy policy, the date of the last update, available at the top of this page, will also be updated.

If the change is substantial, a notice will be posted on the website.

18. Applicable Law and Jurisdiction

The privacy policy, as well as the collection, processing, or transmission of user data, are governed by the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, and by the applicable laws and regulations in Portugal.

Any disputes arising from the validity, interpretation, or execution of the privacy policy, or related to the collection, processing, or transmission of user data, must be exclusively submitted to the jurisdiction of the judicial courts of the District of Lisbon, without prejudice to the applicable mandatory legal norms.