Privacy Policy

1. Scope and Purpose

The Municipality of Albergaria-a-Velha, the entity responsible for providing the website and mobile application supporting the Albergaria-a-Velha Digital Commercial District – The Art of Welcoming Well project, which includes the Albergaria Digital Commercial District platform, defines and implements a set of practices aimed at ensuring the adequate protection of personal data of all individuals who interact with these platforms.

Committed to transparency and compliance with applicable legal obligations, the Municipality has prepared this Privacy Policy with the aim of disclosing and communicating the rules that govern the processing of personal data in the context of using these platforms. This policy, while respecting the terms of the Institutional Privacy Policy, restricts its scope to the set of rules applicable to personal data processing operations that arise exclusively from the use of digital platforms (web and app) associated with the Albergaria Digital Commercial District.

2. What is the legal framework for this Policy?

This policy has been prepared in accordance with applicable national and European data protection legislation, namely:

Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016 (General Data Protection Regulation – GDPR);
Law no. 58/2019, of August 8, which ensures the implementation, in the national legal order, of the GDPR;
Law no. 41/2004, of August 18, relating to the processing of personal data and the protection of privacy in the electronic communications sector, with subsequent amendments;
Rules and guidelines from the National Data Protection Commission (CNPD) and the European Data Protection Board;
Principles of good public administration, including the duty of transparency, proportionality, necessity, and security.

The data processing carried out by the Municipality also takes into account the legal principles that govern public administration, including the exercise of functions of public interest and the fulfillment of legal obligations.

3. Who is responsible for processing your personal data?

The data controller for registration and use is the Municipality of Albergaria-a-Velha, with headquarters at Praça Comendador Ferreira Tavares 3850-053 Albergaria-a-Velha, NIPC 506783146, which, as the promoting and managing entity of the digital platform and mobile application, defines the means and purposes for processing personal data.

However, whenever a purchase process is completed through the platform, merchants adhering to the Albergaria Digital Commercial District will have access to the personal data necessary for the transaction (e.g., name, contact, delivery address, order details). In such cases, merchants act as autonomous data controllers, committing to process user data in accordance with the GDPR.
Each user should consult the legal identity of each merchant, as well as their specific commercial terms, their own privacy policies, and the contacts provided by merchants for exercising rights, being their responsibility to inform themselves about such conditions when interacting with each economic operator.

4. What is personal data and what categories of data do we process in the Albergaria Digital Commercial District?

According to the GDPR, personal data is any information relating to an identified or identifiable natural person. Within the scope of using the Albergaria Digital Commercial District platform, the following data are processed, including consumers and merchants, where applicable:

Identification and Contact Data: Name, NIF (Tax Identification Number), identification document, date of birth, telephone contact, email, address, login credentials, payment data.
Data Related to Platform Interaction: Purchase history, reserved services, visited pages, performed searches.
User Profile: Preferences, interests, interactions, and Browse behavior.
Location Data: Information relating to the approximate or precise location of the user, collected only with their explicit consent. This data is used exclusively for application features that depend on geolocation, such as displaying maps or relevant content for the user’s geographical area. Location data is not shared with third parties and is not used for marketing purposes or profile creation.

In addition to the categories described above, the use of the Albergaria Digital Commercial District platforms may involve the processing of other personal data, whenever:

It is necessary for the fulfillment of legal or regulatory **obligations**;
It results from the execution of a contract with the data subject;
It is carried out based on the **explicit consent** of the data subject, namely for marketing purposes, notifications, or content personalization;
It is based on a **legitimate interest,** duly considered, of the Municipality or the economic operators involved, namely for the purposes of fraud prevention, information security, continuous improvement of user experience, or aggregated statistical analysis.

Whenever it is necessary to collect and process additional categories of data, data subjects will be informed clearly and transparently, and their respective rights will be ensured.

The personal data processed by the platform are not transferred to countries outside the EU, unless this is necessary for the execution of a contract or with the explicit consent of the data subject.
The platform may use automated decision-making processes, such as product recommendation algorithms, based on the user’s Browse history and preferences. Users will be informed when such processes are used and may object to their use, as provided for in Article 22 of the GDPR.

5. In what situations do we process your personal data?

a) Users

Create account on the platform;
Make purchases, reservations, or interactions;
Provide consent for communications;
Use functionalities or request support

b) Merchants

Request platform membership;
Formalize contracts with the Municipality;
Manage products, sales, and orders;
Participate in communications or campaigns.

Processing can be done by digital, written, or in-person means.

6. For what purposes do we process your personal data?

The Albergaria-a-Velha Digital Commercial District processes your data exclusively for the purposes now transmitted and suitable for the platform’s operation, namely:

a) Users

User account management;
Transaction processing and delivery;
Institutional communication and marketing (with consent);
Compliance with legal obligations (e.g., tax).

b) Merchants

Registration and validation as a member;
Contractual, fiscal, and promotional management;
Technical support and sales monitoring;
Institutional dissemination (with consent).

Processing respects the principle of minimization, with only the data necessary for each purpose being collected.

7. On what grounds do we process your personal data?

Legal grounds include:

a) For users

Consent: e.g., marketing, notifications.
Contract execution: e.g., orders and reservations.
Legal obligation: e.g., accounting and security.
Legitimate interest: e.g., platform improvement.

b) For merchants

Contract execution with the Municipality;
Fulfillment of legal and regulatory duties;
Legitimate interest in promoting local commerce;
Consent, where applicable (e.g., publications).

All processing is carried out with security and confidentiality safeguards.

8. How long do we retain your personal data?

We retain your data only for the time necessary for the purposes for which it was collected, and additionally whenever necessary to comply with legal obligations to which the Municipality is subject. For example, users’ identification and contact data are retained while the account is active and up to 1 year after its deactivation, unless legal obligations require longer periods (e.g., 10 years for tax data).

9. To whom do we transmit your personal data?

Your personal data may be transmitted to third parties, always with a legal basis and for legitimate and specific purposes, namely:

Service providers acting on behalf of or for the Digital District, such as transport companies, payment services, or technology providers, exclusively to the extent necessary to ensure the provision of contracted services;
Public entities or administrative authorities, such as the Tax Authority, in cases where the law requires the communication or provision of data;
Merchants integrated into the Digital Commercial District platform, in cases where the user makes a purchase or direct request for products or services made available by these merchants. In such cases, the personal data strictly necessary for order management, invoicing, delivery, or the requested service will be transmitted to the responsible merchant, who will act as an independent data controller with regard to the data they receive. We recommend that the user consult each merchant’s privacy policy for more information on their data processing.

10. What are your data protection rights and how to exercise them?

You can exercise, at any time:

Right of access;
Right to rectification;
Right to erasure;
Right to restriction of processing;
Right to object;
Right to data portability;
Right not to be subject to automated decisions.
Users also have the right to lodge a complaint with the National Data Protection Commission (CNPD), via www.cnpd.pt, if they believe that the processing of their personal data violates the GDPR.
Minors may only provide personal data with the consent of their legal representatives. The platform does not intentionally collect data from minors without such authorization, and any inadvertently collected data will be deleted as soon as detected.

To do so, contact:

Data Protection Officer – Municipality of Albergaria
Email: dpo@cm-albergaria.pt
Address: Praça Comendador Ferreira Tavares 3850-053 Albergaria-a-Velha.

11. How do we protect your personal data?

We adopt robust security measures:

Restricted access;
Secure and encrypted channels;
Access control and monitoring;
Regular audits;
Backup and system redundancy;
Continuous improvement policy.

12. Updates to this Privacy Policy

This Policy may be reviewed periodically. Any relevant changes will be communicated through the Albergaria Digital Commercial District website and application.