Data Protection and Privacy Policy
Pursuant to the General Data Protection Regulation (Regulation (EU) No 2016/679 of the European Parliament and of the Council of 27 April 2016, hereinafter “GDPR”) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and to Portuguese law, namely Law No. 58/2019 of 8 August 2019 ensuring the implementation of the GDPR into national law, the purpose of this Privacy Policy is to provide information to the data subjects who, in any way, interact with Portugal Capital Ventures – Sociedade de Capital de Risco, S.A. (hereinafter referred to as Portugal Ventures), in particular through its website, with the most relevant information regarding the protection of their personal data, including their rights and how such rights may be exercised, including, in general, what personal data is collected, how it is processed, the purposes for data processing, the related legal bases, and storage periods.
The terms “Personal Data”, “Processing”, “Controller”, “Processor”, “Data Protection Officer”, “Recipient”, “Consent”, and “Supervisory Authority” are used in accordance with the definitions provided for under the GDPR.
Controller – Identity and Mission
Portugal Capital Ventures – Sociedade de Capital de Risco, S.A., with its registered office at Avenida Dr. Antunes Guimaraes, n,º 103, 4100-079 Porto and offices at Edifício Arcis, located on Rua Ivone Silva, n.º6, 12º, 1050-124 Lisbon, registered at the Porto Companies Registration Office under unique registration and company number 502 206 128, with a share capital of €40,412,650.00, is the Data Controller responsible for processing your personal data and can be contacted via the following e-mail address: contact@portugalventures.pt.
Founded in June 2012, Portugal Ventures plays a key role in the financing and growth of the Portuguese entrepreneurship ecosystem. Today, Portugal Ventures is part of the public business sector and heads public venture capital investment, operating under the same terms and conditions that apply to private companies and subject to the general national and Community competition rules.
Under this Data Protection and Privacy Policy, Portugal Ventures undertakes, namely, to comply with the need to securely process your personal data and to protect your privacy. With regard to the Portugal Ventures website, we recommend that you read the available “Cookie Policy”, which contains all necessary information for users.
Data Protection Officer
Portugal Ventures has appointed a Data Protection Officer (hereinafter referred to as DPO) who can be contacted in writing at dpo@portugalventures.pt or by sending a letter addressed to the DPO to Portugal Ventures’ registered office.
What is personal data?
Personal data is any information of any kind and in any form related to an identified or identifiable natural person. An identifiable natural person is an individual who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
The following is considered to be sensitive personal data and requires more specific processing conditions: personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs; trade union membership; genetic data; biometric data processed solely to identify a human being; health-related data; and data concerning a person’s sex life or sexual orientation.
Who are the data subjects and what data is processed?
A data subject is any individual person to whom the personal data relates and who, in any way, engages with Portugal Ventures in connection with the pursuit of its business activity, such as employees, trainees, candidates or prospective employees, consultants, experts, auditors, members of the governing bodies, shareholders, participants of the venture capital funds under management and/or partners, service providers, participants in initiatives, investment applicants and website users.
Website users are solely responsible for the personal data they provide. Portugal Ventures only collects information provided by users voluntarily.
Regarding the use of the website, including submission of the contact form or registration forms for initiatives led by Portugal Ventures, the following types of personal data may be collected: identification (name, age, gender, nationality), background and experience, and contact information (e-mail and telephone, address), information related to the accessing system (IP address), other data you specifically provide when filling in the contact form or the initiative registration form(s), and also connection and website activity logs.
By way of example, Portugal Ventures processes the following personal data as part of its business management activities:
– identification data (name, marital status, gender, civil, tax and social security identification numbers, nationality, date of birth, bank details, proof of income, household data, academic qualifications, health data);
– contact details (address, telephone number, e-mail address);
– interests (hobbies, physical and/or leisure activities);
– electronic interaction data (IP address, mobile device identifiers); and
– other data necessary, appropriate and suited to the pursuit of its business, including compliance with its legal obligations, namely with respect to the Tax and Customs Authority, Social Security, the Caixa Geral de Aposentações pension scheme, the Portuguese Securities Market Commission (CMVM), the Coordination Committee for Anti-Money Laundering Policies and Countering Terrorist Financing, and other official bodies.
As the Controller, Portugal Ventures assures that the personal data it has access to is:
- processed lawfully, fairly and in a transparent manner in relation to the data subject;
- collected solely for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes, except with respect to further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes;
- adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed;
- accurate and, where necessary, kept up to date, taking every reasonable step to ensure that personal data that is inaccurate, having regard to the purposes for which it is processed, is erased or rectified without delay;
- stored only for the period necessary for the purposes for which it is processed;
- processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
Personal data collected by the website via the contact form is forwarded to an e-mail address so that incoming requests can be replied to and registered/incorporated in a back-office file controlled by Portugal Ventures. Personal data collected in connection with subscriptions to the newsletter is registered/stored in the MailChimp app. Personal data collected by the website via the Portugal Ventures initiative registration form(s) is forwarded to an e-mail address and simultaneously registered/incorporated in an automated file controlled by Portugal Ventures, stored and consulted internally only by validated and duly authorised users.
If you share confidential information with Portugal Ventures, by filling in the website contact form or the Portugal Ventures initiative registration form, or by any other means, rest assured that the contents of the request and all related information will be kept absolutely and strictly confidential, save the disclosure of information that Portugal Ventures requires to pursue its business activity and to respond to the request, namely to employees, consultants, auditors, external national and international experts who are part of the evaluation panels, members of the governing bodies, shareholders, participants of the venture capital funds under management and/or partners.
For the purposes of complying with its duty of confidentiality as described above, information deemed as confidential is all information submitted via the website contact form or the Portugal Ventures initiative registration form, provided you have expressly indicated in the request that the information is confidential.
Use, purpose and legal basis for the processing of personal data collected and storage periods
| Purpose | Legal Basis | Storage Period |
| Management and handling of requests received via the website contact form or contact e-mails. |
Depending on the request you submit: Legitimate interest of the Controller in responding to requests received. Management of pre-contractual and contractual relationships if the request is linked to a potential business relationship. Recruitment management. |
Until one year has lapsed after the reply to the request, if the request is considered fulfilled or where no subsequent contact has been made following the reply, or until the request has been converted in a separate procedure. In the latter case, the storage period appropriate for the type of data processing concerned will apply. |
| Management of the relationship with the attendees and participants of the initiatives promoted by Portugal Ventures. |
Legitimate interest of the Controller.
|
Until two years have lapsed after the initiative concerned has been held, or until the project submitted has been converted into an investment by Portugal Ventures or a partnership. In this case, the rules and deadlines appropriate to the resulting business relationship will apply. |
| Sending of newsletters and marketing communications, and providing information and content related to Portugal Ventures’ business activities. |
Consent. Legitimate interest of the Controller in developing and disclosing its business activity with a view to growth and consolidation. |
Until consent is withdrawn. |
| Personalising the user experience and improving performance of the website. | Consent. | According to the Cookie Policy and type of associated cookie. |
| Management of digital platforms, including development, improvement, introducing new features, and monitoring information security. | Legitimate interest of the Controller. | Applicable legal deadlines, or limitation periods associated to the legal obligations concerned. |
| Compliance with legal obligations by the Controller, including fraud and corruption prevention, misuse and money laundering. |
Compliance with statutory obligations.
Legitimate interest of the Controller.
|
The legal or regulatory deadlines, or limitation periods, stipulated in connection with the legal obligations concerned. |
| Drawing up of statistical reports | Legitimate interest of the Controller. | Legal deadlines accepted for data processing for statistical purposes. |
|
Management of labour relations and recruitment processes.
|
Performance of a contract. Compliance with legal obligations.
|
Established legal deadlines, set between 1 and 5 years. Data on contribution statements for pension or retirement purposes may be stored indefinitely to help provide a history of contribution periods. |
| Management and handling of contractual and pre-contractual relationships or partnerships/collaborative relationships. |
Performance of a contract or agreement. Compliance with legal obligations. |
Legal deadlines stipulated on a case-by-case basis. |
Recipients and transmission of personal data
In addition to complying with legal obligations, personal data may also be transmitted to official bodies and may also be processed by processors outsourced by Portugal Ventures, where legally required or contractually necessary. Only the data necessary for these entities to perform the requested service is transmitted.
Portugal Ventures undertakes to ensure that the processors it outsources provide sufficient guarantees to implement appropriate technical and organisational measures such that the processing of personal data meets the requirements of the GDPR and to ensure the protection of the rights of the data subjects.
If requests received via the contact form or the information provided in the Portugal Ventures initiative registration form are related to a pre-contractual and/or contractual relationship between you and Portugal Ventures, or with assistance from Portugal Ventures in the analysis of projects submitted, the personal data you provided may be shared with partners/third parties, including entities outside the European Union, that is, third countries, for the purposes described. In this case, Portugal Ventures assures that it will only transfer personal data to countries which ensure an adequate level of protection.
In compliance with statutory obligations and for the purposes described, personal data may also be transmitted to judicial, administrative, supervisory or regulatory authorities.
Your rights
You have the right to:
- Request access to, rectify and erase your personal data and to limit processing;
- Object to the processing of your personal data;
- Receive any personal data related to you and that you provided to a Controller in a structured, commonly used and machine readable format, and to request portability of data to another controller, where technically feasible;
- Withdraw your consent at any time, where processing is based only on this legal basis;
- Lodge a complaint with the Supervisory Authority, in this case the Portuguese Data Protection Authority (CNPD).
To this end, requests should be sent in writing to the DPO to dpo@portugalventures.pt.
You can also ask the DPO for more detailed information on the processing of your personal data and submit complaints to the DPO about how your data is processed, without prejudice to your right to also lodge a complaint with the CNPD.
Personal data security
Portugal Ventures implements the appropriate and necessary security techniques and measures to protect your personal data, protecting it from misuse or unauthorised access. All personal data is processed in a strictly confidential manner, in accordance with internal security and confidentiality policies and procedures, which are updated periodically as required.
Portugal Ventures guarantees privacy and security in the transmission of website user data, using SSL (Secure Sockets Layer) encryption for all information exchanged via the website. The website is not intended for use by minors. If Portugal Ventures identifies or is informed that the data provided relates to children, it will be immediately deleted.
Personal data breach
In the event of a data breach and to the extent that such a breach is likely to result in a high risk to the rights and freedoms of data subjects, Portugal Ventures undertakes to inform you and the Portuguese Data Protection Authority (CNPD) of any data breach within 72 hours of the incident.
Pursuant to law, notification is not required in the following cases:
– Where the appropriate technical and organisational protection measures have been implemented and applied to the personal data affected by the data breach, in particular those that render the personal data unintelligible to any person not authorised to access such data, such as encryption;
Subsequent measures have been taken which ensure that the high risk to the rights and freedoms of the data subjects is no longer likely to materialise; or
– Where notifying data subjects involves a disproportionate effort, a public communication is made.
Changes to the Privacy Policy
This Privacy Policy, which is also an integral part of the Terms of Use of the Portugal Ventures website, may be amended at any time and without prior notice. New versions will be published on the website clearly indicating the date of the last update.
You should regularly read the respective Privacy Policy, Terms of Use and Cookie Policy, without prejudice to Portugal Ventures featuring significant changes on its website or informing users thereof by any other means, where warranted.
Governing Law and Jurisdiction
Without prejudice to the applicable overriding legal provisions, the District Court of Porto has exclusive jurisdiction over any disputes arising from the validity, interpretation or enforcement of the Privacy Policy or those related to the collection, processing or transmission of personal data.
Date of last update: 23 September 2021
