Preamble:

Galucho – Indústrias Metalomecânicas, SA is committed to protecting the privacy of individuals and companies that share personal data with it, striving continuously and uncompromisingly to earn the trust of data subjects in this area.

This applies to the processing of personal data of holders resident in the territory of the European Union.

Article 1

Personal data processing means any personalised communication technique using personal files or databases, with a view to establishing an interactive relationship with all natural persons who have contact with Galucho, with a clearly defined objective.

Article 2

The purpose of this is to provide information on the way how Galucho collects, uses and shares personal information from all individuals and companies who contact it, the options available to them in this regard and how they can access and correct this information if necessary.

This Policy has been developed to meet the requirements of current privacy protection legislation.

Article 3

(1) The entity responsible for the processing of personal data is Galucho.

(2) Galucho has appointed a data protection officer who may be directly contacted by letter sent to Galucho, SA, Av. Central, n.º 4, 2705-737 São João das Lampas, or by e-mail to: [email protected]

(3) We have developed and implemented internal policies and procedures designed to adequately protect the personal information in our possession, and both are reviewed regularly.

Article 4

(1) We train our employees on the importance of protecting personal information through training sessions and guidelines issued on a regular basis, which emphasise their role and their obligations in this regard.

(2) We take reasonable steps to ensure that our agents, authorised representatives, representatives, suppliers and other external organisations comply with this Policy (e.g. suppliers of services and goods, technical and administrative assistance, data storage companies, etc.).

Article 5

(1) For the purposes of this Policy, “personal information” refers to any information that permits the identification of an individual or a collective company, such as name, address, tax identification number, e-mail address, telephone contact, curriculum vitae or any medical or financial information.

(2) We collect your personal information in various ways, including when you place an order or make a simulation on our online pages, respond to employment vacancies or make a prospective application, or participate in our social networking pages.

(3) Depending on the circumstances, here are some types of personal information that may be collected:

Name;

Contact information, including telephone number, address or email address;

Tax number;

Date of birth, gender and nationality;

Interests and training preferences;

Curriculum;

Curriculum details;

Cover letter and content.

(4) Personal data to which we have access in the scope of our activity, are processed because they are necessary for the conclusion and execution of the order or simulation, for registration and applications for open vacancies, or prospective applications, registration for training, to comply with legal obligations imposed on Galucho, to pursue legitimate interests of Galucho, or because they have been the object of express consent. The omission or inaccuracy of this data or other information provided to Galucho by the natural persons who contact with it is their sole responsibility.

(5) The personal data provided by natural persons or generated by the use of the service will be processed and stored electronically, and will be used by Galucho for: disclosure of its activity to potential clients, market analysis and surveys, to find out the needs, interests and preferences of clients and to inform them about the services, advantages, equipment, promotions or characteristics that may be of interest to them, to control the quality of our activity and improve the service, for accounting, fiscal and administrative management, litigation management, revenue protection and auditing, network and systems management, information security and physical security control and compliance with legal obligations.

(6) The processing of data for the purposes of disseminating orders and the like, as well as applications for defined or prospective job vacancies, or even registrations for training will be carried out in accordance with the consent option expressed by those concerned. Consent shall be given in advance, freely, informed, specific and unambiguous, expressed in a written or oral statement or through the validation of an option. Natural persons may object to the processing of data for the purpose of dissemination of activities at any time and by any means.

(7) Personal data shall be retained for different periods of time, depending on the purpose for which they are intended and taking into account legal criteria, necessity and minimisation of retention period. In particular, they will be kept for the purpose of fulfilling legal obligations and protecting the legitimate interests of Galucho or for periods of time legally defined for the purposes of investigation and legal actions of a criminal nature, after which they will be anonymised.

(8) In the case of personal data sent for recruitment purposes, or commercial orders, the personal data will be retained for a maximum period of 2 (two) years. In all other cases, personal data will be kept for a maximum of 10 (ten) years, which Galucho considers sufficient to fulfil the purposes.

(9) At the end of the retention period, all personal data collected will be anonymised or deleted.

(10) Galucho is not responsible for the use or sharing of personal information provided by natural persons to third parties, and cannot be held responsible for their policies, procedures or practices regarding the protection of personal information.

Article 6

(1) We have implemented a combination of material, organisational and technological means to ensure the confidentiality of the personal information we hold, to protect it against loss or theft and to prevent any unauthorised access, transmission, reproduction, use or editing thereof, as well as to safeguard the principle of proportionality in access to information by imposing access profiles, which guarantee the principle that access to personal data is determined, justified and limited to the need to know it.

(2) When we share personal information with third parties, when it results from a legal or supervisory obligation, we take appropriate security measures to ensure that the entity in question complies with the commitments and rules established in this Policy.

(3) Your personal information will be stored on servers to which only Galucho has access, without prejudice to the provisions of Article 8.

Article 7

1) Upon written request and proof of identification, the data subject may consult his/her personal information collected, used or shared by us, as required or permitted by law.

(2) Access and rectification are free of charge.

(3) We will try to process requests for access or rectification of personal information, when this is not made through the Galucho website, within thirty (30) days after receipt. If it is not possible to respond within this period, the individual applicant will be notified.

(4) We make every effort so that the personal information in our possession is correct, complete and updated. However, the data subject is in a better position to inform us promptly of any changes to his/her personal information. We therefore ask you to inform us of any necessary rectifications.

(5) The data subject may request that appropriate corrections be made to the personal information held by us. If applicable, we will forward the rectified information to third parties who have access to your personal information.

6) Any comments, questions or requests for access or rectification regarding the data subject’s personal information, this Policy or our internal procedures for the protection of personal information should be sent to Galucho’s Personal Data Protection Officer (EPD):

In writing to:

EPD, Av. Central, n.º 4, 2705-737 São João das Lampas or to the e-mail address: [email protected].

We undertake to follow up any comments, questions, requests or complaints.

(7) All natural persons sharing personal data with Galucho are guaranteed the right to object, erase, limit and portability of their personal data. The exercise of these rights can be requested through the addresses listed above.

(8) An exception to the duty of erasure is the fulfilment of a legal obligation, which entitles Galucho to keep them, or for reasons of public interest.

Article 8

Galucho may use subcontractors for the purpose of processing personal data, in particular for client management, service provision, billing and litigation management, these entities being obliged to develop the appropriate technical and organisational measures for data protection and to ensure the defence of the rights of the holder. In certain circumstances, certain personal data may have to be communicated to public authorities, such as tax authorities, courts and security forces.

Article 9

Our WEBSITE, social networks and social media are not directed to minors under 13 years of age, so we request that these minors do not provide us with personal data through the WEBSITE, social networks and social media or e-mails.

Article 10

(1) Galucho would appreciate it if you did not send us or disclose any sensitive personal data, i.e. information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, except for the benefit of special conditions of access to our services, genetic information, biometric information, data concerning health or data concerning the sexual life of a natural person or sexual orientation.

(2) This personal data will be deleted immediately.

Article 11

This Policy is subject to amendment to keep pace with the rapid evolution of rules regarding the protection of personal information and privacy.

The last update to this version took place on 22 May 2020.