In accordance with current data protection regulations, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), Law No. 58/2019 of 8 August on Personal Data Protection and the guarantee of digital rights, and other related laws and regulations, we inform you about this Privacy Notice.

The data controller is BANEMA, SA (hereinafter, BANEMA ), with tax identification number 501759115, headquartered at Rua de Santa Marinha, n.º 511, 4585-813 Paredes.

We have detailed information about how BANEMA , as the data controller, handles your personal data.

BANEMA ensures that the personal data you will have access to is:

(i) subject to lawful, fair and transparent treatment;

(ii) used only for the purposes for which they are collected and,

(iii) processed in a manner that ensures their security, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, by adopting appropriate technical or organizational measures.

Personal data is any information about an identified or identifiable natural person.

For the purposes set out in this Privacy Notice, the controller collects and processes the personal data explained in each type of processing, which will depend on the different services you request or the contractual relationship you have with our entity.

BANEMA is committed to treating you with complete confidentiality and implementing appropriate physical, technical, and organizational security measures to protect your personal data.

The provider guarantees and is responsible, in any case, for the veracity, accuracy, validity, and authenticity of the personal data provided and undertakes to keep it duly updated.

• Data provided directly by you: through the access forms available on our website (Information Request, Contact, Checkout, Banema Studio Newsletter Subscription).

• Data associated with incomplete purchase processes: as part of using the Banema Studio website, personal data entered by the user during the purchase process (checkout) may be collected, when they add products to the cart but do not complete the transaction (email address and other contact information voluntarily provided during the purchase process).

• Data indirectly provided about you: through your browsing, different cookies may be installed in accordance with our Cookie Notice. Only those cookies that are technical or strictly necessary for the operation of the Site will be installed (other cookies will only be installed if you give us your prior and express consent to do so through the corresponding cookie settings panel).

• Identification information: name, address, landline or mobile phone number, email address.

• Economic and financial information: bank account or credit card.

• Data relating to transactions , products and services delivered.

• Data related to commercial interactions: data associated with products added to the shopping cart, checkout process status, and any contact information provided by the user during the purchase process, when it is not completed.

• Browsing and online behavior data: IP address and behavioral habits on our website (e.g., how you navigate through the different sections of the website) if you have accepted the use of cookies and other similar technologies; ISP data (domain of the provider that gives access to the network) and the date and time associated with access.

Please note that not all data categories listed above are used for all processing activities outlined in this Privacy Notice. The following section (“For what purpose and with what legal basis do we process your data?”) describes the different data processing activities carried out by BANEMA , indicating their purposes and the respective legal bases of legitimacy, and details which ones...
Specific categories of data are used.

Furthermore, we inform you in the following section that when a category of personal data is associated with a specific processing activity, this does not mean that each and every piece of data included in that category will always be used when said processing is carried out. Indeed, and by application of the legal principle of data minimization, this personal data will only be used to the extent that, depending on the circumstances of each specific case, it is adequate and relevant for the fulfillment of the purpose assigned in this Privacy Notice to the corresponding processing activity.

In this subsection, we refer to treatments whose legal basis lies in the fact that they are necessary to perform your contractual relationship with BANEMA .

Below are the data processing activities we may carry out with your information for the purpose described above:

• Execution of Commercial Contracts;

• Sending a newsletter with news and promotions for Banema Studio products;

• Response to a request for information;

• Management and execution of online orders.

• Management of incomplete purchase processes (abandoned shopping cart).

For this purpose, we may process personal data corresponding to the following categories, detailed in subsection 3.2 of this Notice, without prejudice to the application of the data minimization principle.

Your personal data will be kept for the duration of your contractual relationship with BANEMA . Once this relationship ends, the data will be blocked in accordance with applicable regulations, which implies the identification and reservation of the data, adopting technical and organizational measures to prevent its processing, except for the formulation, exercise or defense of legal claims or to make them available to Judges and Courts, the Public Prosecutor's Office or the competent Public Administrations, for the purpose of addressing or collecting any liabilities arising from the processing and only during the legal limitation periods thereof. After these periods, your personal data will be deleted.

In this subsection, we refer to the processing of your personal data that we will only carry out if we have requested and obtained your prior consent for this purpose.

Please note that the aforementioned consent is revocable, meaning you can withdraw it at any time, and BANEMA will then cease processing your data. However, withdrawing consent will not have retroactive effects and will therefore not affect the legality of processing carried out previously. To revoke or withdraw any consent you have given us, if applicable, please contact us at: marketing@banema.pt.

The processing of your personal data that we may carry out if we have requested and obtained your prior consent to do so is detailed below:

By subscribing to our Newsletter, we will process your personal data to manage your subscription, including sending you personalized information about our products or services. Similarly, we may offer you information about BANEMA products and services.

To that end, we may process personal data corresponding to the following categories detailed in subsection 3.2 of this Policy, without prejudice to the application of the data minimization principle: Identification data (name and email address).

When you contact us through the “Contact” form available on our website ( https://banema.pt/pt/contactos ), we will process your personal data to manage your request and information and to be able to respond to you.

To that end, we may process personal data corresponding to the following categories detailed in subsection 3.2 of this Policy, without prejudice to the application of the data minimization principle: Identification data (name, location, company (if applicable), email address, landline or mobile phone number and message).

The personal data collected and processed is kept, fulfilling its purpose and respecting the applicable legal deadlines.

In cases where no legal deadline applies regarding the retention and storage of personal data, such data will only be stored and retained for the appropriate period and to the extent necessary, considering the purposes for which it was collected, unless, at any time, the data subject, within the legal limits, exercises their rights of objection, limitation, erasure, or withdrawal of their consent.

BANEMA may share your personal data with third-party entities, who will have access to it. These third-party entities include public authorities, partners, suppliers, service providers, among others. In the course of its business, BANEMA may use subcontractors who will access and process your personal data in accordance with BANEMA 's instructions. BANEMA guarantees that such subcontractors offer sufficient guarantees of implementing appropriate technical and organizational measures so that the processing meets the requirements of the GDPR and other applicable legislation, as well as ensuring the protection of the rights of data subjects. Thus, BANEMA may also share your personal data when such sharing is necessary or appropriate under applicable law, to comply with legal obligations to which it is bound, to respond to requests from public authorities, in cases where the vital interests of the data subject or a third party are at stake, for the protection of BANEMA 's rights and property, or when you have given us your prior consent.

The activity conducted by BANEMA may involve the transfer of your personal data to third countries – located outside the European Union or that do not belong to the European Economic Area – even if this occurs occasionally and always in relation to other services used by BANEMA . In such situations, all necessary and appropriate measures will be taken to guarantee the protection of your personal data.

One such situation arises in the context of BANEMA 's presence on social media, where it has limited influence over the data processing carried out by the operators of these networks (for example, member management and general information management). In situations where we have no influence, we try to ensure, as far as possible, that social media operators act in accordance with the privacy and data protection requirements of the GDPR. However, in many cases, we have no influence whatsoever over this data processing carried out by the operators and we do not have clear knowledge of the data being processed on certain occasions.

Social network operators manage the entire IT infrastructure of the service, applying their own privacy and data protection rules, and also maintain their own relationships with users (insofar as they are registered users on the social network). Furthermore, the operators are fully responsible for all matters relating to user profile data, to which BANEMA has no access.

• Facebook: https://pt-br.facebook.com/privacy/policy/
• X: https://x.com/pt/privacy
• Instagram: https://privacycenter.instagram.com/policy
  
• LinkedIn: https://en.linkedin.com/legal/privacy-policy
• Pinterest: https://policy.pinterest.com/en-us/privacy-policy

The GDPR grants you the following rights regarding the processing of your data:

• Right to information: You have the right to be informed in a concise, transparent, intelligible, and easily accessible manner, using clear and simple language, about the use and processing of your personal data.

• Right of access: You have the right to request from us, at any time, confirmation of whether we are processing your personal data, access to it and information about its processing, and a copy of said data. The copy of your personal data that we provide to you will be free of charge, although requests for additional copies may be subject to a reasonable fee based on administrative costs. We may also ask you to verify your identity or request further information necessary to process your request.

• Right to rectification: You have the right to request the rectification of inaccurate, outdated, or personal data.
incomplete information concerning you. You may also request that incomplete personal data be completed, including by means of an additional statement.

• Right to erasure: You have the right to request the erasure of your personal data when, among other reasons, the data is no longer necessary for the purposes for which it was collected. However, this right is not absolute, so BANEMA may continue to keep them properly blocked in the cases provided for in the applicable regulations.

• Right to restrict processing: You have the right to request that we restrict the processing of your personal data, which means that we can continue to store it, but not continue to process it if any of the following conditions are met: for example, when you contest the accuracy of the data, for a period that allows the controller to verify its accuracy;

The processing is unlawful and objects to the deletion of the data and instead requests the restriction of its use;

Our organization no longer needs the data for processing purposes, but you need it for formulating, exercising, or defending claims.

He objected to the processing while we verify whether our organization's legitimate reasons prevail over his.

• Right to data portability: You have the right to have your data transmitted to another data controller in a structured, commonly used and machine-readable format. This right applies when the processing of your personal data is based on consent or the performance of a contract and this processing is carried out by automated means.

• Right to object: This right allows you to object to the processing of your personal data, including profiling. We will only be unable to exercise your right when processing your data if we can demonstrate legitimate grounds for the processing or for establishing, exercising or defending legal claims.

• Right not to be subject to automated decisions, including profiling: This right allows you not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly affects you. Unless such a decision is necessary for the performance or execution of a contract, is authorized by law or is based on consent.

• Right to withdraw consent: In cases where we have obtained your consent to process your personal data in relation to certain activities (for example, for the purpose of sending commercial communications), you may withdraw your consent at any time. In this case, we will cease carrying out that specific activity for which you previously consented, unless there is another reason that justifies the continued processing of your data for those purposes, in which case we will notify you of this situation.

• Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with the National Data Protection Commission, Avenida D. Carlos I, 134, 1º, 1200-651, Lisbon, Portugal, ( https://www.cnpd.pt/ ), or at the email address: https://www.cnpd.pt/cidadaos/participacoes/geral/ .

You can exercise the above rights by sending an email to marketing@banema.pt, providing the necessary information to process your request.

Those interested can obtain additional information about their rights on the website of the National Data Protection Commission, https://www.cnpd.pt/ .

BANEMA uses various security measures, including authentication tools, encryption, and digital certificates to help protect and maintain the security, integrity, and availability of your personal data.

Although data transmission over the internet or website cannot guarantee complete security against intrusions, BANEMA and its service providers and business partners make every effort to implement and maintain physical, electronic, and procedural security measures designed to protect the personal data of Data Subjects in accordance with applicable data protection requirements.

This Privacy Notice may be updated or changed at any time without prior notice.

All updates to the Privacy Notice will be communicated via a notice on our website: https://banemastudio.pt/ so that such changes can be immediately understood.