General Privacy Policy 

1. Scope and legal framework

1.1. This Privacy Policy describes how Carlos Baeta – Unipessoal, Lda (hereinafter “Miosotis Healthy Life”) processes the personal data of users of the Miosotis Healthy Life website (the “Site”), in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the “GDPR”), Portuguese Law No. 58/2019 of 8 August, which implements the GDPR in the Portuguese legal system, and Portuguese Law No. 41/2004 of 18 August, as amended. 

1.2. “Personal data” means any information relating to an identified or identifiable natural person. 

1.3. This Privacy Policy is separate from the Site’s Terms and Conditions of Use. Using the Site or accepting the Terms and Conditions of Use does not, in itself, constitute consent to any processing of personal data.

2. Data controller

2.1. The controller of the personal data collected through the Site is Carlos Baeta – Unipessoal, Lda, tax identification number 515702072, with registered office at Ribeira de Nisa, Portalegre, Portugal, who may be contacted by email at contact@miosotis.org or by telephone on +351 245 308 050. 

2.2. Given the scale and nature of the processing activities carried out, Miosotis Healthy Life is not required to appoint a Data Protection Officer (Article 37 of the GDPR) and has not done so. All privacy-related queries should be sent to the contact details set out in the preceding paragraph. 

3. Personal data processed, purposes and legal bases

3.1. Miosotis Healthy Life processes the following categories of personal data, for the purposes and on the legal bases set out below: 

(a) Technical and browsing data (for example, IP address, browser type, operating system, pages visited, and date and time of access) — collected automatically in order to ensure network and information security, ensure the proper operation and performance of the Site, and compile aggregated or anonymised statistics. Legal basis: the legitimate interest of Miosotis Healthy Life in ensuring the security and proper functioning of the Site (Article 6(1)(f) of the GDPR). Where such data is obtained through cookies or similar technologies that are not strictly necessary, the legal basis is the user’s consent (Article 6(1)(a) of the GDPR and Article 5 of Law No. 41/2004). 

(b) Newsletter subscription data (name and email address) — processed in order to send the Miosotis Healthy Life newsletter, containing information about the activities, products and services of Miosotis Healthy Life. Legal basis: consent (Article 6(1)(a) of the GDPR), given by means of a clear affirmative action (ticking an unticked box) and which may be withdrawn at any time. 

(c) Contact data and enquiries (name, email address, telephone number and message content) — processed in order to respond to enquiries submitted through the contact form or by email. Legal basis: steps taken at the user’s request prior to entering into a contract, where the enquiry concerns the products or services of Miosotis Healthy Life (Article 6(1)(b) of the GDPR); in all other cases, the legitimate interest of Miosotis Healthy Life in responding to enquiries addressed to it (Article 6(1)(f) of the GDPR). 

3.2. Miosotis Healthy Life does not use the data collected for purposes incompatible with those set out above and does not process, through the Site, any special categories of personal data (Article 9 of the GDPR). Users are asked not to include such data (for example, health data) in the messages they send. 

3.3. The data marked as mandatory in the Site’s forms is required in order to subscribe to the newsletter or for Miosotis Healthy Life to respond to the user’s enquiry. Failure to provide it only prevents the use of those features and does not affect access to the rest of the Site’s content. The provision of any other data is optional. 

4. Cookies

4.1. The Site uses cookies and similar technologies. Cookies that are strictly necessary for the Site to function do not require consent. All other cookies (for example, analytics or marketing cookies) are only placed after the user has given prior, freely given, specific and informed consent, in accordance with Article 5 of Law No. 41/2004, as amended. 

4.2. On the user’s first visit to the Site, a banner is displayed allowing the user to accept or reject non-essential cookies with equal ease, as well as to set preferences by category. Consent may be withdrawn or changed at any time via the “Cookie settings” link in the Site’s footer. 

4.3. Details of the cookies used, including their purpose, duration and the party responsible for them, are set out in the Site’s Cookie Policy. 

5. Marketing communications

5.1. Miosotis Healthy Life only sends marketing communications by email to users who have given their prior and express consent, in accordance with Article 13-A of Law No. 41/2004. 

5.2. Each communication identifies Miosotis Healthy Life as the sender and includes a link allowing the user to unsubscribe simply and free of charge. Consent may also be withdrawn at any time using the contact details set out in clause 2.1. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal. 

5.3. Miosotis Healthy Life does not transfer or make users’ email addresses available to third parties for those third parties’ own marketing purposes. 

6. Retention periods

6.1. Personal data is kept only for as long as necessary for the purposes for which it was collected, as follows: 

(a) Newsletter subscription data: until consent is withdrawn or the subscription is cancelled, and deleted within 30 days thereafter. Records of consent and of its withdrawal are kept for as long as necessary to demonstrate compliance with the law (Article 7(1) of the GDPR). 

(b) Contact data and enquiries: for 12 months after the last interaction with the user, unless the enquiry gives rise to a contractual relationship, in which case the retention periods applicable to that relationship apply. 

(c) Technical and browsing data: for a maximum of 12 months, without prejudice to its retention in aggregated or anonymised form for statistical purposes. 

(d) Data whose retention is required by law (for example, accounting and tax records): for the period required by law. 

6.2. Once the retention periods have expired, the data is securely deleted or irreversibly anonymised.

7. Recipients and processors

7.1. Personal data is accessed only by those Miosotis Healthy Life staff who need it to perform their duties, and who are bound by a duty of confidentiality. 

7.2. Miosotis Healthy Life uses service providers that process personal data on its behalf, as processors, under contracts that comply with Article 28 of the GDPR, namely: 

(a) https://www.hostinger.com/, provider of hosting and of the Site’s management platform; 

(b) https://www.hostinger.com/, for sending the newsletter; 

(c) IT, maintenance and accounting service providers, strictly to the extent necessary. 

7.3. Personal data is not sold. Other than to the processors listed above, data may only be disclosed to third parties where: 

(a) this is necessary to comply with a legal obligation, a court order or a lawful request from a public authority; 

(b) this is necessary to prevent fraud or unlawful use of the Site, on the basis of the legitimate interest of Miosotis Healthy Life; 

(c) this is necessary for the establishment, exercise or defence of legal claims; or 

(d) the user has given specific consent to such disclosure.

8. International transfers

8.1. Hostinger (https://www.hostinger.com) is based in the United States of America, a third country in relation to the European Economic Area. Transfers of personal data to that entity take place under the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), where the entity is certified, or, failing that, on the basis of the Standard Contractual Clauses adopted by the European Commission (Commission Implementing Decision (EU) 2021/914), in accordance with Chapter V of the GDPR. 

8.2. Hostinger and its sub-processors may process personal data in other countries outside the European Economic Area. In such cases, transfers are made to countries covered by a European Commission adequacy decision or on the basis of the Standard Contractual Clauses adopted by the European Commission (Commission Implementing Decision (EU) 2021/914), in accordance with Chapter V of the GDPR. 

8.3. Users may obtain further information about these safeguards, or a copy of them, using the contact details set out in clause 2.1.

9. Security

9.1. Miosotis Healthy Life implements technical and organisational measures appropriate to the risk, designed to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services, as well as the ability to restore the availability of and access to personal data in a timely manner in the event of a physical or technical incident (Article 32 of the GDPR).

10. Automated decision-making

10.1. Miosotis Healthy Life does not take decisions based solely on automated processing, including profiling, which produce legal effects concerning users or similarly significantly affect them.

11. Children

11.1. The Site is not directed at children under the age of 13. Under Article 8 of the GDPR and Article 16 of Law No. 58/2019, the personal data of children under the age of 13 may only be processed on the basis of consent if that consent is given by the holders of parental responsibility. 

11.2. Anyone who becomes aware that a child under the age of 13 has provided personal data without such consent should contact Miosotis Healthy Life using the contact details set out in clause 2.1, so that the data can be deleted. 

12. Data subjects’ rights

12.1. Under the terms and conditions laid down in the GDPR, users have the following rights in relation to their personal data: 

(a) the right of access to their personal data and to information about how it is processed; 

(b) the right to rectification of inaccurate or incomplete data; 

(c) the right to erasure (the “right to be forgotten”), in the cases provided for by law; 

(d) the right to restriction of processing, in the cases provided for by law; 

(e) the right to data portability, where processing is based on consent or on a contract and is carried out by automated means; 

(f) the right to object, at any time, on grounds relating to their particular situation, to processing based on legitimate interests; 

(g) the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal; 

(h) the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them; 

(i) the right to lodge a complaint with the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados – CNPD), Avenida D. Carlos I, n.º 134, 1.º, 1200-651 Lisbon, Portugal, www.cnpd.pt, or with the supervisory authority of the Member State of their habitual residence, place of work or place of the alleged infringement; 

(j) the right to an effective judicial remedy against Miosotis Healthy Life in the event of an infringement of these rights. 

12.2. Right to object to direct marketing: users have the right to object, at any time and without having to give reasons, to the processing of their personal data for direct marketing purposes, including profiling to the extent that it is related to such direct marketing. Once this right has been exercised, the data will no longer be processed for that purpose (Article 21(2) and (3) of the GDPR). 

13. Exercising your rights

13.1. These rights may be exercised free of charge by emailing contact@miosotis.org or by using the Site’s contact form, clearly stating the nature of the request. 

13.2. Miosotis Healthy Life will respond within one month of receiving the request. That period may be extended by a further two months where necessary, taking into account the complexity and number of requests, in which case the user will be informed of the extension and the reasons for it within one month of receipt of the request. 

13.3. Miosotis Healthy Life may request any additional information strictly necessary to confirm the identity of the person making the request. Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, Miosotis Healthy Life may charge a reasonable fee or refuse to act on the request, in accordance with Article 12(5) of the GDPR.

14. Personal data breaches

14.1. In the event of a personal data breach, Miosotis Healthy Life will notify the CNPD without undue delay and, where feasible, no later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons (Article 33 of the GDPR). 

14.2. Where the breach is likely to result in a high risk to the rights and freedoms of the users affected, they will also be informed without undue delay (Article 34 of the GDPR).

15. Changes to this Privacy Policy

15.1. This Privacy Policy may be updated to reflect changes in processing practices or legal requirements. The current version is published on the Site, together with the date of the last update. 

15.2. Material changes affecting the processing of data already collected will be communicated directly to the users affected and, where processing is based on consent and the law so requires, fresh consent will be sought.