Carmine Logo

PRIVACY POLICY


1. Framework

CARMINE D-SERVICES, UNIPESSOAL, LDA., with registered office at Rua das Cabanas, n.º 1, lote 2 – Esc. A, 4700-048 Braga, registered with the Commercial Registry under the single registration and corporate number 510491766, is responsible for the processing of your personal data (hereinafter "CARMINE D-SERVICES").

At CARMINE D-SERVICES, the privacy and protection of the personal data of its customers and of other data subjects to which CARMINE D-SERVICES has access and on which it carries out processing are fundamental.

Respect for the fundamental principles of personal data protection and compliance with applicable legislation constitute a fundamental commitment of CARMINE D-SERVICES.

2. Principles

CARMINE D-SERVICES, with regard to the processing of personal data, complies, among others, with the following principles:

  • Principle of lawfulness: personal data will only be processed in accordance with applicable legislation, that is, to the extent that at least one of the following circumstances legitimising the processing is verified: (i) when consent (free, unambiguous and informed and, whenever required, explicit) has been given by the data subject for the processing, when the processing is necessary for (ii) the performance and management of a contract, (iii) the carrying out of pre-contractual steps for the conclusion of a contract requested by the data subject, (iv) compliance with a legal obligation, (v) the pursuit of a legitimate interest of the controller, or of third parties, and a balancing assessment has been carried out allowing the conclusion that such interest does not override the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data; or (vi) the establishment, exercise or defence of a legal claim in judicial proceedings, or whenever courts act in the exercise of their judicial function.

  • Principle of good faith and purpose limitation: personal data will be collected and processed for specific purposes, processed for the purposes determining their collection and will only be processed for different purposes when this is legally permitted and proves necessary, by providing information to the respective data subject;

  • Principle of data minimisation and storage limitation: only personal data that are adequate, relevant and not excessive will be processed and for the period of time strictly necessary for the pursuit of the purposes determining the respective processing or, where applicable, until the exercise of the right to object or the withdrawal of the consent given by the data subject;

  • Principle of transparency: data subjects will be informed in a transparent manner about the main characteristics and protection measures of their personal data, namely regarding the respective processing purposes and any transmission to third parties;

  • Principle of confidentiality: only employees and partners whose functions require it will have access to the personal data processed.

3. Personal Data

Personal data processed by CARMINE D-SERVICES

Personal data is any information, of any nature and on any durable medium, relating to an identified or identifiable natural person.

An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, online identifiers, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

CARMINE D-SERVICES only collects and processes the personal data necessary for the provision of the services and/or products requested by you or for the offer thereof, seeking to ensure the quality and personalisation of the service provided and the products offered. CARMINE D-SERVICES does not process personal data that are not necessary for the agreed provision of services, the products purchased or their offer.

In the provision of services and the offer of products, CARMINE D-SERVICES processes various categories of personal data (as regards special categories of data, only if consent has been obtained for that purpose), including:

  • A. Data relating to personal characteristics (e.g. nationality);

  • B. Economic, financial and insurance / commercial data (e.g. account number, IBAN);

  • C. Unique identifiers (e.g. name, address, telephone number, email address, citizen card number, tax identification number);

  • D. Academic and professional data (e.g. profession, employer);

  • E. Data relating to goods and services (e.g. vehicle registration number);

  • F. Data relating to social circumstances (e.g. marital status).

Collection

This Privacy Policy applies to the personal data of potential customers/customers of CARMINE D-SERVICES and of other data subjects to which CARMINE D-SERVICES has access, collected through the digital channels of CARMINE D-SERVICES, upon subscription to products or services, completion of the forms available on the websites, email, as well as in person.

CARMINE D-SERVICES may also process the personal data of its customers' customers. Such data are collected directly by the customers of CARMINE D-SERVICES, and the respective collection and transmission are the responsibility of those customers. Such data include, namely: name, unique identifiers, contact data and billing data.

If you use a third-party service (for example, Google) to create your account on Carmine.pt, we will receive your personal data through the said third-party service, based on your consent given when using this account creation service.

When you request information about products or services offered on Carmine.pt through a third-party website, by giving your informed consent for that purpose, that third party will send us your identification and contact data so that we can manage your information request.

Processing

CARMINE D-SERVICES only processes your personal data in the following situations:

  • A. For the provision of the requested service (to allow registration as a user through "My Account") and for the performance of a contract with the data subject, including the carrying out of pre-contractual steps at their request (contact requests);

  • B. For compliance with legal obligations to which CARMINE D-SERVICES is subject;

  • C. For the satisfaction of legitimate interests of CARMINE D-SERVICES, namely to improve the quality of the service provided, or for the management of the websites, always balancing the interests, rights and fundamental freedoms of the data subject;

  • D. To meet your choices, when you have given your prior consent for that purpose and such consent is free, informed, specific and unambiguous (for example for sending newsletters or marketing communications).

CARMINE D-SERVICES processes the personal data of data subjects for determined, explicit and legitimate purposes, and such data may not subsequently be processed in a manner incompatible with those purposes, except under the conditions expressly permitted or imposed by law.

4. Transmission of personal data to other entities

In order for CARMINE D-SERVICES to fulfil all its duties and to provide and offer you quality services and products, it may need to communicate your personal data, or give access to them, to other entities.

CARMINE D-SERVICES will only transmit your personal data to the following categories of recipients:

  • Santander Group, for the purpose of carrying out pre-contractual steps at your request, more specifically to Santander Consumer Finance, S.A. - Sucursal em Portugal for financing purposes;

  • Advertisers of the vehicles on Carmine.pt, if you have requested information about a vehicle. The advertiser will contact you (by telephone, SMS, email, or WhatsApp);

  • Auditors, in compliance with obligations arising from the monitoring and follow-up of the activity of CARMINE D-SERVICES;

  • Courts and judicial authorities, in the context of judicial proceedings and litigation;

  • Subcontractors of CARMINE D-SERVICES for the processing of personal data for various purposes, such as legal advisory services, supplier approval, technology service providers, or call centre entities.

In cases of international transfers (outside the European Union), whenever the European Commission has declared, through an adequacy decision, that the country located outside the European Union in question ensures a level of personal data protection equivalent to that resulting from European Union legislation, the transfer of data will be based on that adequacy decision. You may consult the existing adequacy decisions at www.eur-lex.europa.eu.

In cases where the transfer is made to countries or organisations located outside the European Union, in respect of which there is no adequacy decision by the European Commission, CARMINE D-SERVICES will introduce safeguards to ensure the protection of your data (namely, the introduction of standard contractual clauses or codes of conduct).

5. Rights of Data Subjects

Under applicable law, data subjects have the rights indicated below, which may be exercised through the following channels: written communication to the Data Protection Officer (DPO) via the email address dadospessoais@santanderconsumer.pt, or by letter sent to the address indicated above.

In cases where the processing of data is based on your consent, you may withdraw your consent at any time, through one of the available channels.

If you withdraw your consent, your personal data will no longer be processed, except if there is another basis justifying such processing, such as the contract, legal obligations or the legitimate interest of CARMINE D-SERVICES.

A. Right of access

Whenever you request it, you may obtain confirmation as to whether your personal data are processed by CARMINE D-SERVICES.

You may also access your personal data, as well as obtain the following information:

  • (i) The purposes for which your personal data are processed;

  • (ii) The type of personal data that are processed;

  • (iii) The entities to whom your personal data may be communicated, including entities located in countries outside the European Union or international organisations, in which case you will be informed of the safeguards applied to the transfer of your data and the means of obtaining a copy of them, or where they have been made available;

  • (iv) The retention period of your data or, if this is not possible, the criteria for determining that period;

  • (v) The rights you have in relation to the processing of your personal data;

  • (vi) If the personal data were not collected from you, information about their origin and the type of data in question;

  • (vii) The existence of automated individual decision-making, including profiling and, in that case, information about the logic underlying such processing, as well as about the significance and envisaged consequences for you.

B. Right to rectification

Whenever you consider that your personal data (objective personal data provided by you) are incomplete or incorrect, you may request their rectification.

C. Right to erasure

The data subject has the right to obtain from CARMINE D-SERVICES the erasure of their data in the cases and for the reasons provided for by law. CARMINE D-SERVICES is subject to legal obligations which may limit the right to erasure of your personal data.

The right to erasure does not apply, namely, when the processing is necessary for the following purposes:

  • (i) Exercise of freedom of expression and information;

  • (ii) Compliance with a legal obligation requiring processing that applies to CARMINE D-SERVICES;

  • (iii) Reasons of public interest in the area of public health;

  • (iv) Archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, to the extent that the exercise of the right to erasure would seriously impair the achievement of the objectives of such processing; or

  • (v) The establishment, exercise or defence of legal claims in judicial proceedings.

Having regard to the above, you will have the right to request and obtain the erasure of your personal data when one of the following situations occurs:

  • (i) The personal data are no longer necessary for the purpose that motivated their collection or processing;

  • (ii) You withdraw the consent on which the processing is based and there is no other legal basis for such processing;

  • (iii) You object to the processing of the data in cases where the law grants such right of objection and there are no overriding legitimate interests, to be assessed on a case-by-case basis, that justify the processing;

  • (iv) The personal data must be erased pursuant to a legal obligation to which CARMINE D-SERVICES is subject; or

  • (v) The personal data were collected in the context of the direct offer of information society services.

D. Right to restriction of processing

Restriction of processing allows the data subject to request the controller to limit the scope of processing to certain categories of data, or processing purposes, or to suspend processing activities in the cases and conditions provided for by law.

You may request the restriction of the processing of your personal data in the following cases:

  • (i) If you contest the accuracy of your personal data, for a period enabling CARMINE D-SERVICES to verify their accuracy;

  • (ii) If CARMINE D-SERVICES no longer needs the personal data for processing purposes, but such data are necessary for the establishment, exercise or defence of legal claims in judicial proceedings; or

  • (iii) If you have objected to the processing, until it is verified that the legitimate interests of CARMINE D-SERVICES override yours.

E. Right to data portability

You may request CARMINE D-SERVICES to provide the personal data supplied by you in a structured, commonly used and machine-readable format. You also have the right to request that CARMINE D-SERVICES transmit such data to another controller, provided that this is technically feasible.

The right to data portability applies only in the following cases:

  • (i) When the processing is based solely on the consent of the data subject or on the performance of a contract; and

  • (ii) When the processing in question is carried out by automated means.

F. Right to object

You have the right to object to the processing of your personal data at any time, for reasons related to your particular situation, in the following situations and conditions:

  • (i) When the processing is based on the legitimate interest of CARMINE D-SERVICES; or

  • (ii) When the processing is carried out for purposes other than those for which the data were collected, but which are compatible with them.

In such cases, CARMINE D-SERVICES will cease processing your personal data, unless it has legitimate reasons for carrying out such processing and these override your interests.

You may also object to the processing of your data for direct marketing purposes, including profiling related to such marketing.

6. Supervisory Authority

The Portuguese Data Protection Authority (CNPD) will act as the supervisory authority in matters of data protection. You have the right to lodge complaints with the CNPD at https://www.cnpd.pt/cidadaos/participacoes.

7. Duties of Data Subjects

Data subjects must undertake to update their information whenever there is a change to their personal data.

8. Retention Period

The period of time during which personal data are retained varies according to the purpose for which the information is processed.

Whenever there is no specific legal requirement, personal data will be retained only for the minimum period necessary for the purposes that motivated their collection.

9. Contacts

For clarification of any matter relating to this Privacy Policy or the exercise of your rights, you may contact the Data Protection Officer (DPO) by written communication, via the email address dadospessoais@santanderconsumer.pt, or by letter addressed to CARMINE D-SERVICES, UNIPESSOAL, LDA., Rua das Cabanas, n.º 1, lote 2 – Esc. A, 4700-048 Braga.

10. Revisions to the Privacy Policy

CARMINE D-SERVICES reserves the right to make changes or revisions to this Privacy Policy at any time.

December 2024 version