Responsible for processing personal data
Personal data will be processed by CAEL – Consórcio de Automóveis Excelsior, Lda, headquartered at Rua Braamcamp, No. 52 B, 1250-051 Lisbon, taxpayer number 500049947, hereinafter identified as “CAEL”.
Legislation
The processing of personal data carried out by CAEL, as well as the sending of commercial communications carried out by electronic means, are in accordance with the national and community legislation in force, Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, on the protection of individuals with regard to the processing of personal data and the free movement of such data and guidelines issued by European and national authorities, by model clauses approved by the European Commission or by supervisory authorities, as well as by any relevant jurisprudence, collectively referred to as “Data Protection Regime”, hereinafter “RGPD”.
Processing of personal data
The processing of personal data is carried out in accordance with the general principles set out in the "RGPD", namely:
• In the context of the relationship established with the data subject, we ensure that personal data will be treated in a lawful, fair and transparent manner (“Principle of lawfulness, loyalty and transparency”);
• We collect personal data for specific, explicit and legitimate purposes and do not further process the same data in a way that is incompatible with those purposes (“Purpose limitation principle”);
• We ensure that only personal data that are adequate, relevant and limited to what is strictly necessary for the purposes for which they are processed («Principle of data minimization») are processed;
• We take appropriate measures so that inaccurate personal data, taking into account the purposes for which they are processed, are erased or rectified without delay ("Principle of Accuracy");
• We keep personal data in such a way as to allow their identification only for the period necessary for the purposes for which they are processed ("Principle of conservation");
• We ensure that personal data are processed in a way that guarantees its security, including protection against its unauthorized or unlawful processing and against its accidental loss, destruction or damage, adopting the appropriate technical or organizational measures ("Principle of integrity and confidentiality').
What personal data do we handle?
In the context of the activities carried out by CAEL, the Data Subject is, without limitation, the customer and/or former customers, potential customers, partners, job applicants, employees and former employees, employees of partners, suppliers and service providers and its employees, applicants and complainants, visitors and individuals and all those individuals who maintain a relationship with CAEL and to whom the Personal Data relate.
CAEL does not voluntarily or directly solicit or collect personal data from minors. If CAEL discovers that it has inadvertently collected personal data from a minor under the age of 18, it will immediately delete the records containing that minor's personal data. We emphasize, however, that CAEL may collect personal data relating to minors, when provided by their parents or a legal guardian who expressly consents to such collection.
In carrying out its activities, CAEL processes personal data from a significant number of categories of Data Subjects.
The personal data that CAEL collects always depends on the nature of the interaction, but may include the following:
• Identification and contact information: Name, surname, postal address, telephone or mobile number, e-mail address, civil identity documents (citizen card, passport) or other similar information.
• Data related to the provision of services and supply of goods, or for contractual performance or for compliance with legal obligations, such as: billing data, billing history, current account values, payment data and family data.
• Data related to the method of acquisition of services, goods or subscription of services, your transaction, billing history and assistance in the context of the CAEL services you use, or any other related information and information in the context of answering any questions , requests or complaints.
• Security credentials data: User identification, passwords and similar security information required for authentication and access to CAEL accounts.
• Demographics, place of birth, nationality, CV, gender, age, preferred language, general education and employment history, as well as general interest data about the job.
• Preference Data: Information on the holder's preferences and interests, insofar as this is related to the products and/or services and on how he prefers to receive communications.
• Data from social networks: Information shared on social networks when interacting with CAEL, where transparency is guaranteed through the existence of adequate privacy policies.
• IT usage data: user ID, roles, rights, login times, computer name, IP address;
• Depending on relevant circumstances and applicable local laws and requirements, we may collect: photograph, video image, age/date of birth, diversity information including racial or ethnic origin and supplementary information you choose to share with us;
• Images of CCTV systems, if you visit our facilities.
Please note that you will not be required to share personal data with CAEL. However, if you choose not to share your personal information, in some cases, CAEL may not be able to provide the services or products you want, ensure certain specialized features or effectively answer any question you may have.
Because we treat your information
The development and carrying out of the various activities pursued by CAEL mean the existence of a relevant set of specific, explicit and legitimate purposes for the processing of personal data, such as:
| Goal: |
Fundamento jurídico: |
| • Provision of Services Reservation of a rental car without a driver and purchase of products and services associated with this same reservation |
• Pre-contractual due diligence and contractual execution
• Legitimate interest for a legally permissible purpose |
| • Marketing communications, including newsletter sending and testimonials |
• Data Subject Consent |
| • Praise and Testimonials |
• Data Subject Consent |
| • Respond to requests, complaints and communications within the contractual scope |
• Pre-contractual due diligence and contractual execution
• Legitimate interest for a legally permissible purpose |
| • Administrative, economic and accounting management |
• Pursuing those necessary to comply with legal obligations
• Legitimate interest |
| • Event management organized by CAEL |
• Data Subject Consent |
| • Data transfer to EU third parties (police authorities, regulatory authorities, insurance companies, motorway concessionaires, toll and parking management entities, fleet operators, travel agents, fraud verification entities, credit card issuers) |
• Legal obligation
• Contract fulfillment
• Legitimate interest
|
What we treat your information for
By reference to the "Principle of Lawfulness" enshrined in the RGPD, in the development and carrying out of its activities, CAEL only processes personal data when there is a legal basis that legitimizes the processing, namely:
• Consent
CAEL will only process personal data if you consent to its processing through a free, specific, informed and explicit expression of will, by which it accepts, by means of a statement (in writing or orally) or an unequivocal positive act (by filling in an option ), that personal data are subject to Processing.
• Pre-contractual steps or the execution of a contract
CAEL may process personal data if they are necessary, without limitation, for the execution of a contract for the provision of services and/or supply of products to which it is a party as an Employee, Customer and/or Supplier, or to carry out due diligence pre-contractual on request.
Includes payment processing and insurance processes that may be applicable and/or requested.
• Fulfillment of a legal obligation
CAEL may process personal data to ensure and guarantee compliance with legal obligations to which it is subject under the legislation of a Member State and/or the European Union.
• Legitimate Interests
CAEL, other Responsible Persons or Third Parties may process personal data as long as this same Treatment does not prevail over the interests or fundamental rights and freedoms of the Holder.
These treatments will be legally permitted for purposes, such as verification of fraud, threat to other people's safety, traffic violations, non-compliance with the terms of use, processes that may have been triggered in accordance with the insurance policy, among others.
These treatments may be related to data communication to law enforcement authorities, regulatory authorities, insurance companies, highway concessionaires, toll and parking management entities, fleet operators, travel agents, fraud verification entities and credit card issuers .
How long do we keep personal data
During the period of Treatment of personal data, CAEL guarantees that they are treated in accordance with this Privacy Policy. As soon as the data is no longer necessary for the pursuit of the purpose, CAEL will proceed with its secure elimination.
| Treatment: |
Shelf life: |
| • Provision of Services Reservation of a rental car without a driver and purchase of products and services associated with this same reservation |
• 10 years after provision of services in conjunction with other criteria defined by the authorities |
| • Marketing communications, including newsletter sending and testimonials |
• Until revocation of consent or opposition to treatment |
| • Respond to requests, complaints and communications within the contractual scope |
• Up to 3 years after pursuing the purpose |
| • Administrative, economic and accounting management |
• 10 years after compliance with legal obligations |
| • Event management organized by CAEL |
• After pursuing the purpose |
CAEL keeps personal data only for the period of time necessary to carry out the specific purposes for which they were collected. However, CAEL may be required to retain some personal data for a longer period, taking into account factors such as:
• Legal obligations, under the laws in force, to keep Personal Data for a certain period;
• Limitation periods, under the laws in force;
• (if any) Litigation; and,
• Guidance issued by competent data protection authorities.
Sharing personal data with third parties
Personal data may be shared with entities responsible for providing services to CAEL.
The companies in charge of providing services are bound by CAEL by written contract, and may only process personal data for the purposes specifically established and are not authorized to process personal data, directly or indirectly, for any other purpose, for their own benefit or for third.
Personal data may be shared internally with other CAEL companies that will comply with applicable data protection rules depending on the purposes of the Processing carried out.
Upon request and with due consent, personal data may be shared with other entities.
In compliance with legal and/or contractual obligations, personal data may also be transmitted to judicial, administrative, supervisory or regulatory authorities and also to entities that carry out, lawfully, data collection actions, actions to prevent and combat fraud, market or statistical studies.
EU cross-border transfer
CAEL does not transfer Personal Data outside the EU.
What are the rights of the Holder
As the Owner of the personal data processed by CAEL, you have the right to access, rectify, limit, portability, erasure and the right to object to the processing of personal data, in certain circumstances, which may be exercised under the terms of this chapter of the Privacy Policy.
• Right to provide information
You have the right to obtain clear, transparent and easily understandable information about how CAEL uses personal data and what your rights are. That is why CAEL makes all this information available to you in this Privacy Policy.
• Right of access
You have the right to obtain information about what Personal Data CAEL handles (if you are processing them) and certain information (similar to that provided in this Privacy Policy) about how such data is handled. This right allows you to know and confirm that we use your data in compliance with data protection laws.
CAEL may refuse to provide the requested information whenever, in order to do so, CAEL has to reveal another person's Personal Data or the information negatively impacts another person's rights.
• Right of rectification
If your details are incorrect or incomplete (for example, if your name or address is wrong), you can ask CAEL to take reasonable steps to correct them.
• Right to data deletion
This right is also known as the "right to be forgotten" and, simply, allows you to request the erasure or deletion of your data, provided that there are no valid grounds for CAEL to continue to use or use them be unlawful. This is not a generic right to erasure, as exceptions are allowed (for example, whenever these data are necessary for the defense of a right in a legal proceeding).
• Right to treatment limitation
You have the right to “block” or prevent future use of your data while CAEL evaluates a request for rectification or as an alternative to deletion. Whenever the Treatment is limited, CAEL can still store your data, but it will not be able to use them later. CAEL maintains a list of holders who requested “blocking” the future use of their data to ensure that this limitation is respected.
• Right to data portability
You have the right to obtain and reuse certain personal data for your own purposes in various organizations. This right applies only to the data that you have provided to CAEL and that CAEL handles with your consent and those that are processed by automated means.
• Right to Opposition
You have the right to object to certain types of treatment, for reasons related to your particular situation, at any time such Treatment takes place, for the purposes of the legitimate interest of CAEL or Third Parties. CAEL may continue to process such Data if it can provide evidence of "legitimate reasons prevailing for the Process that outweigh its interests, rights and freedoms" or if such Data are necessary for the establishment, exercise or defense of a right in a judicial process.
• Right to revoke consent
When the basis of lawfulness is consent, you have the right to revoke it at any time.
You can do it as follows:
• Newsletter and communications: Through the option inserted in the “Unscribe/Remover” message;
• Testimonials and other treatments: By email sent to rgpd@cael.pt.
• Right to file a complaint
You have the right to file a complaint with the competent supervisory authority, the National Data Protection Commission – CNPD, if you consider that the Processing carried out on personal data violates your rights and/or applicable data protection laws. You can do this through the website
Security and confidentiality
Personal data will be processed by CAEL, in the context of the purposes identified in this Policy, in accordance with other internal CAEL policies, procedures and rules and using appropriate techniques and organizational measures to promote their availability, confidentiality and integrity, namely in regarding unauthorized or unlawful processing of personal data and its accidental loss, destruction or damage.
Without limiting, CAEL uses logical and physical security requirements and measures to ensure the protection of personal data by preventing unauthorized access, ensures that the information is stored on secure computers in a closed and certified information center and that data is encrypted whenever possible, has implemented audit and control procedures to ensure compliance with security and privacy policies, and periodically reviews our security policies and procedures to ensure that CAEL's systems are safe and secure.
However, as the transmission of information over the Internet is not completely secure, CAEL cannot guarantee the security of data when transmitted over an open network.
CAEL recognizes that the information you provide to us may be confidential. CAEL does not sell, rent, distribute, or commercially or otherwise make available personal data to any third party, except in cases where it needs to share information with Service Providers for the purposes set out in this Privacy Policy. CAEL preserves the confidentiality and integrity of data and protects them in accordance with this Privacy Policy and applicable laws.
Use of cookies
See our Cookies Policy posted on
In case of doubt or to exercise rights
If you have any questions or would like more information about how we handle personal data or about our practices in terms of information security, please do not hesitate to contact us at our address or at rgpd@cael.pt
You may at any time, in writing, exercise the rights enshrined in the RGPD, and other applicable legislation, through the contacts mentioned above.
For the exercise of rights, if necessary, you must attach a copy of the document that proves the identity of the Personal Data Subject. The right you intend to exercise must be indicated. The exercise of rights is free.
Changes to this Privacy Policy
CAEL may periodically update this Privacy Policy, as well as any other specific data protection and privacy statement. When making changes to this Privacy Policy, a new update date will be added.
Last update date: 06/04/2021
