Privacy Policy

We want you to feel comfortable when visiting our website.

It is very important to us to protect your privacy when your personal data is processed.

This privacy policy has been prepared in accordance with current national and European legislation on the protection of personal data, more specifically Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016. (“GDPR”), as well as other legal, regulatory and good practice provisions.

In terms of principles relating to the processing of your personal data, Holon SA. undertakes to ensure that they are: 

• Subject to lawful, fair and transparent processing;
• Collected for specific, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes;
• Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
• Accurate and updated whenever necessary, with all appropriate measures being taken to ensure that inaccurate data, taking into account the purposes for which they are processed, are deleted or rectified without delay;
• Kept in a form which permits identification of the data subject only for the period necessary for the purposes for which the data are processed;
• Processed in a manner that ensures their security, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures.

In this privacy policy we describe how we collect, use and disclose your personal data when you visit our website www.farmaciasholon.pt (hereinafter: “Website”).

1.  Responsible for processing

For all legal purposes, the entity responsible for processing the data is:
HOLON, S.A. (“Holon”)
Rua General Firmino Miguel, nº3 – piso 7, 1600-100 Lisboa, Portugal
Phone: +351 219 666 100

Email: geral@farmaciasholon.pt

2. Contacts for matters related to personal data

Under applicable law, Holon does not need to appoint a Data Protection Officer. However, we are happy to clarify any questions you may have regarding the protection of personal data. Please contact us using the following contacts:

José Diniz
Phone: 00351 220907512
Fax: 00351 229 409 490
Email: dadospessoais@holon.pt

3. Definitions 

Supervisory authority: means an independent public authority established by a Member State, which has the responsibility for monitoring the application of the GDPR in order to protect the fundamental rights and freedoms of natural persons with regard to processing and to facilitate the free movement of data. data in the Union;
Consent: means a free, specific, informed and explicit manifestation of will, by which the data subject accepts, by means of a statement or unequivocal positive act, that personal data concerning him/her may be subject to processing; Personal data: means information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is a data subject who can be identified, directly or indirectly, in particular by reference to an identifier. Identifiers include, for example, a name, an identification number, location data, electronic identifiers, an IP address or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person (hereinafter referred to together as “data”);
Controller: means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data;
Processor: means the natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller. Processing: means the operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, the use, disclosure by transmission, dissemination or any other form of making available, alignment or combination, restriction, erasure or destruction;

4. Legal basis for data processing  

4.1 General
We process your data in accordance with the GDPR, and any other applicable legislation regarding personal data. Data will only be processed to the extent necessary, and if we are qualified to do so, within the scope of personal data legislation, or within the limits of your Consent to the processing of personal data. For the Processing of personal data to be lawful, the GDPR requires that there be an adequate legal basis for each specific Processing. In this sense, data processing carried out by Holon is lawful when at least one of the following situations occurs:

• The data subject has given his/her explicit consent to the processing of data for one or more specific purposes;
• The processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
• The Processing is necessary for compliance with a legal obligation to which Holon is subject;
• The Processing is necessary for the defense of vital interests of the data subject or of another natural person;
• The Processing is necessary for the purposes of the legitimate interests pursued by Holon.
• Purposes, types of data and legal grounds for the Processing of data collected by Holon through the Website.

Contact management: to contact you, for administrative or operational reasons, for example, in response to any query, comment, suggestion or request for information requested on the contact form. For this purpose, personal data related to contact (telephone and email), identification (name) and information provided in the subject “field” are processed, with the Processing being based on Holon’s legitimate interest in contacting you. to respond to your request for information. In this case, your data and documents will be encrypted for transmission purposes.
Recruitment: through the Website page (https://www.farmaciasholon.pt/recrutamento) you may apply for a professional position at Holon, and your contact and identification data are collected, as well as relevant information relating to professional qualifications, habits or personal characteristics, including your curriculum vitae.
In this case, the processing of personal data is subject to the legitimacy of pre-contractual due diligence and the legitimate interest of Holon. 
Technical data and data of the device with which you access our Website: Information provided in the cookie policy. For more information, access the Cookies Policy.
Newsletter: if you wish to receive news, updates and information about Holon pharmacies and the products sold therein by receiving our newsletter, we collect your email so that we can send the newsletter with the appropriate frequency. To do so, you must give your Consent for the processing of your personal data (email) for the aforementioned purpose. You can withdraw your Consent whenever you want, as described, and to the contacts indicated in point 11 of this privacy policy.
HolOn data processing: HolOn is an online platform incorporated into the Website that mediates contacts between customers and Holon pharmacies, with the aim of facilitating the process of buying and selling products from Holon pharmacies, through home delivery or collection of products. of the order at the pharmacy near the user's address. Holon collects your personal contact and identification data for the purpose of expediting the order to the pharmacy (e.g., name, billing address, delivery address, CPF, email and telephone contact), giving you the option of creating an account. After confirming the information provided, you will receive an email confirming the order. Your personal data will be processed for the aforementioned purpose for the purpose of carrying out the necessary pre-contractual steps at the request of the data subject and your consent is requested for the communication of the data to the pharmacy in question. Holon and the pharmacy that will receive your data have entered into an agreement to regulate the processing of your personal data for the purpose of streamlining the process of ordering products from the pharmacy, in accordance with Article 26 of the GDPR. In the aforementioned agreement, Holon and the pharmacy jointly determine the means of processing, the way in which your rights are exercised and the way in which information about the processing of your data is provided to you, as well as the security measures applicable to the processing of your data for this purpose. After the contract has been signed with the pharmacy for the delivery of the requested order, your personal data processed within the scope of the contractual execution and for the pharmacy's own purposes are the responsibility of the pharmacy, and you must exercise your rights and obtain information for said processing with the pharmacy. pharmacy. 

5. Hyperlinks

Some areas of our Site contain links to third party websites. These sites are covered by other privacy policies. We are not responsible for the operation of these websites, including how personal data is handled by third parties. If you wish to submit information to (or through) these third party websites, we recommend that you check their respective privacy policies before submitting information that can be associated with you as an individual.  

6. Data recipients

Your data will only be shared with internal departments or organizational units and other companies affiliated with us that need access to the data to fulfill contractual and legal obligations or to the extent that they need the data to process and implement our legitimate interests.
Your data will be communicated to external recipients in order to perform contracts if we have such a legal obligation to provide information, report or share data or if you have given us your consent to share your data with third parties or with external service providers who are to act as our Subcontractors or those who perform functions for us (e.g. IT service providers, service providers we use for our online recruitment tool, data centers, companies that destroy data or postal services). Holon ensures that each of these external recipients ensures the confidentiality of the data by entering into agreements or other regulatory act to regulate the communication of data with its Subcontractors, pursuant to Article 28 of the GDPR.

7. Transfers to external countries

We transfer your data to entities located in jurisdictions outside the European Union (EU) or the European Economic Area (EEA) (“external countries”) who are acting as Processors on Holon’s behalf (e.g. IT providers or data centers). As part of our use of the Google Analytics service, we transfer truncated IP addresses to the USA. Additionally, your data may be transferred to social plugin providers; For more information, please consult the privacy policies of these providers.   
In the absence of a decision by the European Commission on the adequate level of protection in the country in question, we conclude contracts in accordance with EU data protection rules which ensure that your rights and freedoms are adequately protected and safeguarded. Alternatively, the data transfer is based on Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 on the level of protection provided by the EU-U.S. Privacy Shield based on Directive 95/ 46/EC of the European Parliament and of the Council. We are happy to provide you with any relevant and detailed information you request.   
Except as set out above, we do not transfer your personal data to countries outside the EU or EEA or to international organisations.  

8. Your rights as the data owner subject

You may at any time invoke your rights listed below against any entity listed in Section 1.  

8.1 Right of access
Under Article 15 of the GDPR, you have the right to access the following information at any time and free of charge: the personal data we process relating to you, the categories of recipients, the intended data retention period or, in the case of transfers to countries outside the European Union, the safeguards implemented. You still have the right to a copy of your data.  
Pursuant to Article 12, paragraph 5, GDPR, Holon reserves the right to demand payment of a reasonable fee or to refuse access to information in the event of manifestly unfounded or excessive requests. 

8.2 Right to rectification, erasure and restriction of processing  
If the data we process is incorrect or incomplete or if its processing is unlawful, you can request that we rectify, complete or limit the processing of your data or that we delete it to the extent permitted by law (Articles 16, 17.º and 18 of the GDPR). 
There is no right to erasure if the processing of personal data is necessary for (i) the exercise of the right to freedom of expression and information; (ii) for compliance with a legal obligation to which Holon is subject (e.g. minimum data retention periods); or (iii) for the declaration, exercise or defense of legal rights. 

8.3 Right to portability
In the event that you provide us with personal data based on your Consent or in the context of a contractual relationship, Holon will, upon request, deliver said data to you in a commonly used machine-readable format and in a structured form. Where technically feasible, we may also transmit the data to a third party indicated by you.    

8.4 Right of opposition
If we process your data to pursue a legitimate interest, you can object to such processing on grounds relating to your particular situation (Article 21 GDPR). The right to object can only be exercised within the limits of Article 21 GDPR. However, our interests may override the right to cease processing, which means that despite your objection, we may have the right to process your personal data.    

8.5 Right to lodge complaints
Please contact us with your questions, suggestions and criticisms. Under Article 77 of the GDPR, you have the right to lodge a complaint with a supervisory authority, namely the Member State of the European Union where you habitually reside, work or where the alleged infringement of your rights under the GDPR was committed. The right to lodge a complaint is independent of any other administrative or judicial measures.  
The Portuguese Control Authority is: 
Comissão Nacional da Protecção de Dados
Rua de São Bento n.º 148-3º 1200-821 Lisboa
Tel.: 00351 213928400
Fax: 00351 213976832
Email:  geral@cnpd.pt 

Before contacting the Supervisory Authority, we ask that you contact us first if you have any complaints. We will try to resolve it quickly. 

9. Obligation to provide data  

As a general rule, you are not obliged to provide us with personal data. However, if you do not provide us with your data, we cannot give you access to our Website or process your order or respond to any questions you may send us. 

10. Automated individual decision-making/profiling  

We do not carry out automated individual decisions. If necessary, we may process your data to evaluate certain personal aspects (profiling). In particular, we may, if necessary, use assessment tools to provide appropriate information and advice on products. These allow us to design our products, communications and advertising to meet your needs.  

11. Consent/Consent Withdrawal Rights

In the event that you have given us your Consent to the collection, processing or use of your data, you may at any time withdraw this Consent by sending a notification to this effect to the entity indicated in Section 1. An email will suffice.  
You also have the right to object to the Processing of your data due to your particular situation, under Article 6.1, letter e) (performance of functions in the public interest) or Article 6. paragraph 1 (f) (legitimate interests of the Controller) of the GDPR; the same applies to profiling under the said provisions. In these situations, we will stop processing your data unless we can demonstrate that we have compelling legitimate grounds to carry out the Processing which override your interests, rights and freedoms, or that the Processing serves for the establishment, exercise or defense of legal claims in a lawsuit.
If data relating to you is processed for direct marketing purposes, you may object to such processing at any time. If you object to the processing for direct marketing purposes, we will no longer process your data for these purposes.    
Please send your Consent withdrawal notice to the contacts listed in Section 1.  

12.  Personal Data Retention Period

Your data collected through the Website are processed in strict compliance with applicable legislation and are stored in specific databases created for this purpose. Such data are kept in a format that allows their identification, and only for the period necessary for the purposes for which they are processed, after which they will be deleted.
The period of time for which data is stored and retained varies depending on the purpose for which the information is used. There are, however, legal requirements that require keeping data for a longer period of time. In this case, the data will be stored and maintained for the minimum period necessary to comply with this legal obligation, after which they will also be deleted.

13.  Changes

Holon reserves the right to change this privacy policy at any time. Any material changes will be announced by posting the revised privacy policy on our Site. Unless otherwise stated, changes will take effect immediately. We therefore suggest that you regularly consult the privacy policy to ensure that you are aware of the latest version.  

Last updated May 2019