I. The Privacy and Personal Data Protection Policy, complementary to the Terms and Conditions of Use, is intended to regulate the processing of personal data carried out by IVDP, IP.

II. The data controller is the IVDP, Instituto dos Vinhos do Douro e do Porto, IP, headquartered at Rua dos Camilos, 90, 5050-272 Peso da Régua – Portugal, and branch at Rua Ferreira Borges, 27, 4050-253 Porto – Portugal.

III. Data collected.

1. Obtaining data:

(a) Data provided directly by the holder;

(b) Data collected within the framework of the relationship formed with the holder of such data, namely through registration under legal terms or within the scope of fulfilling the attributions and competences provided by law;

(c) Personal data requested from the holder treated with his consent;

(d) In case the data refer to minors, these will be obtained through their legal representatives or guardians.

2. In all interactions, we try to reduce the requested data as much as possible. Thus, we only request the data that are, in fact, necessary for the exercise of our duties and competences.

3. Therefore, we request personal data that allow us to identify and contact people. This data is strictly necessary for this contact and management, for purposes directly related to the attributions and powers of the IVDP. Since, as mentioned, in the case of minors, we request the identification of the person responsible for the registration or contact.

IV. The processing of personal data includes, namely, the registration, collection, consultation, use, adaptation, alteration, storage, destruction of data, among other operations.

V. The use of the data collected has the following purposes, namely:

(a) Fulfillment of the mission, attributions and powers of the IVDP;

(b) Provision of services requested by the holder;

(c) Provide information about products and services, namely of a promotional nature, under legal terms, subject to prior consent for this purpose.

VI. The IVDP guarantees the processing of personal data in accordance with the legislation in force regarding its collection, treatment, use, disclosure, storage and privacy.

VII. The IVDP will not process personal data that reveal racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as the processing of genetic data, data biometric data to unambiguously identify a person, data relating to health or data relating to the holder’s sexual life or sexual orientation.

VIII. When accessing, using or enjoying our services, the user agrees with the privacy and personal data protection policy of the IVDP, giving his consent to the collection and processing of his data for the purposes referred to in point V by providing them directly. The non-provision or partial provision of personal data by the holder may limit or make it impossible to carry out the services.

IX. Personal data will only be collected:

(a) In fulfillment of a legal obligation;

(b) The user registers;

(c) The data subject requests a product, a service or requests more information about an IVDP activity, by any means of contact with the IVDP.

X. The data subject will give his prior consent regarding the receipt of communications or others for promotion or dissemination purposes, being conferred the option of opposition, at any time, by means of a written communication addressed to to IVDP. Said information may be sent by IVDP, via email, mail, telephone, SMS or any other means of electronic communication, social networking websites, Web 2.0, any mobile phone content or method.

XI. In addition to the obligations referred to in the applicable law for data protection or the safeguarding and protection of its own interests, as well as the transmission of data resulting from legal obligations, the IVDP will not share any personal data with third parties, except with prior authorization from the data subject.

XII. The IVDP has adequate technical and organizational measures for the security of processed data, namely against unauthorized access or any other form of illegal or illicit treatment. IVDP guarantees, in addition to the security measures and internal protection of its facilities, the limitation of access to personal data only to its employees duly identified for the fulfillment of the processing purposes. Furthermore, we limit their access and keep them in environments protected by a firewall and complex passwords. Finally, we also use encryption keys in the transmission of data between the storage location and the access terminal.

XIII. The data subject is granted the right of access and rectification of the processed data, being able, at any time, to withdraw the consent for the treatment and request the erasure of the data, under the legal terms, by communication written address to the IVDP. XIV. IVDP will make reasonable efforts to ensure that it retains data about the data subject only for as long as is necessary in relation to the purpose for which it was collected, or as required under any contract or applicable law.

XV. IVDP’s privacy and personal data protection policies apply to the processing of personal data carried out within the scope of its activities and provision of services, in accordance with the principles of legality, legality, loyalty and transparency.

XVI. The IVDP may use cookies on its website in order to improve the quality of the service, the functionalities provided and the user experience, not being used for profiling. If you do not allow the use of cookies, some of the functionalities may not correspond to the expected level of service. If you wish to remove cookies, consult the “Help” section of your internet browser.

XVII. The IVDP will not take any action based on automated decisions or that lead to profiling. XVIII. The supervisory authority is the National Data Protection Commission;

XIX. Any communication regarding the processing of personal data should be addressed to the IVDP via email: rdpd@ivdp.pt.