Privacy Policy

Privacy and Personal Data Protection Notice

In accordance with the applicable data protection regulations, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), Law No. 58/2019 of August 8, on Personal Data Protection and Guarantee of Digital Rights and other related laws and regulations, we inform you about the Personal Data Protection Policy.

1. Who is responsible for processing your personal data?

The data controller is ARSOPI-THERMAL, with Tax ID 502192364 and registered office at Rua N. Sra. da Graça 1212, 3730-541 Vale de Cambra.

If you need to obtain more information about any of the points included in our Privacy Policy and send your questions, inquiries, or complaints related to the processing of your personal data, you can do so via email: thermal@arsopi-thermal.pt.

Below, we provide detailed information about the processing of your personal data by ARSOPI-THERMAL as the data controller.

ARSOPI-THERMAL ensures that the personal data it accesses are:

(i) processed lawfully, fairly, and transparently;

(ii) used only for the purposes for which they are collected; and

(iii) processed in a manner that ensures their security, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, by implementing appropriate technical or organizational measures.

2. Personal Data

Personal data is any information relating to an identified or identifiable natural person.

For the purposes established in this Privacy Policy, the controller collects and processes the personal data explained in each type of processing, which will depend on the different services you request or the contractual relationship you maintain with our entity.

ARSOPI-THERMAL is committed to treating them with full confidentiality and applying appropriate physical, technical, and organizational security measures to protect your personal data.

It guarantees and is responsible, in any case, for the truthfulness, accuracy, validity, and authenticity of the personal data provided and undertakes to keep them properly updated.

3. Categories of Personal Data

3.1. Website Users

In the context of using and interacting with the ARSOPI-THERMAL website, as well as managing communications and requests submitted by users, the following types of personal data may be processed:

a) Identification Data: full name and, when applicable, username associated with access accounts or restricted areas.

b) Contact Data: telephone/mobile phone and email address.

c) Browsing and Technical Data: IP address, date and time of access, pages visited, session duration, browser type and version, device used, operating system, and other technical data necessary for the operation and security of the website.

d) Communication and Interaction Data: messages, contact requests, or information submitted through online forms (e.g., "To contact us, please fill out the form below"), as well as the respective history.

e) Preference and Usage Data: options selected in forms, language preferences, consents provided (such as cookie acceptance), and browsing behavior on the website, as configured in the cookie management panel. These data are processed exclusively to ensure the operation, improvement, security, and personalization of the browsing experience, as well as to respond to contact requests, newsletter subscriptions, and other legitimate user interactions with the ARSOPI-THERMAL website.

3.2. Recruitment Candidates

In the context of recruitment and selection processes, ARSOPI-THERMAL collects and processes personal data of candidates, strictly necessary for evaluating their profile and suitability for the positions to be filled.

a) Identification and Contact Data: Name, email address, ID card number, tax identification number, address, and telephone contacts.

b) Professional and Academic Data: Professional experience, educational qualifications, employment history, and other information contained in the resume submitted by the candidate.

c) Complementary Data: Date of birth and any other personal data included in documents voluntarily provided by the candidate during the recruitment process.

ARSOPI-THERMAL may, whenever legally permitted, collect personal data through third parties, such as recruitment companies, professional references, previous employers, or entities conducting background checks.

During selection interviews and evaluation processes, additional information relevant to the assessment of the application may also be collected.

4. How We Collect Your Personal Data

4.1. Website Users

ARSOPI-THERMAL collects personal data from its website users in a transparent, lawful manner and limited to the purposes for which they are processed, through the following means:

a) Directly from the data subject: When the user fills out forms available on the website (for example, "Contact Us"), or when contacting us by email, telephone, or other electronic communication means provided by ARSOPI-THERMAL.

b) Through website browsing: During browsing, certain technical data may be automatically collected, such as IP address, device type, operating system, browser used, and pages visited. Cookies and similar technologies may also be used, according to the terms defined in the ARSOPI-THERMAL Cookie Policy. Only technical or strictly necessary cookies for website operation will be used, while others (such as analytical or personalization cookies) will only be activated with the prior and express consent of the user, through the cookie management panel.

  • c) Through duly authorized third parties: When applicable, ARSOPI-THERMAL may receive personal data through technology service providers or web analytics partners (for example, Google Analytics or equivalent tools), exclusively for statistical, security, and improvement of website user experience purposes, and always in accordance with user consent preferences.

4.2. Recruitment and Selection Processes

ARSOPI-THERMAL collects personal data from candidates in the context of recruitment and selection processes, through the following means:

a) Directly from the candidate: When submitting a spontaneous application, responding to a job advertisement, submitting a resume (in physical or digital format), or participating in interviews and evaluation processes conducted by ARSOPI-THERMAL.

b) Through third-party entities: Data may be collected through recruitment platforms, temporary employment agencies, personnel selection agencies, or professional references and previous employers, in cases where the candidate has expressly authorized it.

c) During interviews and evaluations: During interviews and evaluation processes, complementary information about skills, availability, professional experience, expectations, or other data relevant to the assessment of the application may be collected.

5. For What Purposes Do We Collect Personal Data?

5.1. Website Users

ARSOPI-THERMAL processes personal data of its website users for specific, explicit, and legitimate purposes, respecting the principles of necessity, proportionality, and purpose limitation defined in Regulation (EU) 2016/679 (GDPR).

In particular, personal data collected through the website may be processed for the following purposes:

a) Management of requests, communications, and user relationship: Responding to contact requests, information, quotes, or other requests submitted through website forms or electronically; managing support communications, technical assistance, or commercial follow-up.

b) Management of commercial relationships and service provision: Whenever contact established through the website results in a contractual or commercial relationship, data are used for preparing proposals, order management, invoicing, contract execution, and associated administrative and accounting management.

c) Sending institutional and informational communications: With prior and express consent of the data subject, ARSOPI-THERMAL may send informational communications, institutional newsletters, event invitations, or updates about its products and services.

d) Collection of opinions and continuous improvement: Collecting feedback, opinions, or evaluations from users and customers about products, solutions, and services provided, aiming at continuous improvement of quality and adequacy of ARSOPI-THERMAL's responses.

e) Technical and functional management of the website: Ensuring the operation, maintenance, security, and continuous improvement of the website, including cookie management and similar technologies, as defined in the ARSOPI-THERMAL Cookie Policy.

f) Statistical analysis and digital experience optimization: Conducting statistical analyses and aggregated anonymous studies about website usage, aiming to understand user behavior and improve navigation, content, and functionalities available online.

g) Compliance with legal and security obligations: Ensuring compliance with legal, regulatory, and cybersecurity obligations, as well as protecting ARSOPI-THERMAL's systems and infrastructure against unauthorized access, fraud, or illicit activities.

h) Management of consents and privacy preferences: Recording and respecting consent options and privacy preferences provided by users regarding the use of their personal data, cookies, and electronic communications.

5.2. Recruitment and Selection

In the context of recruitment and selection processes, ARSOPI-THERMAL processes personal data of candidates for the following purposes:

a) Management of spontaneous applications and response to job advertisements: Receiving, analyzing, and processing applications submitted through the website, by email, physically, or through recruitment platforms.

b) Evaluation of qualifications and suitability for the position: Analyzing candidates' skills, experience, and professional profile against job requirements.

c) Conducting interviews and evaluation processes: Conducting interviews, technical tests, and collecting complementary information necessary for assessing the application.

d) Communication with candidates: Contacting candidates during the selection process, including notifications about application status or possible future opportunities.

e) Verification of professional references: Confirming information contained in the resume, through references or previous employers, whenever legally admissible and/or with the candidate's consent.

f) Management of candidate database: Maintaining a candidate database for consideration in future recruitment opportunities, based on express consent of the data subject.

g) Compliance with legal and contractual obligations associated with recruitment processes and eventual employment contract conclusion.

6. Use of Data for Other Purposes

ARSOPI-THERMAL uses personal data only for the specific, explicit, and legitimate purposes that motivated their collection, as defined in this Privacy Policy. As a rule, personal data are not processed for purposes different from those for which they were originally collected. However, in specific and duly justified situations, data may be used for other purposes compatible with the initial processing purpose, provided that: these purposes fall within the limits of the original processing; there are adequate guarantees of security, confidentiality, and data protection; and the new processing is based on a lawfulness criterion provided for in Article 6 of the GDPR. Whenever ARSOPI-THERMAL intends to process personal data for a substantially different purpose from the initial one, the following conditions will be met:

  1. The data subject will be previously informed of this new purpose;
  2. The legal basis supporting the new processing will be communicated;
  3. When necessary, new express consent from the data subject will be requested before using the data.

This policy applies equally to customer data (website users) and all job applicants of ARSOPI-THERMAL, ensuring that any reuse of personal information fully respects the principles of lawfulness, fairness, transparency, and purpose limitation.

7. What are the Lawful Bases for Processing Personal Data?

ARSOPI-THERMAL only processes personal data when there is a lawful basis provided for in Article 6 of Regulation (EU) 2016/679 - General Data Protection Regulation (GDPR).

In general, the processing of personal data is based on the following grounds:

7.1. Website Users

The processing of personal data of ARSOPI-THERMAL website users is based exclusively on the lawful grounds provided for in Article 6 of the GDPR, applicable to the digital context and electronic interactions:

  1. Performance of pre-contractual measures (Art. 6(1)(b)): When processing is necessary to respond to requests submitted through the website, such as contact requests, quotes, information about services, or other communications initiated by the user. It is related to managing contractual and pre-contractual service relationships, including quality control of the service provided.
  2. Legitimate interest (Art. 6(1)(f)): When processing is essential to ensure the operation, security, and technical improvement of the website, prevent unauthorized access or fraud, and optimize the browsing experience, without harming the rights and freedoms of data subjects. It will also be related to managing Complaints/Suggestions.
  3. Consent (Art. 6(1)(a)): When the user expressly authorizes processing for optional purposes, such as marketing, informational campaigns, or use of non-essential cookies (analytical, personalization, or advertising). Consent is always free, informed, specific, and revocable at any time, without affecting the lawfulness of previous processing.

7.2. Recruitment and Selection

Personal data of job or internship applicants are processed based on the following grounds:

  1. Performance of pre-contractual measures (Art. 6(1)(b)): Processing is necessary to evaluate the application and decide on the eventual conclusion of an employment or internship contract. This basis applies because the candidate provides their data with a view to concluding a contract, and it is essential to collect information to schedule interviews, apply selection tests, or evaluate suitability for the position.
  2. Compliance with legal obligation (Art. 6(1)(c)): Arising from labor, social security, and immigration legislation, which requires verification of legal capacity to work in Portugal. It also includes the obligation to retain certain records in case of inspections or audits by official entities.
  3. Consent (Art. 6(1)(a)): Used in specific situations not covered by the previous bases, namely for retaining the resume or personal data for a longer period, with a view to future job opportunities. Consent is free, informed, specific, and can be withdrawn at any time, without prejudice to the lawfulness of processing carried out until the date of withdrawal.

8. For How Long Do We Retain Your Personal Data?

Personal data collected and subject to processing are retained, considering their purpose, in compliance with applicable legal deadlines.

In cases where no legal deadline applies regarding the retention and storage of personal data, such data will only be stored and retained for an adequate period and to the extent necessary, considering the purposes for which they were collected, except if, at any time, the data subject, within legal limits, exercises their rights of objection, limitation, erasure, or withdrawal of consent.

Whenever the data subject exercises, within legal limits, their rights of objection, erasure, or withdraws consent, ARSOPI-THERMAL will proceed to delete or anonymize the data, unless retention is required by law or necessary for the defense of rights or legitimate interests of ARSOPI-THERMAL in judicial, administrative, or arbitration proceedings.

9. With Whom Do We Share Your Personal Data?

ARSOPI-THERMAL is committed to treating personal data confidentially and sharing them only with third parties when necessary, legitimate, and proportionate to the processing purposes, or when there is a legal obligation to do so.

The responsible entities may disclose data to other companies within their group, in the context of service sharing and for internal reporting purposes. Data may also be shared with the clients of the responsible entities, in the context of human resources recruitment services and, where applicable, in the provision of temporary work.

The sharing mentioned in the preceding paragraphs may be carried out for purposes of contacts related to other offers, not just the one for which the application is made.

They may also be shared with third-party service providers of the responsible entities (namely legal, accounting, or audit services) and with public authorities, under applicable law, to which we are obliged to disclose data, such as the Authority for Working Conditions (ACT), as well as following judicial mandates, to the respective judicial authorities.

10. What are the Rights of Data Subjects

Data subjects, as such, have the following rights:

  • Right to information – the data subject has the right to be informed about how their data will be processed by ARSOPI-THERMAL in accordance with Articles 13 and 14 of the GDPR.
  • Right of access – the data subject has the right to access their personal data and all information regarding the processing in question.
  • Right to rectification – the data subject has the right to request correction of personal information that ARSOPI-THERMAL holds about them that is outdated, incorrect, or incomplete.
  • Right to erasure – the data subject has the right to request erasure of their personal data in certain situations. This allows them to ask ARSOPI-THERMAL to delete personal information concerning them if there is no acceptable reason for continuing to process it.
  • Right to restriction of processing – the data subject has the right to request restriction of processing of their personal data, for example, if they want us to verify its accuracy or the basis for processing.
  • Right to data portability – the data subject has the right to request portability of their personal information to another controller.
  • Right to object to processing – the data subject has the right to object to processing of their personal data when ARSOPI-THERMAL is processing that data based on legitimate interest.
  • Right to withdraw consent – In situations where the data subject has given consent for collection and processing of their personal data for a specific purpose, they have the right to withdraw their consent at any time. Such withdrawal of consent does not compromise processing of data carried out based on previously given consent.

You may also request more detailed information, namely about purposes, lawful bases, and retention periods, and likewise submit complaints to ARSOPI-THERMAL about how your personal data are processed, without prejudice to also being able to do so with the competent authority.

Exercise of these rights can be done via email: thermal@arsopi-thermal.pt. ARSOPI-THERMAL may request specific information about you to confirm your identity and ensure response to exercising rights. This is a security measure to ensure that your personal information is not disclosed to anyone not authorized to access it.

Exercising rights does not imply payment of any fee. However, ARSOPI-THERMAL may charge a reasonable fee considering administrative costs of providing information if requests are clearly unfounded or excessive, particularly due to their repetitive nature. Alternatively, ARSOPI-THERMAL may, in such circumstances, refuse to comply with the request.

Data subjects have the right to lodge a complaint with the National Data Protection Commission (CNPD), if they consider that processing of their personal data by ARSOPI-THERMAL violates the General Data Protection Regulation (GDPR) or applicable national legislation on privacy and data protection. The complaint can be submitted directly to CNPD through the following official contacts: Email: geral@cnpd.pt, available on the website: www.cnpd.pt.

11. Under What Circumstances Do We Transfer Your Personal Data to Third Countries?

Sharing of images (video) and audio (sound) on the social networks mentioned below by the data controller may result in international transfers of personal data to a third country or an international organization. It is important to clarify that ARSOPI-THERMAL does not share personal data collected on its website on social networks, despite maintaining institutional presence on them. Any processing carried out on these platforms results exclusively from the interaction that the user themselves establishes directly with the social network operator.

Thus, we must inform that ARSOPI-THERMAL has limited influence on data processing carried out by social network platform operators.

The social network platform operator operates the entire IT infrastructure of the service, defines its own data protection rules, and maintains its own relationship with users. Moreover, the operator is solely responsible for all issues related to user profile data, to which ARSOPI-THERMAL has no access.

We must also inform that transmission and/or subsequent disclosure of images (video) and audio (sound) on social networks entails risks, particularly regarding reuse of personal data for purposes different from what occasional sharing on social networks entails.

For more information about data processing carried out by the social network platform operator, consult the operator's privacy policy:

In this sense, within the scope of platform use, your personal data will generally also be processed and stored on servers located in third countries, as better defined by the aforementioned policies, which are the exclusive responsibility of the respective platform operators. The data subject acknowledges that images (video) and audio (sound), once made available online, are susceptible to being reused and disseminated by third parties.

12. What Security Measures Are Adopted?

ARSOPI-THERMAL uses various security measures, including authentication tools, encryption, and digital certificates to help protect and maintain the security, integrity, and availability of your personal data.

Although data transmission over the internet or website cannot guarantee total security against intrusions, ARSOPI-THERMAL and its service providers and business partners employ best efforts to implement and maintain physical, electronic, and procedural security measures designed to protect Data Subjects' personal data in accordance with applicable data protection requirements.

13. Changes to the Privacy Notice

This Privacy Notice may be updated or changed at any time without prior notice.

All updates to the Privacy Notice will be communicated through a notice on our Website: https://www.arsopi-thermal.pt/pt/ so that such changes can be immediately understood.