Privacy Policy
Version 1 — 09/10/2014
1. Introduction
1.1 MK – IS Consultoria Informática, Lda. and ATENASOFT, Lda. are two private limited companies, hereinafter referred to as Grupo MK, whose activities include, among others, the sale of software applications and IT services.
1.2 Taking into account the proportionality and suitability imposed by the resources and technical means available to it, Grupo MK is deeply and genuinely committed to protecting its customers, service providers and regular or occasional staff, as well as all users of its various physical and digital media and platforms — namely paper files, digital files, software applications and websites in use or to be implemented — with regard to their privacy and the processing and movement of their personal data.
1.3 An information system means an organised set of elements used to manage information, whether manual, automated, computerised, people-based or otherwise. The provisions of the GDPR naturally apply to all types of data management.
1.4 We undertake to identify within our organisation all the systems used, who uses them, the types of data processed, how the data is managed and how it is transmitted both internally and externally.
2. Purpose
2.1 When you use and contract the services provided by Grupo MK, you entrust us with your information. This privacy policy is intended to help customers, service providers and all staff understand what data we collect, why we collect it and what we actually do with it.
2.2 The General Data Protection Regulation — hereinafter the GDPR — provides for the protection of natural persons with regard to the processing of personal data and the free movement of such data, safeguarding the fundamental rights and freedoms of natural persons, in particular their right to the protection of personal data, and promoting the lawfulness of the technical, administrative and organisational measures required for that purpose, without ever neglecting the rights of the data subjects.
2.3 The GDPR requires companies to have a legal basis for processing data. However, regardless of the legal basis applicable in each case, data subjects may always request access to, rectification and erasure of their data under the GDPR.
2.4 Protecting your personal data is an ongoing process, which is why our Privacy Policy is subject to change. However, no change may reduce or jeopardise any acquired rights without your express consent.
2.5 Any change to the privacy policy will be published on our website and, if the changes are significant, we will highlight them. In all cases, we will keep previous versions available in an archive for consultation.
3. Principles governing the processing of personal data
Any operation involving personal data must have a specific purpose, a concretely defined objective and, upstream, a legitimate ground for processing. In this context, the processing of personal data must comply with the following principles:
3.1 Lawfulness, fairness and transparency: personal data is processed lawfully, fairly and transparently in relation to the data subject, who is informed at the time of collection, by means of a notice, of the processing operations that will be carried out.
3.2 Purpose limitation: personal data is collected for specified, explicit and legitimate purposes and may not be further processed in a manner incompatible with those purposes.
3.3 Data minimisation: personal data must be adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed.
3.4 Accuracy: personal data must be accurate and kept up to date where necessary, and every reasonable step must be taken to ensure that inaccurate data, having regard to the purposes for which it is processed, is erased or rectified without delay.
3.5 Storage limitation: personal data must be kept only for as long as necessary for the purposes for which it is processed.
3.6 Integrity and confidentiality: personal data is processed in a manner that ensures its security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage.
4. Role of the entity under the GDPR
4.1. As data controller
4.1.1 Grupo MK, as data controller, is the legal person which, directly and individually and/or jointly with others, determines the manner, purposes and means of processing personal data.
4.1.2 Accordingly, in the relationships it establishes as controller with data subjects — whether its customers (natural persons), employees or service providers — and always in compliance with the applicable law, Grupo MK determines the personal data collected, the means of processing and its purposes.
4.2. As processor
4.2.1 Under the GDPR, a "processor" is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller, cf. Article 4(8) of the GDPR.
4.2.2 In the course of Grupo MK's business, whether in the provision of services or in the supply and management of the software applications it develops, MK acts as a "processor" under the GDPR.
4.2.3 In these relationships, MK processes personal data of partners, employees, customers, users, assisted persons or any other "third parties" involved in the business relationship between MK and a partner/customer/service provider, being responsible, on their behalf, for processing and storing the data for the duration of the contractual relationship.
4.2.4 The types of personal data collected in such operations include name, email, phone/mobile number, vehicle registration number, location, case number, home address, loading and unloading locations, vehicle photographs, operator email/username and password, and operator analytics and statistics.
4.2.5 Grupo MK, as processor, will enter into an agreement with all the third parties identified above governing responsibilities for the processing of personal data.
4.2.6 Without prejudice to the provisions of that agreement, Grupo MK will inform the controller of any personal data breach relating to the direct or indirect relationships arising from the existing contract between the parties, and will notify the Portuguese Data Protection Authority accordingly.
4.2.7 Grupo MK will assist controllers in responding to requests from data subjects to exercise the rights conferred by the GDPR.
4.2.8 Grupo MK will make available to the controller all information necessary to demonstrate compliance with the obligations arising from the contractual relationship.
4.2.9 Grupo MK undertakes to delete and/or return to the controller the personal data made available to it when the contractual relationship ends.
4.3. As joint controller
4.3.1 Under the GDPR, where two or more controllers jointly determine the purposes and means of processing, they are joint controllers, as provided for in Article 26(1) of the GDPR.
5. Concept of personal data
5.1 Under Article 4(1) of the GDPR, personal data means "any information, regardless of its nature and the medium on which it is stored, relating to an identified or identifiable natural person, known as the data subject".
5.2 An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
6. Processing of personal data
6.1 Processing of personal data means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
6.2 We are committed to protecting our customers, service providers and employees against unauthorised access, alteration, disclosure or destruction of information under our responsibility, namely by reviewing our information collection, processing and storage practices — including physical security measures — and by restricting access to personal information to Grupo MK employees, contractors and agents who genuinely need to know it, subject to strict confidentiality obligations, without prejudice to the administrative and judicial protection provided for in Portuguese Law no. 58/2019 of 8 August — the Personal Data Protection Law.
7. Data controller
7.1 The controller may be a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
8. Data Protection Officer
8.1 The main role of the data protection officer is to ensure that the processing of personal data does not conflict with or harm the rights, freedoms and guarantees of the data subject.
8.2 The need for this role does not depend on the size of the company, but on the risks that the processing carried out poses to those rights, freedoms and guarantees.
8.3 A data protection officer is mandatory where the core activities of the controller or processor require regular and systematic monitoring of data subjects, or consist of large-scale processing of special categories of data (Article 9 of the GDPR) or of data relating to criminal convictions and offences (Article 10 of the GDPR).
8.4 The data protection officer, controllers, processors and all persons involved in any data processing operation are bound by a duty of confidentiality, in addition to the duty of professional secrecy provided for by law.
8.5 Grupo MK has appointed a Data Protection Officer to support the organisation in adopting measures that ensure systematic compliance with the obligations imposed by the GDPR:
8.5.1 Name: Célia Oliveira
8.5.2 Business email: epd@grupomk.pt
9. Types of personal data within the organisation
9.1 In the context of recruiting and hiring employees, a summary record of the processing of personal data according to its purpose is maintained.
9.2 The same applies to the personal data of service providers, customers and API users, for which a summary record of the processing according to its purpose is likewise maintained.
10. How personal data is collected
10.1 Under the GDPR, companies must have a legal basis for any processing of data, and data subjects are granted specific rights depending on the legal basis used.
10.2 Processing of personal data is lawful only if and to the extent that at least one of the following applies, in accordance with Article 6(1) of the GDPR: (a) the data subject has given consent for one or more specific purposes; (b) processing is necessary for the performance of a contract or for pre-contractual steps at the data subject's request; (c) processing is necessary for compliance with a legal obligation; (d) processing is necessary to protect the vital interests of the data subject or of another person; (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority; (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, in particular where the data subject is a child.
10.3 Grupo MK ensures that the data collected is genuinely necessary, limited and relevant for each stated purpose.
10.4 Personal data is stored in specific databases and may be processed by automated or non-automated means, always in strict compliance with the data protection legislation in force.
10.5 Data collected by Grupo MK will never be used for any purpose other than that for which it was collected and consented to, unless required by law or by an overriding public interest.
10.6 Data subjects always have the right to object to processing and to request its restriction. Your objection will be respected and Grupo MK will stop processing your information, unless the processing is based on compelling legitimate grounds or is required for legal reasons.
10.7 Grupo MK may, for statistical purposes only, analyse the performance of its operations, provided this does not conflict with the personal data protection policy and other applicable legislation.
11. Conditions for consent
11.1 Where processing is based on consent, the controller must be able to demonstrate that the data subject has given consent.
11.2 The data subject has the right to withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand. It must be as easy to withdraw consent as to give it.
12. Personal data breaches
12.1 A personal data breach occurs when a breach of security leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
12.2 In the event of a breach, Grupo MK will notify the controller, where applicable, the supervisory authority or the data subject, depending on whether the breach is likely to result in a high risk to the rights, freedoms and guarantees of the data subject.
12.3 In the event of a breach, Grupo MK will make the notifications referred to in Articles 33 and 34 of the GDPR.
13. Retention of personal data
13.1 The retention period for personal data is that set by law or regulation or, failing that, the period necessary to achieve the purpose.
13.2 Where it is not possible to determine in advance when the data will no longer be needed, it may lawfully be retained, provided that appropriate technical and organisational measures are adopted to safeguard the rights of the data subject.
13.3 Where data is needed to prove compliance with contractual or other obligations, it may be retained until the limitation period for the corresponding rights has expired.
13.4 When the purpose that justified the processing ceases, the controller must destroy or anonymise the data.
14. Rights of the data subject
14.1 Data subjects must be informed about all operations carried out on their data in a clear and free manner, enabling them to fully exercise their rights.
14.2 In addition to the "ARCO" rights — access, rectification, cancellation and objection — data subjects also have: the right to data portability; the right not to be subject to decisions based solely on automated processing (profiling); the right to restriction of processing; the right to a response within a set period when exercising their rights; the right to be informed in the event of a breach of their rights; the right to the protection of their data; and the right to lodge a complaint with a supervisory authority.
14.3 Data subjects have the right to obtain from the controller confirmation as to whether or not personal data concerning them is being processed and, where that is the case, access to their personal data and to information on the purposes of the processing, the categories of data concerned, the envisaged retention period, the existence of the right to request rectification, erasure or restriction of processing, the right to lodge a complaint with the supervisory authority, and the source of the data where it was not collected from the data subject.
14.4 It is the responsibility of Grupo MK to adopt the most effective mechanisms to ensure that data subjects can exercise their rights, including access, updating, rectification, erasure, restriction and portability of their data.
15. Security and privacy in data processing
15.1 In order to prevent accidental, intentional or improper disclosure of personal data, Grupo MK implements a rigorous set of technical and organisational measures capable of protecting personal data against any form of unlawful processing.
15.2 Grupo MK undertakes to make every effort to ensure that these measures are complied with by everyone authorised to access personal data.
16. Disclosure of personal data to third parties
16.1 A third party is a natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and persons who, under the direct authority of the controller or processor, are authorised to process the data.
16.2 Where data is disclosed to a third party, that third party must ensure the protection of the personal data using the same technical and organisational measures as those used by the controller.
17. Commercial and promotional communications
17.1 Grupo MK processes personal data provided by data subjects in order to send electronic communications containing commercial and promotional information.
17.2 Whenever Grupo MK sends a communication of this kind, it will be addressed exclusively to data subjects who have given their prior and express authorisation.
18. Cookies
18.1 Cookies are files containing small pieces of information that are downloaded to your device when you visit a website.
18.2 Cookies help a website remember information about your visit, such as your preferred language and other settings, making your next visit more useful.
18.3 Grupo MK may use cookies on its website, as well as in the applications and IT systems it develops, to make navigation easier, store preferences and improve the user experience.
18.4 If you do not wish to receive cookies, you can set your computer or mobile device to warn you each time a cookie is sent, or disable them in your browser — which may prevent access to some features.
For specific details about the cookies (or the absence of them) used on this website, please see our Cookie Policy.
19. Exercising the rights of the data subject
19.1 Under the GDPR, you may at any time exercise your rights of access, rectification, erasure, restriction, objection and portability. Grupo MK's data protection officer can be contacted at epd@grupomk.pt.
19.2 As set out in the GDPR, Grupo MK guarantees a period of one month (extendable by two months where justified) to respond to requests.
19.3 To exercise any of your rights, you can fill in the dedicated form (in Portuguese): Data subject rights — Atena.
19.4 The controller will endeavour to respond as soon as possible, and within no more than 30 days, in a clear, concise and sufficient manner.
19.5 Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with the CNPD or another competent supervisory authority if you believe that your data is not being processed lawfully.
20. Data Protection Authority
20.1 In Portugal, the supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD): Avenida D. Carlos I, 134, 1.º, 1200-651 Lisboa · geral@cnpd.pt · cnpd.pt.
21. Complaints
21.1 If you have reason to believe that your right to privacy has been infringed, you should first contact Grupo MK's data protection officer. If you are not satisfied with the outcome, you can lodge a complaint with the CNPD using the form available at cnpd.pt.
Questions about this policy? Contact us at geral@atenasoftware.pt.