Política de privacidade e cookies

 

Introduction

This Privacy Policy was created to support Scintilla Unipessoal, Lda, tax identification number (NIF) 517190320, registered at Rua da Bouça Grande, nº 74, 4905-096, Fragoso – Barcelos, Portugal (hereinafter "Scintilla"), owner of the website www.scintilla.pt, in complying with the General Data Protection Regulation – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 ("GDPR").

This policy is complemented by other security policies relevant to the company's business, which together describe Scintilla's approach to information security and privacy.

The terms "Privacy", "Data Privacy" and "Data Protection" may be used interchangeably, as they all relate to a set of legal requirements that apply to Personal Data and go beyond data security and confidentiality – for example, requirements on transparency in the use of data and on how long it is kept.

Compliance with this policy is mandatory. All staff and partners are individually responsible for complying with it and should ask their team leaders for clarification when needed. Scintilla is responsible for setting up the appropriate mechanisms to achieve compliance. Compliance may be monitored through inspections, audits and/or written confirmations. Any employee who breaches this policy may be subject to disciplinary action.

This policy is based on the principles of the GDPR. However, national differences may apply when Scintilla processes personal data outside the EU, receives personal data from outside the EU, or processes personal data of non-EU citizens. If in doubt, please contact Scintilla using the contact details provided.

Data protection principles

In the course of our business we process Personal Data – for example, when we receive it through business opportunities, customer orders, marketing activities and other related and supporting activities. Data may be received directly from the Data Subject (for example in person, by post, email or phone) or from other sources, namely our customers, partners, subcontractors, joint controllers, support service providers and credit reference agencies.

All staff and partners must only request Personal Data that is relevant and necessary for a specific purpose and business task.

Scintilla is committed to the data protection principles set out in the GDPR:

• Lawfulness, fairness and transparency: we must have a legitimate reason to process Personal Data (for example, the Data Subject's consent or a legal obligation) and inform the Data Subject clearly about the processing;
• Purpose limitation: we only collect Personal Data for specified, explicit and legitimate purposes and do not process it beyond those purposes;
• Data minimisation: the Personal Data processed must be adequate, relevant and limited to what is necessary;
• Accuracy: we must ensure Personal Data is accurate and kept up to date;
• Storage limitation: we do not keep Personal Data for longer than necessary, although some data may be kept for historical and statistical purposes;
• Integrity and confidentiality: we have appropriate security controls to protect data against unauthorised or unlawful processing, loss, destruction or damage;
• Lawful transfers outside the European Economic Area: we only transfer Personal Data outside the EEA when appropriate safeguards, such as a contractual basis, are in place;
• Data Subject rights: Data Subjects have several rights we must respect (for example, the right to access a copy of their data and to withdraw consent to direct marketing).

Lawful and fair processing

Whenever Personal Data is collected, there must be a legal basis for processing it. Under the GDPR, at least one of the following must apply:

• Consent: the Data Subject has given consent for one or more specific purposes;
• Contract: processing is necessary to perform a contract with the Data Subject or to take pre-contractual steps;
• Legal obligation: processing is necessary to comply with a legal obligation of the controller;
• Vital interests: processing is necessary to protect the vital interests of the Data Subject;
• Public interest: processing is necessary to perform a task carried out in the public interest;
• Legitimate interests: processing is necessary for the controller's legitimate interests, except where the Data Subject's interests or fundamental rights and freedoms prevail.

When we act as controller, we must ensure we have a legitimate basis to collect and process Personal Data. In some situations we may act as a processor on behalf of a client, in which case the client is responsible for having a valid basis for processing and sharing it with us. When special categories of data are processed, additional conditions apply – please contact Scintilla for guidance.

The GDPR requires us to inform Data Subjects about how their data is processed. When information is collected through our website, this is done through a privacy notice. Please see this Privacy Policy and the Cookie Policy below for more information.

Processing for specific purposes only

We only use Personal Data for the specific purposes communicated to the Data Subject. Scintilla never processes Personal Data for additional purposes that have not been communicated to the Data Subject.

Adequate, relevant and limited processing

We follow the principle of data minimisation: we collect only the minimum Personal Data needed for a specific task, while making sure we have enough data to carry it out properly. This also applies to sharing and other processing activities.

Accuracy of Personal Data

We must keep Personal Data accurate and up to date and have appropriate processes to do so. When acting as a processor for a client, keeping that data up to date is the client's responsibility as controller.

Retention of Personal Data

Personal Data must not be kept for longer than necessary. The following retention periods may apply: (i) as long as necessary for the relevant activity or service; (ii) any retention period required by law; (iii) until the end of the period in which disputes or investigations may arise regarding the services; or (iv) the minimum period set out in the contract.

Data Subject rights

The GDPR requires us to inform people about the Personal Data we collect and the purposes and means of processing it.

a) Right of access – Data Subjects may ask to see the Personal Data we hold about them, the purpose of processing and the categories of data concerned. We will inform them of the recipients of their data (especially if located in another country or an international organisation), the retention period, their right to object, rectify and erase, their right to lodge a complaint with a supervisory authority and, where data was not collected from them, its source. We respond to access requests without undue delay and within one month at the latest.

b) Right to rectification – Data Subjects have the right to have inaccurate data corrected, and Scintilla will do so promptly.

c) Right to erasure – Data Subjects have the right to have their data erased ("right to be forgotten"). Scintilla will do its best to erase the data promptly, unless there is a legal requirement to keep it.

d) Children's rights – Everyone, including children, is protected by the GDPR. We do not process the Personal Data of children under 13 on the basis of their consent without authorisation from the holders of parental responsibility.

e) Marketing – We may send customers and partners marketing communications about services, upcoming events or other activities of interest. In that case we always state the right to withdraw consent at any time, and we have processes to record and respect all preferences.

Security of stored data

Scintilla protects the Confidentiality (only authorised people can access the data), Integrity (data is accurate and fit for purpose) and Availability (authorised users can access the data when needed for authorised purposes) of Personal Data.

Disclosure of data

All staff and partners must avoid any inappropriate disclosure of Personal Data. Personal Data may be disclosed: to third parties only under instruction or with a legitimate basis and no restrictions in place; in the event of the sale or purchase of a business or assets, or as a joint controller in a joint venture; to third parties processing data on our behalf, which may include transfers to a third country; to staff or agents so they can perform their duties; where non-disclosure would prejudice the prevention or detection of crime, the prosecution of offenders or the assessment or collection of any tax; when required by law or court order, to obtain legal advice, in connection with legal proceedings or to defend legal rights, or to safeguard national security. All disclosures must be justified and documented.

International transfers of Personal Data

Scintilla may transfer Personal Data to a third country or international organisation, or have it processed by staff or suppliers operating in a third country, provided at least one of the following applies: the country ensures an adequate level of protection according to a European Commission decision; appropriate safeguards are in place (such as standard data protection clauses); the Data Subject has given explicit consent after being informed of the possible risks; the transfer is necessary for one of the reasons set out in the GDPR, including the performance of a contract with the Data Subject or the protection of their vital interests; or the transfer is legally required for important reasons of public interest or for legal claims.

Log information, cookies and web beacons

The Scintilla website uses cookies to distinguish its users and collects standard internet log information, including the user's IP address, browser type and language, access times and referring website addresses. To ensure the website is well managed and easy to navigate, Scintilla or its service providers may also use cookies or web beacons to collect aggregated data.

Staff information

As an employer, Scintilla collects, processes and stores personal data of employees, contractors, consultants and candidates only where there is a valid and legitimate purpose and a documented legal basis. We provide appropriate data protection training to all staff and assess the privacy and security impact of any new systems or procedures involving Personal Data.

COOKIE POLICY

This website uses cookies to give visitors a better experience and to make sure it works properly. This Cookie Policy is part of our Privacy Policy. Cookies are small text files downloaded to your computer or device that allow the website to recognise you and remember your preferences on each visit. More information about cookies is available at aboutcookies.org. By using this website you accept the use of cookies as described here.

Which cookies do we use and why?
Some cookies are necessary to browse the website and use its features, such as secure areas for registered users. We also use functional cookies to remember your choices (for example language or region), analytics services to measure the effectiveness of our content, and web beacons/tracking pixels and performance cookies to count visitors and see how the website is used. This information is used for statistical purposes only, without identifying individual users; for registered users who are signed in, it may be combined with analytics data to better understand how the website is used. For detailed information about the cookies we use, please contact us by email.

How to control cookies
You can view, delete or block cookies in your browser settings. Removing or blocking cookies may affect your experience and limit access to some areas of the website. Preferences you have set are lost when cookies are deleted. More information: cookiecentral.com.

Analytics cookies
We use the following providers, where you can learn more about their privacy policies and how to opt out: Google Analytics (google.com/analytics/learn/privacy.html) and Facebook Pixel (facebook.com/business/help/742478679120153).

Social buttons
We use social buttons so you can share or bookmark pages. These social networks may collect information about your online activity, including on our website. Please check their own Terms of Use and Privacy Policies.

Email communications
We may use tracking technologies to see whether our emails were read, clicked or forwarded. If you do not agree, you can unsubscribe at any time using the link in our emails or by contacting us by email.

This Cookie Policy may be updated at any time. Changes take effect from the revision date shown below.

Last updated: October 2026