Privacy

1. INTRODUCTION 

The Navigator Company, S.A., with the Portuguese legal person identification number (NIPC) 503.025.798, registered under the same number at the Commercial Registry Office of Setúbal, with headquarters at Península da Mitrena 2910-738 Setúbal, with share capital of €500,000,000.00 (henceforth referred to as "Navigator") is the entity responsible for the processing and protection of personal data processed by the Navigator Group.

2. PURPOSES OF THE PROCESSING AND LEGAL BASIS

Navigator will process personal data manually and/or automatically for the following specific purposes:

Ø    Contact management

• Purpose: To respond to inquiries, requests for clarification or complaints, using the physical and digital means provided for this purpose;
• Basis: Navigator's consent and legitimate interest in guaranteeing a response to any request for information;
• Personal Data: identification and contact details;
• Retention Period: For as long as you do not object to the processing or withdraw your consent and for the period necessary to respond to the request.

Ø    Recruitment

• Purpose: Presentation, analysis and selection of candidates, which includes the analysis of applications, as well as the internal process of selecting new employees according to the needs detected;
• Basis: Consent, pre-contractual diligence, legitimate interest in analysing submitted applications according to previously defined criteria and/or compliance with legal obligations;
• Personal Data: identification, contact, academic and/or professional data;
• Retention Period: 2 (two) years from the date they were received or since they were last updated.

Ø    Institutional and school visits

• Purpose: Management of the visits process in accordance with the internal procedure;
• Basis: Consent and legitimate interest;
• Personal Data: Identification, contact details, professional and/or academic details and reasons for the visit;
• Retention period: 1 (one) year.

Ø    People and property protection

• Purpose: Protection of people and property on Navigator's premises;
• Basis: Compliance with a legal obligation and Navigator's legitimate interest in ensuring the safety of visitors and property on its premises;
• Personal Data: Identification, image, professional and/or academic and reason for visit;
• Retention period: 30 (thirty) days.

Ø    Service acquisition

• Purpose: Procurement of services, contracting and execution of services by Navigator;
• Basis: Pre-contractual due diligence and execution of the service contract;
• Personal Data: Identification and contact details;
• Retention Period: For the period necessary for the procurement of the service in question and the execution of the contract signed.

Ø    Business relation (1)

• Purpose: Analysis of new clients, suppliers and potential conflicts of interest;
• Basis: Legitimate interest and pre-contractual due diligence;
• Personal Data: Identification, contact and professional occupation;
• Retention Period: 2 (two) years.

Ø    Business relation (2)

• Purpose: Opening files, registering and managing suppliers and customers;
• Basis: Navigator's legitimate interest in organizing its commercial portfolio of suppliers and customers;
• Personal Data: Identification, contact and professional data;
• Retention Period: 20 (twenty) years after termination of the contract.

Ø    Invoicing and accounting management

• Purpose: Accounting for expenses, controlling costs and reimbursements, invoicing and managing checking accounts and maintaining an archive of accounting records and supporting documentation;
• Basis: Execution of contract, legitimate interest in maintaining efficient management control, invoicing or liquidating services rendered on time and ensuring compliance with applicable legal obligations;
• Personal data: Identification, contact and accounting data;
• Retention period: 10 (ten) years.

Ø    Compliance

• Purpose: Fulfilment of legal obligations in the area of Compliance;
• Basis: Fulfilment of Navigator's legal obligation;
• Personal Data: Identification and contact details;
• Retention Period: 7 (seven) years after the customer or supplier has been identified or, in the case of business relationships, after their termination.

Ø    Audits

• Purpose: Conduct and execute internal audits;
• Basis: Compliance with legal obligation and Navigator's legitimate interest in promoting internal audits to comply with best practices (e.g., International Accounting Standards)
• Personal Data: Identification and professional details;
• Retention Period: 3 (three) years from the date on which they were received or since they were last updated.

Ø    Sending communications

• Purpose: Disclosure of news, products, training sessions, technical information, promotional and advertising campaigns, advertising contests, hobbies related to our activity;
• Basis: Navigator's consent or legitimate interest in maintaining a personalized communication;
• Personal Data: Identification and contact details;
• Retention Period:  For as long as you do not object to the processing or withdraw your consent.

Ø    Organization and management of events

• Purpose: Internal and external disclosure, management of participations and communications with participants in events, conferences and seminars;
• Basis: Navigator's consent and legitimate interest in organizing and promoting its events;
• Personal Data: Identification and contact details;
• Retention Period: For the period necessary to communicate and organize the event and for subsequent relevant communications, without prejudice to the right to withdraw the consent given.

Ø    Participation in directories or award nominations

• Purpose: Navigator's participation in directories or award nominations in the forestry sector;
• Basis: Legitimate interest in promoting the culture and excellence of Navigator and its employees;
• Personal Data: Identification, professional occupation and, when applicable, contact details;
• Retention Period: For the duration of the file or dossier.

Ø    Statistical operations

• Purpose: Surveys, market research, evaluation/opinion inquiries;
• Basis: Consent;
• Personal Data: Identification, contact, geographical location, Navigator’s products, and preferences. This data will be anonymized or pseudonymized as regards the impossibility of re-identification once the statistical operation has been completed.
• Retention Period: For as long as deemed necessary, with the addition of appropriate technical and organizational measures to guarantee the rights of the data subjects.

Ø    Use of websites and interactions

• Purpose: Provision of websites and analysis of the use and interaction with them;
• Basis: Navigator's legitimate interest in optimizing the browsing experience or consent, as applicable;
• Personal Data: Data relating to interaction with our websites. For more information on this processing, please consult the respective Cookies’ Policy.
• Retention Period: 2 years in accordance with the Cookies’ Policy.

Ø    Download and use of NVG apps

• Purpose: Provision of digital tools within the scope of Navigator’s activities;
• Basis: Consent;
• Personal Data: Identification and contact details;
• Retention Period:  For as long as the consent is maintained.

Ø    Exercise or defence of rights in administrative, judicial or extrajudicial proceedings

• Purpose: For administrative, judicial and extrajudicial collection and claims, which includes, without limitation, the collection and recovery of amounts owed by its customers and suppliers and the defence of Navigator's reputation;
• Basis: Legitimate interest in satisfying your claims and defending your rights;
• Personal Data: Identification;
• Retention Period: Until payment of the amounts owed or resolution of the dispute, as applicable.

In certain situations, Navigator may determine, together with other entities of the Navigator Group, different purposes for which the data subject will have prior knowledge.

3. DATA COMMUNICATION

We hereby inform that personal data may be communicated to Navigator Group entities which, in some cases, may act as co-responsible parties. These entities pledge to process personal data solely and exclusively for the fulfilment of the purposes identified above.

Navigator may also communicate the personal data to third parties as long as it has obtained consent or when:

(i)            The transmission is made in compliance with legal obligations or court order; and

(ii)           The communication is made to protect vital interests or any other legitimate purpose foreseen by law.

4. SUBCONTRACTORS

Navigator may hire external service providers, acting as subcontractors, to provide services in different areas (e.g., communications services, IT consultancy).

In this regard, Navigator follows strict criteria when selecting service providers in order to comply with its data protection obligations, pledging to subscribe a data processing agreement with them which includes, among other things, the following obligations:

• Apply appropriate technical and organizational measures;
• Process personal data for the agreed purposes and respond exclusively to Navigator's documented instructions;
• Delete or return the personal data to Navigator’s upon completion of services.

5. INTERNATIONAL DATA TRANSFERS

Navigator will process personal data within the European Economic Area. However, in certain cases, it may carry out international transfers in order to comply with legal obligations, or in cases where it proves necessary to contract a service, as long as the third country ensures an adequate level of protection of personal data in accordance with the directives and agreements celebrated with the European Union.

6. RETENTION PERIODS

The period for which we store personal data may vary depending on the purpose for which they were processed. In the event that the personal data is used for several purposes, which require Navigator to keep it for different periods, the longest retention period will apply.

7. RIGHTS OF THE DATA SUBJECT

It is possible, at any time and free of charge, to exercise the rights of access, rectification or elimination, opposition, limitation and portability of personal data, through written communication sent to DPO_NVG@thenavigatorcompany.com, under the terms established in the applicable legislation:

Access: You can obtain information on whether we are processing your personal data, as well as consult your personal data included in the Navigator archives;

Rectification: You can change your personal data when they are incorrect or complete those which are incomplete.

Erasure: You can request the elimination of your personal data when, among other reasons, the personal data is no longer necessary for the purposes for which they were collected.

Objection: In certain situations, you may request that for your personal data to cease being processed. Navigator will cease the processing of personal data, except if there are legitimate grounds or for the declaration, exercise, or defence of rights in an administrative, judicial or extrajudicial proceeding.

Restriction of processing: You may request the restriction of the processing of your personal data in the following situations: (a) during the dispute of the accuracy of your personal data; (b) when the processing is illicit and you have opposed to it and requested the restriction of the use of the personal data; (c) when Navigator no longer needs to process your personal data, but needs it for the exercise or defense of rights in an administrative, judicial or extrajudicial proceeding; (d) when you have opposed to the processing of your personal data for the fulfillment of an obligation of public interest or for the satisfaction of a legitimate interest, for as long as such legitimate grounds for processing prevail over those reasons.

Portability: In certain situations, you will have the right to receive, in a structured, commonly used and automatically readable format, the personal data you have made available to us and those obtained from your relationship with Navigator, as well as to transmit them to another entity.

To exercise your rights, if necessary, you must provide proof of identity. You must also indicate the right you wish to exercise. The exercise of rights is free of charge, except in the case of a manifestly unfounded, excessive or repeated request.

In any case, we inform that if you consider that Navigator has violated, or may violate, your rights under the legislation regarding the protection of personal data, you may file a complaint with the National Data Protection Commission (CNPD) via the telephone number 213928400 or the e-mail geral@cnpd.pt.

Under-aged persons may not use Navigator’s available services without the prior authorization of their parents, guardians or legal representatives, who will be solely responsible for all acts carried out by the minors in their charge, including filling in the forms with the personal data of these minors and checking the corresponding boxes, if applicable.

8. WITHDRAWAL OF CONSENT

The acceptance that personal data may be processed or transferred will always be revocable, without retroactive effect. To revoke consent, you can contact Navigator by writing to DPO_NVG@thenavigatorcompany.com.

9.REQUIRED NATURE OF THE SOLICITED DATA

The data that is marked with an asterisk (*) in the forms provided by Navigator via its platforms will be required in order to fulfil the established purpose. Therefore, if they are not provided, Navigator will not be able to fulfil the request in question.

10. AUTOMATED DECISIONS

Navigator may develop profiles, which will allow to adopt automated decisions, based on personal characteristics, preferences, behavioural history, and location (in this case, regarding the participation in certain promotions). In these cases, you have the right to obtain human intervention in the decision, to express your opinion and to challenge the decision adopted by Navigator.

11.PERSONAL DATA PROTECTION MEASURES

Navigator implements appropriate technical and organizational measures to ensure the protection of personal data, as well as to prevent unauthorized access to data, improper use, disclosure, loss or destruction.

Navigator makes every effort to protect personal data from unauthorized access via the Internet. To this end, it uses security systems, rules and other procedures to ensure the protection of personal data and to prevent unauthorized access to data, improper use, disclosure, loss or destruction.

It is, however, the responsibility of the data subject to guarantee and ensure that the computer it uses is adequately protected against harmful software, computer viruses and worms. Additionally, the data subject should be aware that without the adoption of appropriate security measures (e.g., secure browser configuration, updated antivirus software, security barrier software and the non-use of software of doubtful origin), the risk of personal data and passwords being accessed by unauthorized third parties is aggravated.

It should be noted that whenever data is collected on open networks, such as the Internet, personal data may circulate without security conditions and there is a risk that it may be seen and used by unauthorized third parties.

12. CHANGES TO THE PRIVACY POLICY

Navigator reserves the right, at any time, without notice and with immediate effect, to amend, add to or revoke, in whole or in part, this Privacy Policy. Any changes will be immediately disclosed on this same online page; therefore we recommend its regular consultation for periodic review.

This policy is subject to regular review to verify that it complies with the applicable legal requirements and best practices in terms of personal data protection.

[Lisbon, January 24^th, 2024]