Kleya is committed to protect the privacy of its Clients and the Users of its websites. In this context, this Privacy, Safety and Data Protection Policy was prepared to affirm this commitment and respect for the rules of privacy and protection of personal data.
Thus, and when in this Privacy Policy we refer to Kleya, we are referring to a consultant who can be trusted by foreign nationals that wish to retire, live or invest in Portugal.
Why?
We want our clients and users to know the general rules regarding privacy and the handling of the data that we store in strict respect and compliance with European legislation, specifically the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016 - GDPR).
Kleya seeks to respect best practices in matters of safety and the protection of personal data, through the promotion of actions and improvements to systems that ensure the protection of the data provided by our Clients and Users.
The use of our websites, products and digital services, the completion of our forms and providing data directly, imply the knowledge of this privacy and safety policy and the acceptance of the General Terms, Policies and Conditions of Use and of other specific terms, policies and conditions of the subscribed services. Upon subscribing to our services, carefully read the respective terms and conditions. Upon providing your personal data, you authorize the registration, handling, use and disclosure of these in accordance with the rules defined herein.
Who is responsible for data management?
References in this Privacy Policy to "Kleya", "we", "us" or "our" shall mean the following entity:
Address: Praça Príncipe Perfeito n°2, 1990-278 Lisboa
Tax Number: 513502416
Contact: +351 211 214 983
This entity will be the data controller in accordance with the General Data Protection Regulation.
Kleya provides this service and within this context adequately decides, always in strict compliance with the Personal Data Protection Law, which data will be recorded, the means for handling this data and the format and purpose for which these are used.
Kleya may record your data by telephone, in writing or through its website and applications. As a rule, personal data are recorded when Client registers for one of our products or services, or when an order or contact is made through our website or through our Customer Service Centre.
The supply of some personal data is obligatory because it is necessary for the performance of the contract, and in the event that this data is lacking or is insufficient, Kleya may not render the service or supply the product in question. In these cases, the Client or user will be duly informed regarding the obligatory nature of this data to continue the process.
The recorded personal data are handled electronically and in strict compliance with the Personal Data Protection Law, and these are stored in specific databases created for this purpose.
What are personal data?
Personal data includes any information collected by us, or supplied by the Client or user, regardless of the means used for such collection, including sound and images, for individuals which allow themselves to be identified.
Personal data is considered to be any information about an individual who is identified, or becomes identifiable, by means of such information, and whose identification can occur directly or indirectly, specifically through an identification number, name, date of birth, telephone, e-mail, address or other elements.
All personal information that Kleya may collect when the Client or user visit the website are: (i) necessary for the performance of the contract/relationship to which the client is party or in order to take steps at the request of the client prior to entering into a contract/relationship; (ii) collected with prior consent from the Client or user; (iii) necessary for compliance with a legal obligation to which Kleya is subject (iv) necessary for the purposes of the legitimate interests pursued by the controller or by a third party. All of the data are treated in conformance with GDPR and the Portuguese law (Lei nº 58/2019, de 08 de Agosto). The present data protection policy is in line with the guidelines by which Kleya is governed, actively committed to respect the privacy of its clients and users.
What type of personal data do we process?
Kleya records and handles personal data which is required for the rendering of services and/or the registration for features, products, services, or communication, including in this scope data such as:
Some personal data is mandatory and, in case of lack or insufficiency of such data, Kleya will not be able to provide the product or service in question. In such cases, the Customer or user will be duly informed of the obligation to provide such data. Applicable when you subscribe to a plan or create an Account on our sites.
Some personal data is mandatory and in case of lack or insufficiency of such data Kleya will not be able to provide the product or service in question. In such cases the Customer or user will be duly informed of the obligation to provide such data. Applicable when subscribing to a plan.
When providing data to third parties, you should ensure that you have been authorized by them to provide us with their personal data, as well as inform them of the way in which Kleya processes personal data in accordance with this Policy.
When subscribing products, we may process personal data of the household or other people included in the service, which has been provided to us by the plan owner.
Kleya is particularly concerned with the protection of the rights of minors and therefore the collection of personal data of people under 18 years of age is subject to the consent of their parents/guardians. For this purpose, when collecting data from minors, the consent of the parents/guardians of the minors will be requested.
In order for us to process the services payments.
Applicable when you contact Kleya or are contacted by Kleya.
Applicable when you participate in our satisfaction surveys/questionnaires.
Applicable when you use our websites or applications in accordance with our Terms and Conditions of Use of Tracking Technologies (cookies).
In order for us to process your complaint.
Kleya also records traffic and localization data with prior consent from the Client or user, without prejudice to the fulfilment of legal standards.
For what purposes are personal data used?
The personal data supplied or collected are generally used to:
We use your above information to provide our products and services.
Occasionally, we may contact you by e-mail, phone call or SMS for administrative or operational reasons, for example, in order to send you confirmation of your payments as well as to inform you about complaints processing. As these communications are not undertaken for marketing purposes, you will continue to receive them even if you have opted out of marketing communications. We will also use your personal data to respond to your requests, suggestions or contacts, to improve our services and your customer experience.
We may send you marketing communications if you have indicated that you wish to receive them. If you agree to receive marketing communications, we will send you newsletters with news from us, such as new products you may be interested in or offers you may like. Please note that we do not share your personal data with other companies for marketing purposes unless we have your consent to do so. If you do not wish to receive further marketing communications from us, simply click the unsubscribe link at the bottom of any Kleya marketing communication.
The business purposes for which we use your information include accounting, billing and auditing, security, legal and procedural purposes, statistical studies, as well as systems development and maintenance.
In particular, the obligation to provide your personal data to the Tax Authority.
For how long is your personal data stored?
The personal data collected is treated in strict compliance with the applicable legislation, and is stored in specific databases created for this purpose. The period for which the data is stored and retained varies according to the purpose for which the information is used. The data necessary for the provision of the subscribed products and services will be kept for as long as you maintain your relationship with us, unless we are obliged by legal requirements to keep the data for a longer period.
With regard to the processing of personal data for which your consent is required (i.e. marketing), the data will be kept until you revoke your consent.
What are the Data Subjects Rights?
In accordance with the provisions of the GDPR, the owner of the data is guaranteed, at any time:
You may request, at any time, the exercise of the rights listed above (with the exception of data strictly necessary for the provision of the service) by e-mail to privacidade@kleya.eu.
Without prejudice to any other administrative or judicial appeal, the data subject has the right to lodge a complaint with the CNPD or other supervisory authority competent under the law, if he or she considers that his or her data is not being legitimately processed by Kleya, in accordance with applicable law and this Policy.
Under what circumstances is there data communication with other entities?
Kleya may utilize other entities for the rendering of specific services. Eventually these services may imply access by these entities to the personal data of Clients and/or users.
Thus, any entity subcontracted by Kleya will handle the personal data of our Clients and/or users, in the name of and on behalf of Kleya, under strict obligation to adopt the measures required to ensure the protection of the personal data from destruction, whether accidental or illicit, accidental loss, change, disclosure or unauthorised access, and from any other form of illicit handling.
Kleya seeks to ensure that these processors are carried out with the highest guarantees in terms of safety and reputation.
The Client or user data may need to be preserved and communicated for the use of the competent authorities, in compliance with legal obligations, in the event that Kleya is notified by these entities to supply these, always in strict compliance with GDPR.
In what circumstances can your personal data be transferred?
The rendering of specific services by Kleya may result in the transfer of your data out of Portugal.
In such a case, Kleya will rigorously comply with the applicable legal dispositions in respect to the protection of personal data and the applicable requirements to such transfers, namely by informing the Client or user.
What are the security measures adopted by Kleya?
Kleya is committed to ensure the confidentiality, protection and security of its clients' personal data by implementing appropriate technical and organizational measures to protect their data against any form of improper or illegitimate processing and against any accidental loss or destruction of such data.
Because we recognize the sensitivity of this subject, we have drawn up and disclosed a Personal Data Protection Policy to all our employees, in order to ensure that they are aware of the obligations imposed on them in this regard. To ensure the ongoing awareness of our employees, we have also developed training sessions for them, who undertake to not disclose to third parties or use for purposes contrary to law, any personal information of Kleya customers that they learn while performing their work duties.
In this context, Kleya has also appointed a Data Protection Officer ("DPO") to monitor compliance with applicable policies and standards on personal data protection.
How can I clarify any doubt about data protection?
You may contact the Data Protection Officer ("DPO") of Kleya at dpo@kleya.eu. For further information about the actual processing of your Personal Data, as well as any questions related to the exercise of your rights under applicable law, and in particular those referred to in this Policy, you may contact the Controller by e-mail at privacidade@kleya.eu
How can I be informed of any changes of this Policy?
Kleya reserves the right to make changes or updates to its Privacy, Safety and Data Protection Policy at any time, and these changes will be duly updated on this page. We suggest that you regularly consult it to be aware of any eventual changes.
Date: 22/06/2022