This Privacy Policy intends to make known to our Customers and Visitors the general rules of privacy and treatment of their personal data, which we collect and treat in strict respect and compliance with the Personal Data Protection Law.

The Privacy Policy is related to the current website, we are not responsible for any content or privacy policy of other websites. Any external links will be clearly identified.

By accessing this website, you undertake to accept and respect this Privacy Policy.

 

A. GENERAL PART

Within the scope of the services and communications provided by CAROLDU, as responsible for the treatment, it may request users to provide personal data, that is, information provided by the User that allows CAROLDU to identify and/or contact him ("Personal Data" ).

Through this Privacy Policy, CAROLDU provides the User, under the terms of their right to information established in the General Regulation on Data Protection (Regulation (EU) 2016/679, of the European Parliament and of the Council, of April 27, 2016) and the Personal Data Protection Law (Law nº 58/2019, August 8), detailed information about the nature of the data collected and about the purpose and treatment that will be carried out in relation to your Personal Data.


1. COLLECTION AND PROCESSING OF PERSONAL DATA

1.1. PERSONAL DATA CATEGORIES

CAROLDU collects and processes the personal data of users (customers, visitors, vendors and affiliates) in order to pursue the purposes for which they were collected.
Thus, the following data is collected:

• Identification data: Name, date of birth, gender and tax identification number;

• Contact details: Email, mobile phone number and address;

• Profile data: Access credentials (username and password), communication preferences (newsletters);

• Contractual relationship data: history of orders and communications within the scope of customer support and assistance;

• Bank details: bank identification number and credit card (if associated);

• Browsing and usage data (including cookies): Information regarding the use and browsing of the website and associated apps (sessions, duration of access, pages consulted, IP address).

1.2. DATA COLLECTION CHANNELS

Sonho Com Estante may collect data directly (ie, directly from the User) or indirectly (ie, through partner entities or third parties). Collection can be done through the following channels:

Direct collection: in person, by telephone, by email, through the Site or from the access credentials of social networks (social login);

Indirect collection: through partners or group companies and official entities.


2. DATA COMMUNICATION

The personal data collected is not shared with third parties without the User's consent, as is the case with communication platforms and social networks, with the exception of the following situations:

• The communications required by law, in compliance with a certain legal obligation;

• Suppliers that provide services as Subcontractors (cf. point 2.1. of this Privacy Policy); It is

• The processing of personal data, insofar as this is necessary for the provision of services and/or products by Sonho Com Estante.

2.1. SUBCONTRACTORS

Within the scope of the processing of personal data, Sonho Com Estante resorts or may resort to third parties, subcontracted by it, to, on behalf of Sonho Com Estante, and in accordance with the instructions given by it, proceed with the processing of personal data, General Data Protection Regulation and the Personal Data Protection Act (Law No. 58/2109, August 8), as well as this Privacy Policy.

Any subcontractor in this context may not transmit Users' personal data to other entities without Sonho Com Estante having previously given, in writing, authorization to do so, and are also prevented from contracting other entities without prior authorization.

Sonho Com Estante undertakes to subcontract only entities that provide sufficient guarantees for the execution of appropriate technical and organizational measures, in order to ensure the defense of the User's rights. All subcontractors are bound by a written contract which governs, namely, the object and duration of the treatment, the nature and purpose of the treatment, the type of personal data, the categories of holders and the rights and obligations of the parties.

2.2. OTHER RECIPIENTS

Sonho Com Estante may also communicate personal data to other third parties not qualified as subcontractors. These entities are subject to the duty of confidentiality and may not transmit the User's personal data to other entities without Sonho Com Estante having previously given, in writing, authorization to do so. Under the applicable legal terms, Sonho Com Estante may transmit or communicate the User's data to other entities in the event that such transmission or communication is necessary for the execution of the contract established between the User and Sonho Com Estante, or for pre-contractual procedures at the request of the User, in case it is necessary for the fulfillment of a legal obligation to which Sonho Com Estante is subject, or in case it is necessary for the pursuit of legitimate interests of Sonho Com Estante or third parties. In the event of a transmission of User Data to third parties, we will make every effort considered reasonable for the recipient to use the personal data in accordance with our Privacy Policy and in accordance with the applicable legislation on data protection.


3. GENERAL PRINCIPLES APPLICABLE TO THE PROCESSING OF PERSONAL DATA

In terms of general principles relating to the processing of personal data, Sonho Com Estante undertakes to ensure that the data processed by it are:

• Object of lawful, fair and transparent treatment in relation to the User;

• Collected for specific, explicit and legitimate purposes, not being further processed in a manner incompatible with those purposes;

• Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;

• Accurate and updated whenever necessary, adopting all appropriate measures so that inaccurate data, taking into account the purposes for which they are processed, are erased or rectified without delay;

• Stored in a way that allows the User to be identified only for the period necessary for the purposes for which the data is processed;

• Processed in a way that guarantees their security, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, with appropriate technical or organizational measures being adopted.

4. LEGITIMACY FOR PROCESSING PERSONAL DATA

The processing of data carried out by Sonho Com Estante is lawful when at least one of the following situations is verified:

• The User has given his explicit consent for the processing of personal data for one or more of the specific purposes;

• The processing is necessary for the performance of a contract to which the User is a party or for pre-contractual steps at the User's request;

• The treatment is necessary for the fulfillment of a legal obligation to which Sonho Com Estante is subject;

• The processing is necessary for the defense of vital interests of the User or another natural person;

• The processing is necessary for the legitimate interests pursued by Sonho Com Estante or by third parties (except if the interests or fundamental rights and freedoms of the User that require protection of personal data prevail).

Sonho Com Estante undertakes to ensure that the processing of personal data is only carried out under the conditions listed above and with respect for the aforementioned data protection principles.

When the processing of personal data is carried out by Sonho Com Estante based on the User's consent, the User has the right to withdraw their consent at any time. The withdrawal of consent, however, does not compromise the lawfulness of the treatment carried out by Sonho Com Estante based on the consent previously given by the User.


5. TERM OF CONSERVATION OF PERSONAL DATA

The period of time during which the data is stored and maintained varies according to the purpose for which the information is processed. There are legal requirements that require the retention of data for a minimum period of time. Thus, and whenever there is no legal and specific requirement, the data will be stored and kept only for the minimum period necessary for the purposes that motivated their collection or their subsequent processing, after which they will be deleted.


6. PURPOSES OF PROCESSING PERSONAL DATA

In general terms, Sonho Com Estante processes personal data for the following purposes:

• When you carry out purchase processes for products sold on this site, we collect your personal data (for example, email address, delivery address and telephone number) in the purchase form, only for the purpose of selling, sorting and transporting the products ordered by si;

• When you record a delivery address, we collect your personal data in order to simplify the preparation of your future orders;

• When you register on our website, we consider that you have a legitimate interest in sending commercial communications by equivalent automatic email (such as SMS) with information about new products and services similar to those previously purchased;

• User Registration on the Site;

• Allow access to restricted areas of the Site, in accordance with previously established terms;

• Provide support to the User, namely to manage contacts at the Support and Customer Service level;

• Ensure that the Site meets the User's needs, through the development and publication of content more adapted to the requests and types of Users, with a view to improving the search capabilities and functionality of the websites and obtaining aggregated or statistical information regarding the profile -type of User;

• Sending newsletters, opinion surveys or other information about products requested or purchased by the User.

7. TECHNICAL, ORGANIZATIONAL AND SAFETY MEASURES IMPLEMENTED

To guarantee the security of User Data and maximum confidentiality, we treat the information you provide us with absolutely confidential, in accordance with our internal security and confidentiality policies and procedures, which are updated periodically according to needs, as well as in accordance with the legally established terms and conditions.

Depending on the nature, scope, context and purposes of data processing, as well as the risks arising from the processing for the rights and freedoms of the User, Sonho Com Estante undertakes to apply, both when defining the means of treatment and at the time of the treatment itself, the technical and organizational measures necessary and appropriate for the protection of personal data and compliance with legal requirements.

It also undertakes to ensure that, by default, only the data that are necessary for each specific purpose of the treatment are processed and that these data are not made available without human intervention to an indeterminate number of people.

In general terms, Sonho Com Estante adopts the following:

• Regular audits in order to assess the effectiveness of the technical and organizational measures implemented;

• Awareness and training of personnel involved in data processing operations;

• Pseudonymisation and encryption of personal data;

• Mechanisms capable of ensuring confidentiality, availability and permanent resilience of information systems;

• Mechanisms that ensure the restoration of information systems and access to personal data in a timely manner in the event of a physical or technical incident.

8. TRANSFER OF DATA OUTSIDE THE EUROPEAN UNION

As a rule, Sonho Com Estante does not transfer data outside the European Economic Area. However, if this transfer is necessary to fully comply with the purposes mentioned in this Privacy Policy, Sonho Com Estante undertakes to ensure that the transfer complies with the applicable legal provisions, namely regarding the determination of the suitability of such country with regard to the data protection and requirements applicable to such transfers.


9. USE OF COOKIES

For more information on the collection, storage, access and use of cookies, please consult a Cookie Policy.



B. RIGHTS OF USERS (DATA HOLDERS)


10. RIGHT OF ACCESS TO PERSONAL DATA

Sonho Com Estante guarantees means that allow the User to access their Personal Data. The User has the right to obtain from Sonho Com Estante confirmation that the personal data concerning him or her are being processed and, if applicable, the right to access them, as well as the respective information about the purposes of the processing and retention periods of such data.


11. RIGHT TO RECTIFY PERSONAL DATA

The User has the right to request, at any time, the rectification of their personal data and, as well as the right to have their incomplete personal data completed, including by means of an additional declaration.


12. RIGHT TO DELETE PERSONAL DATA ("RIGHT TO BE FORGOTTEN")

The User has the right to obtain, from Sonho Com Estante, the deletion of their data when one of the following reasons applies:

• User Data is no longer necessary for the purpose for which it was collected or processed;

• The User withdraws the consent on which the processing of data is based and there is no other legal basis for said processing;

• The User opposes the treatment under the right of opposition and there are no prevailing legitimate interests that justify the treatment;

• If User Data is processed lawfully;

• If User Data has to be erased to comply with a legal obligation to which Sonho Com Estante is subject.

Under the applicable legal terms, Sonho Com Estante is under no obligation to erase personal data to the extent that the processing proves necessary to comply with a legal obligation to which Sonho Com Estante is subject or for the purposes of declaration, exercise or defense. of Sonho Com Estante's right in a lawsuit.

When Sonho Com Estante has made User Data public and is obliged to erase them under the right of erasure, it undertakes to take reasonable measures, including those of a technical nature, taking into account the technology available and the costs of its application, to inform those responsible for the effective processing of personal data that the User has asked them to delete the links to that personal data, as well as the copies or reproductions thereof.


13. RIGHT TO LIMIT THE PROCESSING OF PERSONAL DATA

The User has the right to obtain, from Sonho Com Estante, the limitation of the processing of User Data, if one of the following situations applies (the limitation consists of inserting a mark in the personal data kept with the aim of limiting its treatment in the future):

• If you dispute the accuracy of the personal data, during a period that allows Sonho Com Estante to verify its accuracy;

• If the treatment is unlawful and the User opposes the deletion of the data, requesting, in return, the limitation of its use;

• If Sonho Com Estante no longer needs personal data for processing purposes, but such data is required by the User for the purposes of declaring, exercising or defending a right in a legal proceeding;

• .If the User has objected to the treatment, until it is verified that Sonho Com Estante's legitimate reasons prevail over those of the User.

When User Data is subject to limitation, it may only, with the exception of conservation, be processed with the User's consent or for the purposes of declaring, exercising or defending a right in legal proceedings, defending the rights of another natural person or collective, or for legally foreseen public interest reasons.


14. RIGHT TO PORTABILITY OF PERSONAL DATA

The User has the right to receive the personal data concerning him and that he has provided to Sonho Com Estante, in a structured, commonly used and machine-readable format, and the right to transmit this data to another controller (whenever applicable).


15. RIGHT TO OPPOSITION TO TREATMENT

The User has the right to object at any time, for reasons related to his particular situation, to the processing of personal data concerning him based on the legitimate interests of Sonho Com Estante.

When the User's personal data is processed for the purposes of direct marketing (marketing), the User has the right to object at any time to the processing of data concerning him for the purposes of said marketing, which includes profiling. in so far as it relates to direct marketing. For this purpose, Sonho Com Estante ceases to process data for this purpose.

The User also has the right not to be subject to any decision taken exclusively based on automated processing, including the definition of profiles, which produces effects in its legal sphere or which significantly affects it in a similar way, unless the decision:

• Is necessary for the conclusion or execution of a contract between the User and Sonho Com Estante;

• Is authorized by legislation to which Sonho Com Estante is subject; or

• It is based on the User's explicit consent.

16. PROCEDURES FOR THE EXERCISE OF RIGHTS BY THE USER

The rights relating to data protection can be exercised by the User by contacting Sonho Com Estante, via email geral@sonhocomestante.com.

Sonho Com Estante will respond in writing to the User's requests within a maximum period of one month from the receipt of the request, except in cases of special complexity, in which this period may be extended up to 2 months.

If the requests submitted by the User are manifestly unfounded or excessive, namely due to their repetitive nature, Sonho Com Estante reserves the right to charge administrative costs or refuse to comply with the request.


17. VIOLATIONS OF PERSONAL DATA

In the event of a data breach and to the extent that such breach is likely to imply a high risk to the User's rights and freedoms, Sonho Com Estante undertakes to communicate the breach of personal data to the User without undue delay.

Under legal terms, communication to the User is not required in the following cases:

• If Sonho Com Estante has applied adequate protection measures, both technical and organizational, and these measures have been applied to the personal data affected by the breach of personal data, especially measures that make the personal data incomprehensible to any person not authorized to access these data, such as encryption;

• If Sonho Com Estante has taken subsequent measures to ensure that the high risk to the User's rights and freedoms is no longer likely to materialize; or

• If communication to the User implies a disproportionate effort for Sonho Com Estante. In this case, Sonho Com Estante will make a public communication or take a similar measure through which the User is informed.

C. FINAL PART


18. CHANGES TO THE PRIVACY POLICY

Sonho Com Estante reserves the right to change this Privacy Policy at any time. In case of modification of the Privacy Policy, the date of the last modification, available at the bottom of this page, is also updated. If the change is substantial, a notice will be posted on the Site.


19. APPLICABLE LAW AND JURISDICTION

The Privacy Policy, as well as the collection, processing or transmission of User Data, are governed by the provisions of Regulation (EU) 2016/679, of the European Parliament and of the Council, of April 27, 2016 and by the applicable laws and regulations. in Portugal.

Any disputes arising from the validity, interpretation or execution of the Privacy Policy, or that are related to the processing of the User's personal data, must be submitted exclusively to the jurisdiction of the judicial courts of the district of Porto, without prejudice to the applicable mandatory legal rules.




Date: 05/24/2022