PERSONAL DATA PROTECTION AND PRIVACY POLICY
“Galp Cards Portal”
The Galp Group ensures compliance with the legal obligations deriving from Regulation (EU) 2016/679 of the European Parliament and the Council (RGPD) and other current legislation associated to the protection of personal data, in the processing of personal data that it undertakes.
I. Who is the «Controller» of my personal data?
Petróleos de Portugal – Petrogal, S.A., with registered office at Rua Tomás da Fonseca, Torre C, 1600-209 Lisboa (hereinafter referred to as «GALP»), is the «Controller» of the personal data collected within the scope of the provision of services to users of the Galp Cards website.
Notwithstanding, according to the terms and conditions of use of the various Galp loyalty cards, the partner companies of Galp which, within the scope of card management, process personal data can also be responsible for their processing, in accordance with the purposes that they pursue.
II. For what purpose will my
personal data be processed, what is the basis of lawfulness and the length of
the retention period?
The processing of your personal data has the following main purposes:
Purpose(s) of Processing
Management of subscription, use and/or cancellation requests of Galp Cards
Basis of Lawfulness
Pre-contractual diligences or execution of the contract whose terms are governed by the Terms and Conditions made available on the website
Length(s) of the Retention Period
1 year after the termination of the contract, without prejudice to the storage of personal data for a longer period for the fulfillment of legal obligations
To provide a better experience to the user in his/her relationship with the Galp Group, the personal data may be processed by Galp for:
Purpose(s) of Processing - Commercial and marketing activities
Basis of Lawfulness - Legitimate interest (soft opt-in) of Galp or consent for the employees of the companies that use the cards
Length(s) of the Retention Period - 1 year after the last contact
Purpose(s) of Processing - Carrying out of surveys and/or opinion polls
Basis of Lawfulness - Consent
Length(s) of the Retention Period - 1 year after the last survey and/or opinion polls were carried out
Purpose(s) of Processing - Definition and analysis of profiles
Basis of Lawfulness - Legitimate interest
Length(s) of the Retention Period - 1 year after the last contact
Purpose(s) of Processing - Development of predictive models
Basis of Lawfulness - Legitimate interest
Length(s) of the Retention Period - 1 year after the last contact
Purpose(s) of Processing - Loyalty-building actions through the dynamic analysis of profiles
Basis of Lawfulness - Consent
Length(s) of the Retention Period - 1 year after the last contact
Purpose(s) of Processing - Recording of calls *
Basis of Lawfulness - Consent
Length(s) of the Retention Period - 24 months after the recording of the calls, plus the expiry or limitation period, for the purpose of evidence of commercial transactions and any other communications concerning the contractual relationship 30 days after the recording of the calls for the purpose of monitoring of the call handling quality.
* Recording of Calls
In the context of the management of requests for subscription, use and/or cancellation of Galp Cards, Galp records calls for the purposes of (1) proof of the commercial transactions and any other communications with respect to the contractual relationship and (2) for the monitoring of the call handling quality in the following telephone lines:
- For Galp Frota Corporate and Professional Cards (707 508 408);
- For Galp Frota Business Cards (707 508 408);
- For Galp+ Cards (707 504 257)
- For the Galp Ready Card (707 502 568)
- General telephone line for
matters relating to fuel, stores, washing, Midas centres, customer service
quality or other matters within the scope of Galp services (707 504 257).
The recording of calls subject to monitoring of the call handling quality are selected randomly and only a percentage of the total volume that does not exceed 5% of the calls made within the context of the contractual relationship established with the user is included in this system.
The user can object to the processing of personal data for the purpose of marketing by Galp, both at the moment of subscription to the cards and in any subsequent electronic communication for marketing purposes, through opt-out mechanisms that will be provided in all communications, without any corresponding consequences and the exercise of the right of opposition does not require the invocation of any specific grounds or justification.
If you do not wish to receive information about Galp products and services within the scope of commercial and marketing activities, you must exercise your right to object via the e-mail data.privacy@galp.com.
Likewise, if the user clearly consents to the processing of his/her personal data for carrying out surveys and opinion polls and/or for loyalty-building actions through the dynamic analysis of profiles, the user can withdraw consent, at any time, without any corresponding consequences.
If there is express objection by the users or if consent is withdrawn, Galp shall immediately cease the processing undertaken for the purpose in question.
III. What personal data will be
processed?
Within the context of the purposes set out, GALP will proceed with the processing of the following categories of users' personal data: identification and contact data, loyalty card data, consumption data, data associated to the vehicles allocated to the cards, information within the context of answers to any questions, requests or complaints by the user (namely through the “Feedback” functionality), data resulting from the collection of opinions and assessment of the services of the Galp Group by the user, traffic data and content of the calls made and information about the preferences and interests of the data subject, to the extent that they are related to the products and/or services provided by GALP.
IV. How will my personal data be processed?
The personal data of users will be processed by GALP, within the context of the purposes indicated above, in accordance with the internal policy and regulations of the Galp Group and with the use of suitable technical and organisational measures to promote the data's security and confidentiality, namely in relation to the non-authorised or illicit processing of their data and their loss, destruction or accidental damage.
V. Who are the recipients of
my personal data?
- «Processors»
The personal data of users can be provided to companies responsible for the provision of Galp services and products.
These companies are associated to Galp through a written contract, are only allowed to process the personal data of users for the purposes specifically established above and are not authorised to process the personal data of users directly or indirectly for any other purpose, for their own benefit or that of third parties.
Galp can transfer the personal data of Customers and/or Users to the United States of America (USA), if justified in accordance with the contractual regime established with the processors. GALP ensures that the international flow of data is carried out and certified based on the "adequate protection" level required by the decision of 12 July 2016 of the European Commission (i.e. EU-US Privacy Shield).
- «Third Parties»
The personal data of users may be communicated by Galp to companies of the Galp Group, via an intragroup data sharing agreement, which will comply with the applicable data protection rules in accordance with the purposes of the data processing.
In compliance with legal and/or contractual obligations, the personal data may also be transmitted to third parties with whom GALP has established partnerships, to judicial, administrative, supervisory or regulatory authorities, as well as to entities that lawfully carry out data compilation actions, fraud prevention and combat actions, and market or statistical studies.
VI. What rights do I have over
my personal data
?
Users have the right to: i) request and receive pertinent information related to the processing of personal data carried out by GALP; ii) request access to their personal data, namely obtain confirmation that their personal data are subject to processing; iii) rectify, delete or restrict the processing of personal data by Galp.
Users also have the right to lodge a complaint with the competent supervisory authority, the National Data Protection Commission - CNPD, if they consider that the processing of their personal data violates their rights and/or the applicable data protection laws.
VII. Cookies
GALP uses cookies to collect information about the use of the website. Users are advised to read and analyse the Cookies Policy for further information in this respect.
Users are also advised to consult the Cookies Policy on a regular basis to be aware of the latest versions.
VIII. Who can I contact to obtain
answers to all my questions
?
Users can, at any moment, in writing:
- Exercise the rights enshrined in the Personal Data Protection Law and other applicable legislation via the e-mail data.privacy@galp.com; and
- Contact the data protection officer of the Galp Group about any questions related to the protection and privacy of your personal data via the email dpo@galp.com.