ARROW4D®Privacy and data protection policy.
The protection and privacy of personal data is a fundamental commitment of ARROW4D® to its data subjects. This policy sets out, transparently, the general rules for processing the personal data collected, in compliance with the General Data Protection Regulation and with Law 58/2019 of 8 August.
Version v2 · 03 August 2026
01Data controller
ARROW4D - Consultores de Engenharia e Geofísica, Lda. Head office: Rua da Fundição nº17A, 7005-368 Évora, Portugal Telephone: +351 966 167 709 (Call to the Portuguese mobile network) Email: geral@arrow4d.pt Data protection officer: Eng. Samuel Neves, reachable at geral@arrow4d.pt.
02How data is collected
In order to provide its services, ARROW4D® collects personal information through several channels: telephone, websites, information systems, postal or electronic mail, and contact forms.
03What personal data is processed
Processing is carried out by computer and in an automated manner, following the principle of data minimisation: only what is adequate, relevant and limited to what is necessary is collected. The categories processed are: · Identification: name, date of birth, identity card details, nationality · Contact: address, telephone number and email address · Professional: job title, functions and company · Academic and professional: qualifications, certifications and CVs · Billing: tax identification number and billing address · Image and sound: in the context of events and activities · Digital: unique device identifier (IP), including date and time of access
04Lawful grounds and purposes
Personal data is processed only where there are lawful grounds: · Consent, given freely, specifically, in an informed and unambiguous manner, for one or more determined purposes · Performance of a service contract to which the data subject is a party, or pre-contractual steps at their request · Compliance with a legal obligation to which ARROW4D® is subject · Legitimate interest, in handling suggestions and complaints and in adapting the services to be provided Where there is an intention to process the data for purposes other than those defined, the necessary information is provided beforehand.
05Retention periods
Retention periods follow the legal and regulatory provisions requiring data to be kept for a minimum period, and those statutory periods are observed. Where processing rests on consent, the data is kept until consent is withdrawn or until the purpose that prompted it ceases.
06Data subjects' rights
The rights of access, rectification, erasure, restriction of processing, portability, objection, objection to automated decisions including profiling, and withdrawal of consent at any time are all guaranteed. Requests for information are met once the data subject's identity has been verified. Replies are given in writing, in clear and simple language, within one month, extendable to two in cases of greater complexity or volume.
07Complaints
The National Data Protection Commission (CNPD) is the independent administrative authority with supervisory powers over the processing of personal data. Anyone who considers that processing does not comply with the legislation in force has the right to lodge a complaint with it: Av. D. Carlos I, no. 134, 1st floor, 1200-651 Lisbon, Portugal Telephone: (+351) 213 928 400 Email: geral@cnpd.pt
08Security and data breaches
Appropriate technical and organisational measures are applied to protect personal data against destruction, loss, alteration, disclosure, unauthorised access or any other form of accidental or unlawful processing. Those measures are reviewed regularly, and there is continued investment in training the staff who handle personal information. Any security breach or loss of personal data is reported immediately to the data protection officer. Where a breach entails a high risk to the rights and freedoms of data subjects, ARROW4D® notifies the CNPD within 72 hours.
09Transfers and subprocessors
Personal data is processed within the European Economic Area and is transferred or made available to third parties only in the cases and under the conditions laid down by law. Where data is transferred to entities outside the EEA, the applicable legal obligations are strictly complied with. When it engages other entities, ARROW4D® assesses their compliance with the GDPR beforehand, and the security guarantees they offer for processing the data they are given access to.
10Changes to this policy
In view of ongoing technological and legal developments, this policy may be revised at any time to adapt it to changes in legislation. Any revision takes effect immediately upon publication, cancelling the effects of previous versions. The document is assessed and revised annually or whenever necessary.