Data Protection and Privacy Policy

Atlânticoline, S.A., with registered office at Rua Conselheiro Miguel da Silveira, nº 31, 9900-114 Horta, and tax identification number 512 091 773, is responsible for processing the personal data provided to it by its clients, employees, service providers, suppliers, and other types of data subjects who interact with it, within the scope of activities for the provision of public maritime transport services.

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April, hereinafter referred to as “GDPR”, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data as a fundamental right;
• Law No. 58/2019, of August 8, which ensures its implementation in the Portuguese legal system, hereinafter referred to as the “Implementing Law,” as well as all national and Azores Autonomous Region legislation applicable to the processing of personal data in the maritime transport sector.

The Data Protection Policy expresses our commitment to applicable legal compliance, in addition to the information provided to data subjects about the processing to be carried out with the personal data they provide to us to obtain our products or services. For any questions related to the processing of your data or the exercise of your rights, you can contact us via email at dpo@atlanticoline.pt or at the postal address indicated above.

We observe the principles relating to the processing of personal data
Atlânticoline, SA complies with the principles relating to data protection and the obligations applicable to data processing, and facilitates the exercise of rights by data subjects. From the collection of necessary, adequate and relevant personal data to meet the legitimate purpose of any public service provided, as well as the… In compliance with the legal obligations that arise, total informational transparency is ensured so that the data subject is aware of the processing to which their data must be subjected. The processed data is kept within the applicable legal deadlines or, in the absence of such a legal definition, Atlânticoline, S.A. informs data subjects about the deadlines and criteria it applies. To guarantee confidentiality and integrity, your data is processed under adequate security conditions using technical measures, such as encryption and ciphering, and organizational measures, such as the regular training of our employees authorized to process personal data, the policies to be followed and the support procedures to be adopted, in an environment of supervision of the risks to the rights, freedoms and guarantees of the data subjects.

Why do we process your personal data?
Without the processing of personal data, it is not possible to provide any of the public passenger transport, vehicle, or baggage handling services. In any service, the processing of your personal data will have to be verified, when necessary to attend to pre-contractual due diligence at your request, to The execution of an employment or public service contract, for the fulfillment of applicable legal obligations, for the defense of the vital interest of the data subject or another natural person, for public interest or legitimate legitimate interest.

For what purposes
Your personal data is processed whenever you wish to use any of our public maritime transport services, for the purposes of:

• Sale of passenger or vehicle transport tickets;
• Validation of identity, age and residence for the application of the Azores Resident fare;
• Validation of identity and Youth Card for the application of the Youth fare;
• Preparation, maintenance and presentation of passenger lists on board;
• Baggage handling;
• Management of the contractual relationship initiated with the sale of any passenger, vehicle or baggage transport ticket;
• Management of complaints and incidents on board;
• Payment for services;
• Payment of salary or compensation due;
• Refund of amounts due;
• Management of the contact list;
• Management of information that the data subject wishes to obtain;
• Management of Litigation;
• Management of the subscription process for available products;
• Compliance with legal, regulatory, and risk management obligations, including the exercise of rights or in potential legal proceedings.

In the case of job applicants seeking to fill a vacancy at Atlânticoline, S.A., their personal data is processed for selection, recruitment, and contracting purposes, in compliance with applicable legal obligations and deadlines. For our employees, their personal data is processed within the scope of various processing activities for the management of the employment contract, and until its termination, in compliance with applicable legal obligations and deadlines. For other processing purposes, such as marketing initiatives to promote our services, sending newsletters, organizing or co-organizing events, Atlânticoline, S.A. will inform and request the data subject’s prior free, specific, informed, and unequivocal consent, reminding them that they may withdraw it at any time, resulting in the cessation of the processing of their data.

What categories of personal data do we process?
For work activities and for the provision of maritime transport services and compliance with applicable legal obligations, the following categories of personal data may be processed that are necessary for the legal purpose pursued:

• Identification data, such as name, gender, nationality, date of birth and, where applicable, the data of their legal representative;
• Contact data, such as the postal code of residence, email address, and a telephone/mobile phone number;
• Professional data, such as the name of the organization to which you are or have been affiliated, your curriculum vitae, certificates proving your academic degree or other relevant training;
• Data for attending internal training courses and issuing the respective certificate or external training courses and evaluating and preserving the certificate obtained;
• Financial data, such as your tax identification number, bank account number, or other payment data to be defined in the contract;
• Data for scheduling meetings or registering for events, including exceptional situations to be considered, such as accessibility restrictions;
• Data or information owned by the client, such as documents, that they provide because they are considered necessary or by their own decision;
• Additional data or information required and requested by our company, as well as communications sent electronically;
• Data obtained from cookies used on our website and consented to by the data subject;
• Special categories of data to meet special conditions of embarkation, transport and disembarkation, when necessary;
• Other categories of data necessary for contracting processes for individuals or services.

Personal Data Retention Period
Atlânticoline, S.A. retains your personal data for the period strictly necessary for the execution of the contract, and in accordance with the different legally established deadlines for compliance with applicable legal and regulatory obligations. Once the life cycle of the data processed for a specific and legitimate purpose has ended, and the applicable legal retention periods have expired, Atlânticoline, S.A. may decide on its eventual continuity, which will only occur after providing the necessary information and requesting consent for the aforementioned purpose, and applying anonymization techniques. If it is not necessary to continue retaining your data to meet a legal obligation or for a legitimate interest pursued, Atlânticoline, S.A. will proceed with its controlled destruction, if it is in physical form, or it will be deleted, if it is in digital form.

Sharing of Personal Data
Atlânticoline, S.A. does not make any type of commercial provision to third-party entities unrelated to the materialization of the purposes of data processing associated with the public service provided, unless necessary, but always after providing the necessary information and obtaining the consent of the data subject. The sharing of your personal data only occurs to comply with an order from a public authority or a legal obligation or by contractual provision. The basis for sharing your data will be provided at the time of collection.

Thus, your data may be shared with:

• Public entities, competent national, regional and judicial governmental authorities;
• Port and maritime authority;
• Subcontractors, suppliers of specialized and support services, within the scope of regulated contracting as IT service providers and others;
• Due to the high degree of uncertainty associated with the circulation of personal data on the internet, we advise you to read the data protection policy of third-party entities.

Data Subject Rights
Atlânticoline, S.A. ensures the free exercise of data subject rights in accordance with the applicable national legal order regarding data protection. Before exercising their rights, data subjects are advised to consult the CNPD website dedicated to rights, where they will find information on how to exercise them. To exercise their rights, the data subject should send a request to dpo@atlanticoline.pt. At any Atlânticoline, S.A. point of sale, or at partner companies that sell our products or services, data subjects can also find the necessary information and means to facilitate the exercise of their rights.

The data subject may exercise the following rights:

1. Right of access, to know whether or not their personal data is being processed;
2. Right to rectification, of inaccurate data or to add other data they deem necessary;
3. Right to erasure of data, with clear justification;
4. Right to restriction of processing, whenever they consider there to be discrepancies;
5. Right to data portability, when they wish to receive or endorse the data provided and the data generated in the provision of contracted services, in a structured, commonly used and machine-readable format, and whenever technically possible;
6. Right to object, at any time, for reasons related to their particular situation regarding certain data processing;
7. Right to withdraw previously given consent, without this affecting the lawfulness of the processing carried out;
8. Right to complain to the supervisory authority, the National Data Protection Commission (www.cnpd.pt), if you consider that Atlânticoline S.A. has not fulfilled its obligations or ensured your rights, in accordance with the applicable national legal order.

Atlânticoline, SA keeps its Data Protection Policy updated and reserves the right to change it whenever necessary.