Scroll
The reading of this policy does not exempt the reading of the General Conditions of Personal Data and the provisions of clause 9a of the General Conditions of the Digital Certificate Issue Agreement.
Available for consultation Here..
The protection of privacy and Personal Data is a fundamental commitment of the company to its customers and users of its services.
DigitalSign Digital Certificate, S.A., hereinafter abbreviated DigitalSign, is a Qualified Trust Services Provider (PQSC), as considered at European Union level, pursuant to Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July (EIDAS Regulation), as part of the trusted list, and as such accredited to the National Security Office in Portugal for the provision of various trust services and, in particular, for the issuance of Qualified Digital Certificates, for the strict compliance with the legal rules applicable in this matter, with the emphasis on Decree-Law No 12/2021 of 9 February, which establishes the Legal Regime of Electronic Documents and Electronic Signature, also complying with strict parameters of confidentiality and security of information, provided for, inter alia, in ISO 27001, which have always guided its performance on the market.
DigitalSign advises you to read this document, and to consult the Clauses of the General Conditions for DigitalSign Personal Data, available for consultation on our website, as well as the Digital Certificate issue agreement, as both constitute DigitalSign's commitment to the protection of your customers' data under the New General Data Protection Regulation that entered into force on May 25, 2018.
This privacy policy covers the following services:
1.1 Management of all accounts created in our services;
1.2 identification and certification services for the issue of qualified certificates;
1.3 Electronic signature and time stamp services;
1.4 SigningDesk Services;
1.5 Invoicing;
1.6 technical and operational support;
1.7 setting up and managing reports with commercial information;
1.8 Training activities (e.g. webinars) for the use of our services.
To facilitate the understanding of this policy, the following definitions are used:
Information relating to a natural or legal person, where applicable, identified or identifiable, directly or indirectly, such as identifiers, or other specific elements relating to their physical, physiological, genetic, mental, economic, cultural or social identity.
the operation or a set of operations carried out on personal data or on personal data sets, by automated or non-automatic means, such as:
(a) the collection, registration, organisation, structuring, conservation, adaptation or alteration, recovery, consultation, use;
(b) disclosure by transmission, dissemination or any other means of making available, or
(c) comparison or interconnection, limitation, erasure or destruction.
the natural or legal person, public authority, service or body other than the data subject, controller, subcontractor and persons who, under the direct authority of the controller or processor, are authorised to process personal data;
the natural or legal person, public authority, agency or other body which, individually or jointly with other entities, determines the purposes and means of processing personal data;
the natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
an independent public authority which, in the case of Portugal, is the National Data Protection Commission (CNPD), which is responsible for monitoring the correct application of the personal data protection legislation;
Computer files containing a sequence of numbers and letters that uniquely identify a user's Internet access device, but may contain other information such as your browsing preferences on a particular site. Cookies are downloaded via the browser to the internet access device (computer, mobile phone, tablet, etc.) when accessing certain websites.
The person responsible for the collection and processing of your personal data will be DigitalSign, because it provides you with the service and, in this context, decides which data is collected, means of processing and purposes for which the data is used.
DigitalSign also has a data protection officer (Data Protection Officer, or DPO), who (i) monitors the compliance of data processing with applicable standards, (ii) is a contact point with the customer or user for clarification of issues relating to the processing of their data by DigitalSign, (iii) cooperates with the supervisory authority, (iv) provides information and advises the controller or processor about their obligations in the context of privacy and data protection.
Contact our DPO via email: dpo@digitalsign.pt
Personal data is any information of any kind and on any medium relating to an identified or identifiable natural person.
A natural person who can be identified directly or indirectly, e.g. by name, identification number, location data, electronic identifier or other elements enabling him to be identified, shall be considered identifiable.
The customer or user, a natural person, to whom the data relates and who has enjoyed the DigitalSign products and services. The Customer will be the person who concludes the DigitalSign contract, and you are the person who uses DigitalSign products and services, which may not correspond to the customer. In this regard, DigitalSign informs that it also protects personal data and respects the rights of customers and users.
Identification data
Examples
Identification and contacts
Full name, address, civil or tax identification numbers, payment and billing data, email address and telephone contact
Other identification data
Quality of representative and/or member of a particular company/entity
Services
Products and services acquired or subscribed
Consent: when you have your express consent – in writing, orally or through the validation of a previous option – and if such consent is free, informed, specific and unequivocal. In the case of processing personal data of minors, which may be subject to prior consent, DigitalSign shall require consent from holders of parental responsibilities, including for the purpose of providing services, by electronic means;
Execution of contracts and pre-contractual proceedings: where processing of personal data is necessary for the conclusion, execution and management of the contract concluded with DigitalSign, including for the purposes of issuing Digital Certificates, for the management of contacts, information and requests, for the management of billing, collection and payments;
Compliance with legal obligation: where the processing of personal data is necessary to comply with a legal obligation to which DigitalSign is subject, such as the communication of data required by any judicial or administrative authority for compliance with the law;
Legitimate interest: where the processing of personal data corresponds to a legitimate interest of DigitalSign or third parties, such as data processing for fraud detection, revenue protection or improvement of the quality of services.
In the processing of your Customers' Personal Data, DigitalSign observes the principles of lawfulness, loyalty, transparency, limitation of purposes, minimization of data, accuracy, limitation of conservation, integrity, confidentiality and responsibility.
As provided for in clause 9a of the general conditions of the Digital Certificate issue contract, DigitalSign undertakes to ensure the confidentiality and confidentiality of all Personal Data of its Customers whose knowledge is not intended for public disclosure.
Your personal data is processed by DigitalSign only for the period necessary for the achievement of the defined purpose or, as applicable, until you exercise your right of opposition, right to be forgotten or withdraw consent. After the respective storage period has elapsed, DigitalSign shall eliminate or anonymise the data where they are not to be retained for a different purpose and, in this sense, except as regards compliance with the data retention obligation which has served as the basis for the provision of its services for a minimum legal period of 7 years, as provided for in Article 13(f) of the Legal System for Electronic Documents and Digital Signature, corresponding to the updated version of Decree-Law No 12/2021 of 9 February.
Purposes
Examples of Purposes (not exhaustive)
Marketing and Sales
Marketing or sale of new products or services
Customer Management and Service Provision
Management of contacts, information or requests; installation management, activation, revocation or renewal of services; invoicing management, collection and payments; recording of calls (and video conferences) and communications under the contractual relationship, if applicable
Use of SaaS software solutions
Creating user accounts and managing the use of tools.
Accounting, Tax and Administrative Management
Accounting, billing; tax information, including sending information to the tax authority
Compliance with legal obligations
Conservation of Digital Certificates issued for the legal period of 7 years pursuant to Article 13(f) of the Legal System for Electronic Documents and Digital Signature, corresponding to the updated version of Decree-Law No 12/2021 of 9 February.
DigitalSign processes and preserves your personal data according to the purposes for which they are processed.
Thus, and where there is no specific legal obligation, the data will be processed only for the period necessary for the purposes of the collection and preservation of the data, and always in accordance with the law, the guidelines and decisions of the CNPD, or the competent supervisory authority under the law, as applicable. The personal data collected by DigitalSign will therefore be processed and retained for the purpose of the performance of the contract and during the respective execution period.
After that period, the respective data shall be kept for the legal period of 7 years after revocation of a digital certificate in accordance with Article 13 of the Legal Regime for Electronic Documents and Digital Signature, corresponding to the updated version of Decree-Law No 12/2021 of 9 February. Otherwise, the processing and preservation of the personal data of the Customers may occur only by express consent, for the purpose of ensuring rights or obligations related to the contract, or when legitimate interests justify it, to that precise extent.
We collect your personal data when you wish to purchase a pre-contractual DigitalSign service and for the purpose of contractual execution. In fact, the personal data required by DigitalSign are the personal data necessary for the provision of its services (e.g. for issuing, billing and/or renewal of Digital Certificates and access to other services made available). The collection may be made through the registration of the user on the site, and by completing the respective form, through the DigitalSign website, or by conducting a video conferencing specifically directed to that end, if this option applies and is chosen by the Customer.
DigitalSign may also access, collect or confirm personal data on public administration and private entities websites, in particular to confirm the accuracy and actuality of your identification and contact details.
Right of access: the right to obtain confirmation of what your personal data are collected and processed by DigitalSign, as well as to obtain information about them, for example, what the purposes of the processing are, what the retention times, among others, and the right to see/listen or obtain copies, for example, of invoices, written agreements or calls and videoconferencings in which you are involved and recorded.
Right to rectify: the right to request the rectification of your personal data which is inaccurate or to request that incomplete personal data be completed, such as address, NIF, email, telephone contacts, among others.
Right to erasure of data or «right to be forgotten»: the right to obtain the erasure of your personal data, provided that there are no valid grounds for its retention, such as the cases where DigitalSign has to retain the data for compliance with legal obligations (in particular, the legal obligation to retain the digital certificates it issues for a minimum legal period of 7 years), such as compliance with the legal obligation to preserve for investigation, detection and prosecution of crimes, or also because a judicial process is under way.
Right to portability: the right to receive the data provided to us in digital format of current use and automatic reading or to request the direct transmission of your data to another entity that becomes the new controller of your personal data, if technically possible.
Right to withdraw consent or right of opposition: the right to object or withdraw your consent at any time to data processing, such as in the case of processing data for marketing purposes, provided that there are no legitimate interests that prevail over your interests, rights and freedoms, such as the defence of a right under judicial proceedings.
Right of limitation: right to request limitation of the processing of your personal data in the form of: (i) suspension of processing or (ii) limitation of the scope of processing to certain categories of data or purposes of processing.
Through registration as users, customers or potential users may Customers have access to the various services provided by DigitalSign and, in particular, carry out the order order of the services they wish to purchase, among other features available such as the management of orders made in the area reserved for customers ("See Account").
If there is already registration on the user's website, just log in by entering the email and its password defined when registering. This keyword guarantees the user access to the management of the services in the respective reserved area and if, on the contrary, there is no registration on the user's website, the registration request requires the introduction of the user's NIF and, subsequently, the definition of the email and access password.
At the time of the initial registration, DigitalSign, such as mandatory data, the respective NIF of the user, invoicing name, contact name, address, port/walk number, postal code, city, country and telephone, and as optional data, the country and the mobile phone are also requested. The data provided by users will only be used in performing the services selected by the user for which they were provided, not being added to another list, made available to other entities or used to send unrelated information.
DigitalSign uses cookies on your website to improve the performance and browsing experience of personal data subjects, increasing on the one hand the speed and efficiency of response and, on the other hand, eliminating the need to repeatedly introduce the same information. For more information see our Cookies Policy, available for consultation on the Website.
DigitalSign may profile customers based, for example, on the use of the service, location, etc., in particular to provide services, increase the quality and experience of products and services, adapt marketing communications, etc., provided that such treatment is necessary for the conclusion or execution of the contract between the holder and DigitalSign, or is based on the consent of the holder.
Right to lodge a complaint with the CNPD, or the other competent supervisory authority in accordance with the law, other than the company or the PDO, if you consider that the processing of your data by DigitalSign violates the applicable legal regime.
The exercise of its rights shall be free of charge, unless it is a manifestly unfounded or excessive request, in which case a reasonable fee may be charged taking into account the costs. It should take into account, inter alia, that the exercise of its data erasure rights, withdrawal of consent or limitation rights may only be exercised in so far as they do not prevent DigitalSign from complying with any legal obligation.
The information shall be provided in writing but, if requested, may be provided orally. In this case, DigitalSign must verify its identity by other than oral means. The reply to applications should be made within 30 days, unless it is a particularly complex request.
By Letter
Largo Padre Bernardino Ribeiro Fernandes, No 26, 4835-489 Nespereira, Guimarães
By email
Your personal data may be transmitted to subcontractors to treat them on behalf and on behalf of DigitalSign. In this case, DigitalSign shall take the contractual measures necessary to ensure that subcontractors respect and protect the personal data of the holder. Data may also be transmitted to third parties other than DigitalSign or subcontractors, in particular companies with which DigitalSign develops partnerships, where the holder has consented, or to entities to whom the data has to be communicated under the law.
Your personal data may be transmitted to subcontractors to treat them on behalf and on behalf of DigitalSign. In this case, DigitalSign shall take the contractual measures necessary to ensure that subcontractors respect and protect the personal data of the holder. Data may also be transmitted to third parties other than DigitalSign or subcontractors, in particular companies with which DigitalSign develops partnerships, where the holder has consented, or to entities to whom the data has to be communicated under the law.
DigitalSign websites may contain links to other third-party websites, products or services that have no relation to DigitalSign or are not covered by this Privacy Policy.
The collection or processing of personal data requested by those third parties is your sole responsibility, and DigitalSign cannot be held liable under any circumstances for the content, accuracy, veracity or legitimacy of those Websites or for the misuse of data collected or processed through them.
We alert DigitalSign customers and users to this fact and to the need, before using websites, products or applications, to read and accept the rules on the processing of personal data defined by those third parties.
DigitalSign has implemented appropriate logical, physical, organisational and security measures necessary and sufficient to protect your personal data from destruction, loss, alteration, dissemination, unauthorized access or any other form of accidental or unlawful treatment. DigitalSign has implemented:
A) logical security requirements and measures, such as the use of firewalls and intrusion detection systems in their systems, the existence of a strict policy on access to systems and information and the registration of actions by DigitalSign employees on personal data of customers or users;
B) Physical security measures, including strict control of access to DigitalSign's physical installations by employees, partners and visitors, as well as very restricted and permanently monitored access to DigitalSign's essential technological infrastructures;
C) means of data protection from the design ("privacy by design") using technological means such as mask, encryption, pseudonymization and anonymization of personal data and also a set of preventive measures favourable to privacy ("privacy by default");
(d) scrutiny, audit and control mechanisms to ensure compliance with security and privacy policies;
E) a computer programme and training of DigitalSign employees and partners;
F) Access rules for customers or users to certain products or services, such as the introduction of a password, to enhance control and security mechanisms.
DigitalSign may update or re-adjust this Policy, as well as its Cookie Policy, and the general conditions relating to Personal Data, these changes being properly advertised.
