Company Name: Granchinho Unipessoal, Lda.

NIPC/NIF: 510344275

Address: Zona Industrial das Lameiras, Lote 19-A 2240-426 Ferreira do Zêzere

Email:  info@biologic.pt

Telephone: 249361071

Legal Representative(if applicable): Pedro Manuel Granchinho de Matos

The company collects data for the purposes of order processing (invoicing) and delivery (shipping), as well as customer contact details such as phone number and email address.

The purposes of data processing include order and invoicing management, customer communication, sending promotional campaigns (with consent), compliance with legal obligations, personalization of the browsing experience, and ensuring website security.

The processing of personal data collected on the BIOLOGIC® website is based on the following legal grounds. Performance of a contract, for order processing, invoicing and product shipping. Customer consent for promotional offers and the use of non-essential cookies. Compliance with legal obligations in accordance with tax and accounting obligations. Legitimate interest, with the aim of improving the customer experience, preventing fraud and ensuring security when browsing the website.

Personal data collected through the store’s website may be shared with third parties only when necessary to fulfill the purposes of processing, always respecting the principles of lawfulness, necessity, and proportionality. Such sharing may occur with service providers involved in managing the online store, such as logistics companies, payment platforms, accounting services, or technology suppliers, ensuring that all these third parties comply with legal data protection obligations. In certain cases, data may be transmitted to public authorities when required by law, particularly for tax or judicial purposes. Whenever data is shared with processors (subcontractors), written agreements are in place to regulate the processing of such data, ensuring it is used only for authorized purposes and under appropriate security measures. Data will not be transferred to countries outside the European Union without adequate protection guarantees, as required by the GDPR. The store is committed not to sell, rent, or disclose users’ personal data for unauthorized commercial purposes. Any additional sharing will always be preceded by clear information to the data subject and, when required, the explicit consent of the individual.

Under the General Data Protection Regulation (GDPR), data subjects have the following rights. Right of Access: obtaining confirmation as to whether your data is being processed and accessing that data. Right of Rectification: requesting the correction of inaccurate or incomplete data. Right of Erasure: requesting the deletion of your personal data, in accordance with the law. Right to Object, objecting to the processing of your data for reasons related to your particular situation. Right to Portability, receiving the personal data you have provided to us in a structured, commonly used and machine-readable format, and transmitting that data to another data controller. Right to Restriction of Processing, requesting the restriction of the processing of your data in certain situations. To exercise your rights, please send a written request to info@biologic.pt, including information that allows us to identify you. A response will be provided within a maximum of one month, which may be extended by a further two months in complex cases, with due justification.

Personal data collected through our online store is retained only for as long as is strictly necessary to fulfil the purposes for which it was collected, or to comply with specific legal obligations. Billing data is retained for 10 years, as required by Portuguese tax legislation. Data for marketing purposes (e.g. newsletters, promotional campaigns, etc.) is retained until the data subject withdraws their consent or requests the deletion of the data. Registered customer data is retained for as long as the account is active. After more than 5 years of inactivity, the data will be deleted or anonymised. Data related to orders and customer support is kept for 5 years for the purposes of managing warranties, complaints or disputes. After the expiry of the aforementioned periods, the data will be securely deleted or anonymised, unless there is a legal obligation to keep it for a longer period.

Personal data collected may be transferred to entities located outside the European Economic Area (EEA), namely technology and payment service providers such as Google, Stripe, among others, that support the operation of our online store. Whenever an international data transfer occurs, we ensure that the transfer is made either to countries covered by an adequacy decision from the European Commission, or under Standard Contractual Clauses approved by the Commission, guaranteeing a level of data protection equivalent to that required by the GDPR. We do not use the Privacy Shield mechanism, as it was declared invalid by the Court of Justice of the European Union in July 2020 (Schrems II case). Additionally, we implement appropriate technical and organizational measures to protect transferred personal data, including encryption, access control, and data minimization policies.

You may withdraw your consent to the processing of your personal data for direct marketing purposes, including the sending of newsletters and promotional communications, at any time. To do so, you can click on the ‘Unsubscribe’ link at the bottom of each marketing email we send, or send an email to [info@biologic.pt] with your request to be removed.
Withdrawing consent does not compromise the lawfulness of processing based on consent given previously.

We do not make automated decisions, including profiling, that produce legal effects on data subjects or significantly affect them in a similar way.
Any suggestions for personalised products or content presented in our online shop are based on the user’s previous interactions with our website (such as views or purchases), without this implying automated decisions with legal or significant effects.

We implement appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure, alteration or destruction. Among the measures adopted are the use of HTTPS to ensure secure communication between the user and our website, data encryption where applicable, regular backups to prevent loss of information, access control restricted to authorised employees only, pseudonymisation and minimisation of data, whenever possible, and a security incident response policy with defined procedures for detecting, containing and reporting personal data breaches.
Despite all our efforts, no system is completely immune to risks. We are committed, however, to acting diligently and transparently in the event of any incident.

The data subject has the right to lodge a complaint with the competent supervisory authority if they consider that the processing of their personal data violates the General Data Protection Regulation (GDPR).
In Portugal, the supervisory authority is the National Data Protection Commission (CNPD), which can be contacted via the website www.cnpd.pt.