Atlânticoline, S.A., with registered office at Rua Conselheiro Miguel da Silveira, no. 31, 9900-114 Horta, Portugal, and tax identification number 512 091 773, acts as the controller of the personal data provided by its customers, employees, service providers, suppliers and other data subjects with whom it engages, within the scope of its activities in providing public maritime transport services.

• Regulation EU 2016/679 of the European Parliament and of the Council of 27 April, hereinafter referred to as the GDPR, establishes the protection of natural persons with regard to the processing of personal data and the free movement of such data as a fundamental right.
• Law no. 58/2019 of 8 August ensures the implementation of the GDPR within the Portuguese legal framework, hereinafter referred to as the Implementing Law, together with all applicable national legislation and legislation of the Autonomous Region of the Azores governing the processing of personal data in the maritime transport sector.

The Data Protection Policy expresses our commitment to legal compliance, complementing the information provided to data subjects regarding the processing of the personal data supplied to obtain our products or services. For any matter related to the processing of your data or the exercise of your rights, please contact us at dpo@atlanticoline.pt or at the postal address above.

Principles Governing the Processing of Personal Data

Atlânticoline, S.A. complies with the principles of data protection and the obligations applicable to data processing and facilitates the exercise of data subject rights. From the collection of personal data that are necessary, adequate and relevant for the legitimate purpose of any public service provided, and for compliance with legal obligations, full informational transparency is ensured so that the data subject is aware of the processing activities to which their data are subject.

Personal data are retained for the legally established periods or, in the absence of a defined statutory period, Atlânticoline, S.A. informs data subjects of the applicable retention periods and criteria.

To ensure confidentiality and integrity, personal data are processed under appropriate security conditions, including technical measures such as encryption, and organisational measures such as regular training of authorised staff, defined internal policies and procedures, and ongoing risk supervision to safeguard the rights and freedoms of data subjects.

Why Do We Process Your Personal Data

Without the processing of personal data, it is not possible to provide public maritime transport services for passengers, vehicles or baggage. In the context of any service, personal data are processed where necessary for pre-contractual steps at the request of the data subject, for the performance of a contract of employment or public service, for compliance with legal obligations, for the protection of the vital interests of the data subject or another natural person, for reasons of public interest, or for duly justified legitimate interests.

Purposes of Processing

Your personal data are processed whenever you intend to use any of our public maritime transport services, for the purposes of:

• Sale of passenger or vehicle tickets.
• Verification of identity, age and residence for the application of the Azores Resident fare.
• Verification of identity and Youth Card for the application of the Youth fare.
• Preparation, retention and presentation of passenger lists on board.
• Baggage handling and dispatch.
• Management of the contractual relationship initiated through the sale of passenger, vehicle or baggage tickets.
• Handling of complaints and on board incidents.
• Payment for services.
• Payment of salaries or compensation due.
• Reimbursement of amounts owed.
• Contact management.
• Provision of information requested by the data subject.
• Litigation management.
• Management of subscription to products made available.
• Compliance with legal, regulatory and risk management obligations, including the exercise of rights or participation in judicial proceedings.

In the case of job applicants, personal data are processed for recruitment, selection and contracting purposes, in compliance with applicable legal obligations and retention periods.

In the case of employees, personal data are processed for the management of the employment relationship until its termination, in accordance with applicable legal obligations and retention periods.

For other processing purposes, such as marketing initiatives, newsletters, or the organisation or co-organisation of events, Atlânticoline, S.A. will inform the data subject in advance and request their free, specific, informed and unambiguous consent, which may be withdrawn at any time.

Categories of Personal Data Processed

For employment activities and the provision of maritime transport services, and to comply with applicable legal obligations, the following categories of personal data may be processed where necessary for the intended lawful purpose:

• Identification data, such as name, gender, nationality, date of birth and, where applicable, details of a legal representative.
• Contact details, such as postal code of residence, email address and telephone or mobile number.
• Professional data, such as the name of the organisation to which the individual is or has been affiliated, curriculum vitae, academic certificates or other relevant training certificates.
• Data relating to participation in internal or external training and issuance or retention of certificates.
• Financial data, such as tax identification number, bank account details or other payment information defined contractually.
• Data required for scheduling meetings or registering for events, including accessibility requirements.
• Data or documents provided by the customer where considered necessary or submitted voluntarily.
• Additional data requested by the company, including electronic communications.
• Data obtained from cookies used on our website, subject to consent.
• Special categories of data required to address specific embarkation, carriage or disembarkation conditions, where necessary.
• Other categories of data necessary for contractual processes involving individuals or services.

Retention Period

Atlânticoline, S.A. retains personal data strictly for the period necessary for contract performance and in accordance with legally established retention periods for compliance with applicable legal and regulatory obligations.

Once the life cycle of the data processed for a specific and legitimate purpose has ended, and after the applicable legal retention periods have expired, Atlânticoline, S.A. may assess the need for continued retention. Continued retention will occur only after providing the required information and obtaining consent for the new purpose identified, and will involve the application of anonymisation techniques.

Where continued retention is not required to fulfil a legal obligation or legitimate interest, Atlânticoline, S.A. will ensure controlled destruction of physical records or secure deletion of digital records.

Sharing of Personal Data

Atlânticoline, S.A. does not engage in commercial disclosure of personal data to third parties unrelated to the execution of the purposes associated with the public service provided, unless necessary and always after providing the required information and obtaining consent where applicable.

Personal data may be shared only in compliance with a lawful order from a public authority, a legal obligation or a contractual provision. The legal basis for such sharing will be communicated at the time of data collection.

Your data may therefore be shared with:

• Public entities and competent national, regional and judicial authorities.
• Port and maritime authorities.
• Subcontractors and specialised service providers, including IT service providers and other support services.

Given the inherent uncertainty associated with the transmission of personal data over the internet, data subjects are advised to consult the data protection policies of third-party entities.

Data Subject Rights

Atlânticoline, S.A. ensures the free exercise of data subject rights in accordance with applicable national data protection law. Before exercising your rights, you are advised to consult the website of the Portuguese Data Protection Authority, Comissão Nacional de Proteção de Dados, CNPD, for guidance.

To exercise your rights, please submit a request to dpo@atlanticoline.pt. Information and means to facilitate the exercise of rights are also available at any Atlânticoline point of sale or at partner companies authorised to sell our products or services.

Data subjects may exercise the following rights:

• Right of access, to confirm whether personal data are being processed.
• Right to rectification of inaccurate data or to complete incomplete data.
• Right to erasure, subject to a clear legal basis.
• Right to restriction of processing where non-compliance is alleged.
• Right to data portability, where technically feasible, in a structured, commonly used and machine-readable format.
• Right to object, at any time, on grounds relating to the data subject’s particular situation.
• Right to withdraw consent previously given, without affecting the lawfulness of prior processing.
• Right to lodge a complaint with the supervisory authority, the Comissão Nacional de Proteção de Dados, if the data subject considers that Atlânticoline, S.A. has failed to comply with its legal obligations or to safeguard their rights.

Atlânticoline, S.A. keeps its Data Protection Policy under review and reserves the right to amend it whenever necessary.