GENERAL CONDITIONS > Data Protection and Privacy Policy

Data Protection and Privacy Policy

Atlânticoline, S.A., headquartered at Rua Conselheiro Miguel da Silveira, no. 31, 9900-114 Horta, with tax identification number 512 091 773, is responsible for processing the personal data provided by its customers, employees, service providers, suppliers, and other individuals with whom it maintains a relationship, within the scope of activities related to the provision of public maritime transport services.

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April, hereinafter referred to as “GDPR”, regarding the protection of natural persons with regard to the processing of personal data and the free movement of such data as a fundamental right; Law no. 58/2019, of August 8, which ensures its implementation in the Portuguese legal order, hereinafter referred to as the “Implementation Law”, as well as all national legislation and legislation of the Autonomous Region of the Azores applicable to the processing of personal data in the maritime transport sector.

The Data Protection Policy expresses our commitment to applicable legal compliance, in addition to the information provided to data subjects regarding the processing of the personal data they provide to obtain our products or services. For any questions related to the processing of your data or the exercise of your rights, you may contact us by e-mail at dpo@atlanticoline.pt or at the above-mentioned postal address.

Compliance with principles relating to personal data processing

Atlânticoline, S.A. complies with the principles of data protection and the obligations applicable to data processing, and facilitates the exercise of rights by data subjects. From the collection of personal data necessary, adequate, and relevant to fulfill the legitimate purpose of any public service provided, as well as the fulfillment of legal obligations arising therefrom, full informational transparency is ensured so that the data subject is aware of the processing their data is subject to.

Processed data is retained within the applicable legal time limits or, in the absence of such legal definition, Atlânticoline, S.A. informs the data subjects of the periods and criteria applied. To guarantee confidentiality and integrity, your data is processed under adequate security conditions, applying technical measures such as encryption and coding, and organizational measures such as regular training of authorized staff, the implementation of policies, and the adoption of supporting procedures, within a framework of risk supervision concerning the rights, freedoms, and guarantees of the data subjects.

Why do we process your personal data?

Without processing personal data, it is not possible to provide any of the public services related to passenger transport, vehicle transport, or baggage handling. In every service, the processing of personal data must occur whenever necessary to meet pre-contractual requirements at your request, for the execution of an employment or public service contract, for compliance with applicable legal obligations, for the defense of the vital interests of the data subject or another natural person, for reasons of public interest, or for legitimate interest.

For what purposes?

Your personal data is processed, whenever you wish to use any of our public maritime transport services, for purposes including:

Sale of passenger or vehicle transport tickets;
Validation of identity, age, and residence for the Azores Resident fare;
Validation of identity and the Youth Card for the Youth fare;
Preparation, retention, and presentation of passenger lists on board;
Baggage handling;
Management of contractual relations initiated with the sale of any passenger, vehicle, or baggage transport ticket;
Management of complaints and incidents on board;
Payment of services;
Payment of salaries or due compensations;
Refund of outstanding amounts;
Management of contact agenda;
Management of information requested by the data subject;
Litigation management;
Management of subscription to available products;
Compliance with legal, regulatory, and risk management obligations, including the exercise of rights or participation in legal proceedings.

In the case of job applicants applying for a position at Atlânticoline, S.A., their personal data is processed for selection, recruitment, and contractual purposes, in compliance with applicable obligations and deadlines. In the case of our employees, their personal data is processed in the context of the various activities relating to the management of the employment contract until its termination, in compliance with applicable obligations and deadlines.

For other purposes, such as marketing initiatives to promote our services, sending newsletters, or organizing/co-organizing events, Atlânticoline, S.A. will inform and request the prior free, specific, informed, and unambiguous consent of the data subject, who may withdraw it at any time, resulting in the termination of the data processing concerned.

What categories of personal data do we process?

For employment activities, maritime transport services, and compliance with legal obligations, the following categories of personal data may be processed, insofar as they are necessary to achieve the pursued lawful purpose:

Identification data, such as name, gender, nationality, date of birth, and, where applicable, data of your legal representative;
Contact data, such as residential postal code, e-mail address, and telephone/mobile number;
Professional data, such as the name of the organization with which you are or were associated, curriculum vitae, certificates proving academic or other relevant qualifications;
Data related to participation in internal training and issuance of the respective certificate, or external training and the evaluation/retention of the obtained certificate;
Financial data, such as tax identification number, bank account number, or other contractual payment details;
Data for scheduling meetings or registering for events, including exceptional situations to be considered, such as accessibility restrictions;
Client-owned data or information, such as documents provided as necessary or voluntarily;
Additional data or information required and requested by our company, as well as communications sent electronically;
Data obtained from cookies used on our website, consented to by the user;
Special categories of data to address specific conditions for boarding, transport, and disembarking, where necessary;
Other categories of data necessary for contractualization processes of persons or services.

Data retention period

Atlânticoline, S.A. retains your personal data for the period strictly necessary to execute the contract, and in accordance with legally established deadlines to fulfill applicable legal and regulatory obligations. Once the lifecycle of data processed for a specific and legitimate purpose ends, and the applicable legal retention periods expire, Atlânticoline, S.A. may decide whether to continue retention, which will only occur after providing the necessary information and requesting the data subject’s consent for the indicated purpose, applying anonymization techniques. If it is no longer necessary to retain your data for legal obligations or legitimate interest, Atlânticoline, S.A. will proceed with its controlled destruction (if in physical format) or deletion (if in digital format).

Sharing personal data

Atlânticoline, S.A. does not commercially share personal data with third parties unrelated to the purposes of public service provision, unless necessary, but always after providing due information and obtaining the data subject’s consent. The sharing of your personal data will only occur to comply with an order from a public authority, a legal obligation, or a contractual provision. The basis for such sharing will be communicated at the time of collection.

Thus, your data may be shared with:

Public entities, competent national, regional, and judicial authorities;
Port and maritime authorities;
Subcontractors, specialized and support service providers, under regulated service provider agreements such as IT services;

Given the high degree of uncertainty associated with the circulation of personal data on the internet, we advise consulting the data protection policies of third parties.

Rights of the data subject

Atlânticoline, S.A. ensures the free exercise of data subject rights in accordance with the national legal framework applicable to data protection. Before exercising your rights, we recommend that you consult the CNPD (National Data Protection Commission) website dedicated to rights, where you will find information on how to exercise them.

To exercise your rights, you should submit a request to dpo@atlanticoline.pt. At any Atlânticoline, S.A. sales point, or at partner companies selling our products or services, the data subject may also find the necessary information and means to facilitate the exercise of their rights.

The data subject may exercise the following rights:

Right of access – to know whether your personal data is being processed;
Right of rectification – to correct inaccurate data or add other necessary information;
Right to erasure – where clearly justified;
Right to restriction of processing – whenever discrepancies are identified;
Right to data portability – to receive or transfer the provided and generated data in a structured, commonly used, and machine-readable format, whenever technically feasible;
Right to object – at any time, for reasons related to your particular situation concerning certain data processing;
Right to withdraw consent – previously given, without affecting the lawfulness of prior processing;
Right to lodge a complaint – with the supervisory authority, the National Data Protection Commission (www.cnpd.pt), if you believe that Atlânticoline, S.A. has not complied with its obligations or ensured your rights, in accordance with the applicable national legal framework.

Atlânticoline, S.A. maintains its Data Protection Policy up to date and reserves the right to amend it whenever necessary.