1.1. COLLECTION AND PROCESSING OF USER/CUSTOMER DATA

Grupo Non Basta, composed of several companies, including: Avelar e Teixeira, Lda, headquartered in Lisbon, address Avenida Elias Garcia, R/C, nº180B, postal code 1050-103, with NIF 501200339, regarding the Pasta Non Basta Avenidas Novas, Pasta Non Basta Alvalade, Memoria, and Provincia restaurants; Cucina Globale – Restauração e Franchising Lda, headquartered in Carnaxide, address Rua Manuel António Rodrigues, nº6, postal code 2790-099, with NIF 516483480, regarding the Margarida restaurant; and Brotherfood, Lda, headquartered in Lisbon, address Avenida Elias Garcia, R/C, nº180B, postal code 1050-103, with NIF 513118950, regarding the Pasta Non Basta Cascais restaurant, and registered at the Lisbon Commercial Registry Office.

In order to provide its Customers with meal services, the provision of services, and information, as well as access to www.grupononbasta.pt, recruitment forms, contact requests, newsletters, the Group may request that the Customer provide data that allows their identification, hereinafter referred to as “Personal Data.”

These data will be requested when registering on the website, filling out and submitting job application forms or information requests, subscribing to newsletters and services, purchasing a certain product, or enrolling in activities or events offered by Grupo Non Basta.

For the purposes of personnel selection, recruitment, and employment contract formation, only the personal data necessary for the process will be collected in accordance with the legal basis.

Whenever Personal Data is collected, Grupo Non Basta will inform the Customer about the reason for collecting the data, its purpose, and how that data is processed.

In the case of using the Group’s Wi-Fi network, the IP address may also be collected.

Grupo Non Basta also collects and processes information about your hardware and software, as well as information about the pages visited by the Customer on the Site. This information may include your browser type, domain name, access times, and hyperlinks through which the User/Customer accessed the Site (“Usage Information”). We use this information solely to improve the quality of your visit to our Site and/or Application.

Usage Information and Personal Data are referred to in this Privacy Policy as “Personal Data.”

Grupo Non Basta, and the companies it is composed of, are the entities responsible for the processing of personal data and for drafting the Privacy Policy. A Data Protection Officer has been appointed, responsible for implementing and verifying compliance with the privacy policy, and can be contacted at: geral@grupononbasta.pt.

 

1.2. SUBCONTRACTED ENTITIES

In the context of processing User/Customer Data, Grupo Non Basta engages or may engage third-party entities, subcontracted by it, to process the User/Customer Data on its behalf, in accordance with the instructions provided, and in compliance with the law and this Privacy Policy.

These subcontracted entities cannot transmit User/Customer Data to other entities without prior written authorization from Grupo Non Basta, nor can they subcontract other entities without prior authorization from Grupo Non Basta.

Grupo Non Basta is committed to subcontracting only entities that provide sufficient guarantees for implementing appropriate technical and organizational measures to ensure the protection of User/Customer rights. All subcontracted entities by Grupo Non Basta are bound by a written contract that regulates, among other things, the subject and duration of the processing, the nature and purpose of the processing, the type of personal data, the categories of data subjects, and the rights and obligations of the parties.

At the time of personal data collection, Grupo Non Basta provides the User/Customer with information regarding the categories of subcontracted entities that may process data on behalf of Grupo Non Basta in the specific case.

 

1.3. DATA COLLECTION CHANNELS

Grupo Non Basta may collect data directly (i.e., directly from the User/Customer) or indirectly (i.e., through partner entities or third parties). Data collection may be done through the following channels:

– Direct collection: in person, by phone, by email, and through the Site;
– Indirect collection: through partners or group companies, through the data subject’s legal guardian if the subject is legally incapable of giving consent, and official entities.

 

 

2. GENERAL PRINCIPLES APPLICABLE TO THE PROCESSING OF USER/CUSTOMER DATA

Regarding the general principles related to the processing of personal data, Grupo Non Basta commits to ensuring that the User/Customer Data it processes is:

• Subject to lawful processing, respecting the principles of good faith, fairness, and transparency in relation to the User/Customer;
• Collected for specific, explicit, and legitimate purposes, and not further processed in a manner incompatible with those purposes;
• Adequate, relevant, and limited to what is necessary concerning the purposes for which they are processed;
• Accurate and, when necessary, kept up to date, with appropriate measures taken to ensure that inaccurate or incomplete data is erased or rectified, considering the purposes for which they were collected or are subsequently processed;
• Stored in a manner that allows the identification of the User/Customer only for the period necessary for the purposes for which the data is processed;
• Processed in a way that guarantees its security, including protection against unauthorized or unlawful processing, accidental loss, destruction, or damage, by implementing appropriate technical or organizational measures.

 

The data processing carried out by Grupo Non Basta is permitted and legitimate when at least one of the following conditions is met:

• The User/Customer has given their free and explicit consent for the processing of their Data for one or more specific purposes;
• The processing is necessary for the performance of a contract to which the User/Customer is a party or for pre-contractual steps at the request of the User/Customer;
• The processing is necessary to comply with a legal obligation to which Grupo Non Basta is subject;
• The processing is necessary to protect the vital interests of the User/Customer or another natural person;
• The processing is necessary for the purposes of the legitimate interests pursued by Grupo Non Basta or by third parties (except where such interests are overridden by the fundamental rights and freedoms of the User/Customer that require the protection of personal data).

Grupo Non Basta is committed to ensuring that the processing of User/Customer Data is carried out only under the conditions listed above and in compliance with the aforementioned principles.

When the processing of User/Customer Data is based on the User/Customer’s consent, the User/Customer has the right to withdraw their consent at any time. However, the withdrawal of consent does not affect the lawfulness of the processing carried out by Grupo Non Basta based on the consent previously given by the User/Customer.

 

3. USE AND PURPOSES OF THE PROCESSING OF USER/CUSTOMER DATA

In general terms, Grupo Non Basta uses the User/Customer Data for the following purposes:

• Managing contacts with the User/Customer;
• Billing and charging the User/Customer;
• Registering the User/Customer on the Website and the Application;
• Informing the User/Customer, upon their request, of new products and services available on the Website, special offers and campaigns, updated information on Grupo Non Basta’s activities, and for marketing purposes of Grupo Non Basta through any communication medium, including electronic support;
• Allowing access to restricted areas of the Website, in accordance with previously established terms;
• Ensuring that the Website meets the User/Customer’s needs by developing and publishing content as tailored as possible to their requests and profile, improving the Website and Application’s search capabilities and features, and obtaining aggregated or statistical information about the typical User/Customer profile (profiling or consumption profile analysis);
• Controlling User/Customer access;
• Providing services, such as newsletters, opinion surveys, or other information or products requested or purchased by the User/Customer;
• Using the User/Customer’s image for marketing, promotion, and team-building activities through any medium when the image was captured at events, parties, or other activities promoted by Grupo Non Basta in which the User/Customer participated;
• Personnel selection and recruitment, and management of the contractual relationship established with Grupo Non Basta.

 

Grupo Non Basta may combine Usability Information with anonymous demographic information for research purposes, and we may use the result of this combination to provide more relevant content on the Website. In certain restricted areas of the Website, Grupo Non Basta may combine Personal Data with Usability Information to offer the User/Customer more personalized content (profiling).

The User/Customer Data collected by Grupo Non Basta is not shared with third parties without the User/Customer’s consent, except in the situations mentioned in the following paragraph. However, if the User/Customer contracts services from Grupo Non Basta that are provided by other entities responsible for processing personal data, the User/Customer Data may be consulted or accessed by these entities to the extent necessary for the provision of those services.

Under applicable legal terms, Grupo Non Basta may transmit or communicate the User/Customer Data to other entities if such transmission or communication is necessary for the execution of the contract established between the User/Customer and Grupo Non Basta, or for pre-contractual steps requested by the User/Customer, if it is necessary to comply with a legal obligation to which Grupo Non Basta is subject, or if it is necessary to obtain the legitimate interests of Grupo Non Basta or a third party (for example, in the case of sale or transfer of part or all of Grupo Non Basta or its assets, between entities owned or related to Grupo Non Basta, or for debt collection purposes from the User/Customer to Grupo Non Basta). In the event of a transmission of User/Customer Data to third parties, reasonable efforts will be made to ensure that the recipient uses the transmitted User/Customer Data in compliance with the Privacy Policy.

 

 

 

 

4. TECHNICAL, ORGANIZATIONAL, AND SECURITY MEASURES IMPLEMENTED

To ensure the security and maximum confidentiality of User/Customer Data, we handle the information you provide to us with absolute confidentiality, in accordance with our internal security and confidentiality policies and procedures, which are periodically updated as needed, as well as according to legally provided terms and conditions.

Considering the nature, scope, context, and purposes of data processing, as well as the risks arising from processing for the rights and freedoms of the User/Customer, Grupo Non Basta is committed to applying the necessary and appropriate technical and organizational measures to protect User/Customer Data and to comply with legal requirements. It is also committed to ensuring that, by default, only data necessary for each specific processing purpose is handled and that such data is not made available to an indefinite number of people without human intervention.

The communication between the User/Customer’s device and Grupo Non Basta is carried out through secure channels and communications using the HTTPS protocol and SSL security standard. Additionally, in general terms, Grupo Non Basta adopts the following measures:

• Regular audits to assess the effectiveness of the implemented technical and organizational measures;
• Awareness and training for staff involved in data processing operations;
• Pseudonymization and encryption of personal data;
• Mechanisms that ensure the permanent confidentiality, availability, and resilience of information systems;
• Mechanisms to ensure the timely restoration of information systems and access to personal data in the event of a physical or technical incident.

 

5. TRANSFER OF DATA OUTSIDE THE EUROPEAN UNION

The personal data collected and used by Grupo Non Basta is not made available to third parties established outside the European Union. If, in the future, such a transfer occurs for the reasons mentioned above, Grupo Non Basta commits to ensuring that the transfer complies with applicable legal provisions, particularly regarding the adequacy of such a country concerning data protection and the requirements applicable to such transfers.

 

6. CODES OF CONDUCT AND CERTIFICATION PROCEDURES

Not applicable.

 

7. USE OF COOKIES

When you visit our Website, your consent will be requested for the creation and storage of a text file (Cookie) on your computer. This file will allow you easier and faster access to the Website, as well as its customization according to your preferences. Most browsers accept these files (Cookies), but the User/Customer can delete them or automatically set their blocking. In the “Help” menu of your browser, you will find how to configure these settings. However, if you do not allow the use of cookies, some functionalities of the Website and Application may not be usable.

 

USER/CUSTOMER RIGHTS (DATA SUBJECTS)

Under applicable legal terms, the User/Customer has the following rights:

RIGHT TO INFORMATION

8.1. Information provided to the User/Customer by Grupo Non Basta (when data is collected directly from the User/Customer):

• The identity and contact details of Grupo Non Basta, the data controller, and, if applicable, its representative;
• The contact details of the Data Protection Officer;
• The purposes for which the personal data is being processed, as well as, if applicable, the legal basis for processing;
• If the data processing is based on the legitimate interests of Grupo Non Basta or a third party, an indication of such interests;
• If applicable, the recipients or categories of recipients of the personal data;
• If applicable, an indication that personal data will be transferred to a third country or an international organization, and the existence or absence of an adequacy decision adopted by the Commission or a reference to appropriate or adequate transfer safeguards;
• The retention period of the personal data;
• The right to request from Grupo Non Basta access to personal data, as well as its rectification, erasure, or restriction of processing, the right to object to processing, and the right to data portability;
• If the data processing is based on the User/Customer’s consent, the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal;
• The right to lodge a complaint with the CNPD (Portuguese Data Protection Authority) or another supervisory authority;
• An indication of whether the provision of personal data constitutes a legal or contractual obligation, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and the possible consequences of failing to provide such data;
• If applicable, the existence of automated decisions, including profiling, and information about the underlying logic, as well as the significance and expected consequences of such processing for the data subject.

If the User/Customer Data is not collected directly by Grupo Non Basta from the User/Customer, in addition to the above information, the User/Customer is additionally informed about the categories of personal data being processed and, as well, the source of the data and, if applicable, whether it comes from publicly accessible sources.

If Grupo Non Basta intends to process the User/Customer Data for a purpose other than that for which the data was collected, before such processing, Grupo Non Basta will provide the User/Customer with information regarding that purpose and any other pertinent information as referred to above.

8.2. Procedures and measures implemented to comply with the right to information.

The information referred to in 8.1 is provided in writing (including electronically) by Grupo Non Basta to the User/Customer prior to the processing of the personal data in question. Under applicable law, Grupo Non Basta is not obligated to provide the User/Customer with the information mentioned in 8.1 when and to the extent that the User/Customer is already aware of it.

The information is provided by Grupo Non Basta at no cost.

 

9. RIGHT TO ACCESS PERSONAL DATA

Grupo Non Basta ensures the means that allow the User/Customer to access their Personal Data.

The User/Customer has the right to obtain from Grupo Non Basta confirmation as to whether or not personal data concerning them is being processed and, if so, the right to access their personal data and the following information:

• The purposes of the data processing;
• The categories of personal data concerned;
• The recipients or categories of recipients to whom the personal data has been or will be disclosed, including recipients in third countries or international organizations;
• The retention period for the personal data;
• The right to request from Grupo Non Basta the rectification, erasure, or restriction of processing of personal data, or the right to object to such processing;
• The right to lodge a complaint with the CNPD (Portuguese Data Protection Authority) or another supervisory authority;
• If the data was not collected from the User/Customer, the available information about the source of the data;
• The existence of automated decisions, including profiling, and information about the underlying logic, as well as the significance and expected consequences of such processing for the data subject;
• The right to be informed about the appropriate safeguards associated with the transfer of data to third countries or international organizations.

Upon request, Grupo Non Basta will provide the User/Customer with a free copy of their personal data that is being processed. The provision of additional copies requested by the User/Customer may incur administrative costs.

 

10. RIGHT TO RECTIFICATION OF PERSONAL DATA

The User/Customer has the right to request, at any time, the rectification of their Personal Data and also the right to have their incomplete personal data completed, including by means of an additional statement, either through specific internet addresses created for this purpose, through specific areas of the Site, or via email (geral@grupononbasta.pt), in accordance with the terms of the Privacy Policy.

In the event of data rectification, Grupo Non Basta will communicate the respective rectification to each recipient to whom the data has been transmitted, unless such communication proves impossible or involves disproportionate effort for Grupo Non Basta.

 

11. RIGHT TO ERASURE OF PERSONAL DATA (“RIGHT TO BE FORGOTTEN”)

The User/Customer has the right to obtain from Grupo Non Basta the deletion of their data when one of the following applies:

• The User/Customer Data is no longer necessary for the purpose for which it was collected or processed;
• The User/Customer withdraws consent on which the processing is based and there is no other legal basis for processing;
• The User/Customer objects to the processing under the right to object, and there are no overriding legitimate interests justifying the processing;
• The User/Customer Data has been unlawfully processed;
• The User/Customer Data must be erased to comply with a legal obligation to which Grupo Non Basta is subject;
• The User/Customer Data has been collected in connection with the offer of information society services to children.

Under applicable law, Grupo Non Basta is not required to erase the User/Customer Data to the extent that the processing is necessary for compliance with a legal obligation to which Grupo Non Basta is subject or for the establishment, exercise, or defense of legal claims.

In the event of data erasure, Grupo Non Basta will communicate the respective erasure to each recipient/entity to whom the data has been transmitted, unless such communication proves impossible or involves disproportionate effort for Grupo Non Basta.

When Grupo Non Basta has made the User/Customer Data public and is obligated to erase it under the right to erasure, Grupo Non Basta commits to taking reasonable measures, including technical measures, considering available technology and the costs of implementation, to inform controllers who are processing the personal data that the User/Customer has requested the erasure of any links to, or copies or reproductions of, such personal data.

 

12. RIGHT TO RESTRICTION OF PROCESSING OF PERSONAL DATA

The User/Customer has the right to obtain from Grupo Non Bastathe restriction of the processing of User/Customer Data, if one of the following situations applies (restriction consists of inserting a mark in the personal data stored with the aim of limiting its processing in the future):

If you contest the accuracy of the personal data, for a period that allows Grupo Non Bastato verify its accuracy;

If the processing is unlawful and the User/Customer opposes the erasure of the data, requesting instead that its use be restricted;

If Grupo Non Basta no longer needs the User/Customer Data for processing purposes, but this data is required by the User/Customer for the purposes of declaring, exercising or defending a right in legal proceedings;

If the User/Customer has objected to the processing, until it is established that the Non Basta Group’s legitimate reasons prevail over those of the User/Customer.

When User/Customer Data is subject to limitation, it may only be processed, with the exception of storage, with the consent of the User/Customer or for the purposes of declaring, exercising or defending a right in legal proceedings, defending the rights of another natural or legal person, or for reasons of public interest provided for by law.

The User/Customer who has obtained the restriction of the processing of their data in the aforementioned cases will be informed by Grupo Non Bastabefore the restriction of processing is cancelled.

If the processing of data is restricted, Grupo Non Bastawill inform each recipient to whom the data has been transmitted of the restriction, unless such communication proves impossible or involves a disproportionate effort for the Non Basta Group.

 

 

13. RIGHT TO PORTABILITY OF PERSONAL DATA

The User/Customer has the right to receive the personal data concerning him/her that he/she has provided to the Non Basta Group, in a structured, commonly used and machine-readable format, and the right to transmit this data to another controller, if:

The processing is based on consent or on a contract to which the User/Customer is a party;

The procesing is carried out by automated means.

The right of portability does not include inferred data or derived data, i.e. personal data that is generated by Grupo Non Bastaas a consequence or result of analysing the data being processed.

The User/Customer has the right to have personal data transmitted directly between the data controllers, whenever technically possible. The exercise of the right to data portability applies without prejudice to the right to erasure of data.

 

 

14. RIGHT TO OBJECT TO PROCESSING

 The User/Customer has the right at any time to object, on grounds relating to their particular situation, to the processing of personal data concerning them that is based on the exercise of legitimate interests pursued by the Non Basta Group, or when the processing is carried out for purposes other than those for which the personal data was collected, including profiling, or when the personal data is processed for statistical purposes.

Grupo Non Bastashall cease processing the User/Customer’s Data, unless it has unavoidable and legitimate reasons for such processing which prevail over the interests, rights and freedoms of the User/Customer, or for the purposes of declaring, exercising or defending a right of Grupo Non Bastain legal proceedings.

The User/Customer has the right to object at any time to the processing of data concerning him/her for direct marketing purposes, which includes profiling insofar as it is related to direct marketing. If the User/Customer objects to the processing of their data for direct marketing purposes, Grupo Non Bastawill cease processing the data for this purpose.

The User/Customer also has the right not to be subject to any decision taken solely on the basis of automated processing, including profiling, which produces effects in their legal sphere or significantly affects them in a similar way, unless the decision:

Is fundamental to the conclusion or performance of a contract between the User/Customer and the Non Basta Group;

Is authorised by legislation to which Grupo Non Bastais subject;

Is based on the explicit consent of the User/Customer.

 

 

15. PROCEDURES FOR EXERCISING USER/CUSTOMER RIGHTS

As holders of personal data, the User/Customer is guaranteed, at any time, the right to access, rectify, update, limit and erase their personal data (except for data that is indispensable for the provision of services by the Non Basta Group, duly identified as being of mandatory supply or for the fulfilment of legal obligations to which the controller is subject, the right to oppose their use for commercial purposes by the Non Basta Group, and to withdraw consent, without this compromising the lawfulness of the processing carried out under that consent, as well as the right to data portability.

The User/Customer exercises their rights directly or by writing to Grupo Non Bastavia the contact details geral@grupononbasta.pt provided for this purpose.

Grupo Non Bastawill respond in writing (including by electronic means) to the User/Customer’s request within a maximum period of one month from receipt of the request, except in cases of particular complexity, where this period may be extended up to two months.

Grupo Non Basta reserves the right to charge administrative costs or refuse to comply with the request if the requests made by the User/Customer are manifestly unfounded or excessive, particularly due to their repetitive nature.

 

 

16. IMAGE RIGHTS

As they correspond to a legitimate commercial interest pursued by the Non Basta Group, the collection and processing of the User/Customer’s image is considered lawful if the User/Customer has given their consent. Whenever the User/Customer participates in an event promoted by the Non Basta Group, namely parties, activities or any other, and without prejudice to the right to honour, privacy and self-image, as well as other applicable legislation to which Grupo Non Bastais bound, the User/Customer’s image may be collected, in accordance with customary uses, within the scope of marketing, promotion and team building activities, including photographs, images and sound. Also as part of a legitimate commercial interest, Grupo Non Bastamay use this data in photos or videos that are displayed in its own media, namely on websites, Facebook pages and other social networks, newsletters, etc. The User/Customer has the right to object to the use of their image by the Non Basta Group, under the applicable legal terms, and to ask Grupo Non Bastato remove images of the User/Customer from its media.

Occasionally, filming or photographic sessions may take place inside the Non Basta Group’s restaurants, for promotional or other purposes, and notices of such sessions will be posted in the restaurants and in the specific spaces where they are taking place. In these cases, the User/Customer also has the right to object to the use of their image under the applicable legal terms, and should contact Grupo Non Bastafor this purpose.

If you do not consent to the use of your image by the Non Basta Group, you will not be able to take part in any of the above events, as Grupo Non Bastacannot guarantee that your image will not be taken.

 

17. PERSONAL DATA BREACHES

In the event of a data breach and insofar as such breach is likely to entail a high risk to the rights and freedoms of the User/Customer, Grupo Non Bastaundertakes tcommunicate the personal data breach to the User/Customer in question within 24 hours of the incident.

Under legal terms, communication to the User/Customer is not required in the following cases:

If Grupo Non Bastahas applied appropriate protection measures, both technical and organisational, and these measures have been applied to the personal data affected by the personal data breach, especially measures that render the personal data incomprehensible to any person not authorised to access such data, such as encryption;

If Non Basta Group has taken subsequent measures to ensure that the high risk to the rights and freedoms of the User/Customer is no longer likely to materialise; or

If communication to the User/Customer would involve a disproportionate effort for the Non Basta Group. In this case, Non Basta Group will make a public announcement or take a similar measure through which the User/Customer will be informed.

 

 

CONCLUSION

 

18. CHANGES TO THE PRIVACY POLICY

Grupo Non Bastareserves the right to amend this Privacy Policy at any time. In the event of a change to the Privacy Policy, the date of the last change, available at the top of this page, will also be updated. If the change is substantial, a notice will be placed on the Site.

 

19. CONTACT

Without prejudice to the provisions of clause 15 regarding the exercise of the rights granted to the User/Customer under the law, if you wish to raise questions or complaints relating to the Privacy Policy, you may do so by emailing geral@grupononbasta.pt.

 

20. APPLICABLE LAW AND JURISDICTION

The Privacy Policy, as well as the collection, processing or transmission of User/Customer Data, are governed by the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 and by the applicable laws and regulations in Portugal.

Any disputes arising from the validity, interpretation or execution of the Privacy Policy, or which are related to the collection, processing or transmission of User/Customer Data, shall be submitted exclusively to the jurisdiction of the courts of the district of Lisbon, without prejudice to the applicable mandatory legal rules.