General Overview

The following Privacy Policy (hereinafter, the “Policy”) outlines the collection, processing, and utilization of your Personal Data on the Cyberspatia website, available at www.cyberspatia.com (hereinafter, the “Website“).

In addition to detailing our data protection practices, this Policy will also inform you about how to exercise your rights concerning your Personal Data. To this end, this Policy has been drawn up in accordance with current national and European legislation on the protection of natural persons, specifically Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, the “GDPR”), as well as other legal and regulatory provisions and best practices.

Please carefully read the following Policy before using the Website, since it contains essential information regarding your rights and obligations, as well as conditions, limitations and exclusions that might apply to you. By using the Website, clicking “I Accept” when prompted, or indicating your acceptance in an adjoining box, you confirm that you understand and agree to abide by all of this Policy.

If you disagree with this Policy or are prohibited by applicable law from accessing or using the Website or any of its contents, products, or services, you should refrain from accessing or using the Website.

Definitions

Consent of the Data Subject – Freely given, specific, informed, and unambiguous indication of the Data Subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the Processing of Personal Data relating to him or her.

Special Categories of Personal Data – Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the Processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

Personal Data – Any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

Processing – Any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

Controller – The natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data; where the purposes and means of such Processing are determined by Union or Member State law, the Controller or the specific criteria for its nomination may be provided for by Union or Member State law.

Personal Data Breach – A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored, or otherwise Processed.

Processor – A natural or legal person, public authority, agency, or other body which Processes Personal Data on behalf of the Controller.

Third-Party – A natural or legal person, public authority, agency, or body other than the Data Subject, Controller, Processor, and persons who, under the direct authority of the Controller or Processor, are authorised to Process Personal Data.

Supervisory Authority – An independent public authority which is established by a Member State responsible for monitoring the application of the GDPR, in order to protect the fundamental rights and freedoms of natural persons in relation to the Processing activities and to facilitate the free flow of Personal Data within the Union. In Portugal, the Supervisory Authority is the Comissão Nacional de Proteção de Dados (hereinafter, the “CNPD”).

Data Subject – An identified or identifiable natural person to whom the Personal Data concerns.

Pseudonymisation – The Processing of Personal Data in such a way that it can no longer be attributed to a specific Data Subject without recourse to supplementary information, provided that such supplementary information is kept separately and is subject to technical and organisational measures to ensure that the Personal Data cannot be attributed to an identified or identifiable natural person.

International Data Transfers – Transfers of Personal Data that are or will be Processed after their transfer to a third country (not located in the European Union or the European Economic Area) or to an international organisation, where such transfer may take place between two or more Controllers or between Controllers and Processors.

General Principles

Concerning the principles relating to the Processing of Personal Data, we undertake to ensure that they are:

• Subject to a lawful, fair, and transparent Processing in relation to the Data Subject.
• Collected for specific, explicit, and legitimate purposes and not further Processed in a manner incompatible with such purposes.
• Adequate, relevant, and limited to what is necessary in relation to the purposes for which they are Processed.
• Accurate and up to date whenever necessary, with all appropriate measures being taken to ensure that inaccurate data, considering the purposes for which it is Processed, is erased, or rectified without delay.
• Kept in a form that allows the identification of the Data Subject for no longer than is necessary for the purposes for which the data are Processed.

• Handled in a manner that guarantees their security, including protection against unauthorised or unlawful Processing and against accidental loss, destruction, or damage, and appropriate technical or organisational measures are taken.

   

Controller

The Controller of the Personal Data collected through the Website is Cyberspatia. For questions relating to privacy, you may contact us through the following e-mail address: support@cyberspatia.com.

What Information do we Collect

We only Process your Personal Data when we are duly authorised to do so. For the Processing of Personal Data to be lawful, the GDPR requires that there be an adequate legal basis for each specific Processing.

Personal Data Processing is lawful when at least one of the following situations applies:

• The Data Subject has given his/her explicit Consent to the Processing of his/her Personal Data for one or more specific purposes.
• The Processing is necessary for the performance of a contract to which the Data Subject is party or in order to take steps at the request of the Data Subject prior to entering into a contract.
• The Processing is necessary for compliance with a legal obligation to which the Controller is subject.
• Processing is necessary in order to protect the vital interests of the Data Subject or of another natural person.
• Processing is necessary for the purposes of our legitimate interests or by Third Parties (except where such interests are overridden by the interests or fundamental rights and freedoms of the Data Subject which require protection of Personal Data).

In this context, the following Personal Data is Processed on the Website:

• User Identification Data: Name and E-mail address.

We Process the aforementioned Personal Data through the Website for the following purposes:

• Newsletters: To keep you informed, engaged, and updated with valuable and relevant insights, we Process User Identification Data, more specifically, your E-mail address. The lawfulness of this Processing activity is based on your Consent.
• Support: To address any support or business inquiries, we process your User Identification Data, more specifically, your Name and E-mail address. The lawfulness of this Processing Activity is based on your Consent.

   

Personal Data Retention Period

Personal Data collected through the Website is Processed in strict compliance with applicable legislation and stored in specific databases created for this purpose. This Personal Data is kept in a format that allows the identification of Data Subjects for no longer than is necessary for the purposes for which it is Processed.

The length of time for which Personal Data is stored and retained varies according to the purpose for which the information is used. There are, however, legal requirements that oblige Personal Data to be kept for a certain period of time.

Therefore, whenever there is no specific legal requirement, the Personal Data will only be stored and kept for the minimum period necessary for the purposes for which it was collected or further Processed, after which it will be deleted.

Data Sharing with Third Parties

Your Personal Data collected through the Website is not shared with Third Parties without your Consent, with the exception of cases in which such transmission or communication is necessary for the fulfilment of our legitimate interests, the performance of a contract entered into between you and us, in order to take steps at the request of the Data Subject prior to entering into a contract, and in the event that it is necessary for the fulfilment of a legal obligation to which we are subject to.

As a result, we may need to communicate or grant access to your Personal Data to Third Parties who collaborate with us, predominantly, to ensure the proper functioning and security of all the services available on Website. These Third Parties include external consultants, cooperation partners, and information technology support services. We guarantee that each of these Third Parties ensures the confidentiality of the Personal Data, by entering into data processing agreements with said entities.

In addition, as previously indicated, we may share your Personal Data with Third Parties under specific circumstances when we hold a good faith belief that it is necessary for the following purposes:

• Comply with applicable laws or respond to judicial orders.
• Respond to requests from public or governmental authorities, particularly for national security or law enforcement objectives.
• Safeguard the vital interests of our users, customers, or other Third Parties. This includes efforts to prevent spam, thwart fraudulent activities related to our products, and prevent potential loss of life or serious injuries.
• To operate and maintain the security and integrity of our Website. This includes preventing or halting any attacks on our computer systems or networks.
• To protect our rights, interests, or property.
• To enforce our Terms & Conditions.

As a complementary note, we may employ and share aggregated non-personal information with Third Parties for marketing, advertising, and analytics purposes.

Data Transfers to Third Countries

The Personal Data we collect may be stored and Processed in Portugal or in any other country where we or our affiliates, subsidiaries, or service providers have operational facilities. The selection of storage locations is guided by the principles of operational efficiency, performance enhancement, and the establishment of redundancies to safeguard data in the event of disruptions or other issues.

We are committed to ensuring that the Personal Data we collect is Processed in accordance with the terms outlined in this Policy and in compliance with the requirements of relevant legislation, regardless of the location of the Personal Data.

In this regard, we may engage in the transfer of Personal Data from the European Economic Area to Third Countries. In the event of such transfers in the future, we are dedicated to ensuring that the transfer aligns with the legal provisions applicable, particularly with regard to the assessment of the destination country’s data protection adequacy and adherence to the required standards for such transfers.

For more information on the European Commission’s decisions regarding the adequacy of Personal Data protection in countries where we Process Personal Data, please refer to this link: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en.

Technical, Organisational, and Safety measures implemented

To guarantee the security of your Personal Data and the utmost confidentiality, we treat the information provided by you in an absolutely confidential manner, in accordance with our internal security and confidentiality policies and procedures, which are updated periodically as necessary, as well as in accordance with the terms and conditions laid down by law.

Depending on the nature, scope, context, and purposes of the Processing of the Personal Data, as well as the risks arising from the Processing activity for the rights and freedoms of the Data Subject, we undertake to apply, both at the time of defining the means of Processing and at the time of the Processing itself, the necessary and appropriate technical and organisational measures for the protection of the Personal Data and compliance with legal requirements.

In general terms, we adopt the following security measures:

• Regular audits to assess the effectiveness of the technical and organisational measures implemented.
• Awareness-raising and training of staff involved in Personal Data Processing operations.
• Pseudonymisation and encryption of Personal Data, whenever justified.
• Mechanisms capable of ensuring the permanent confidentiality, availability, integrity, and resilience of information systems.
• Mechanisms that ensure the restoration of information systems and access to Personal Data in a timely manner in the event of a physical or technical incident.
  

Right of Data Subjects

Under the GDPR, Data Subjects have several rights that allow them to have greater control over their Personal Data. These rights include the right to access their Personal Data (Right of Access), request corrections to inaccuracies (Right to Rectification), and, in certain circumstances, have their Personal Data erased (Right to Erasure).

Data Subjects can also request the restriction of Personal Data Processing (Right to Restriction of Processing), obtain their Personal Data in a portable format for transfer (Right to Portability), and object to specific Processing activities (Right to Object). Data Subjects also have the right to lodge a complaint with a Supervisory Authority (Right to Lodge a Complaint).

If the Processing activity is based on Consent, Data Subjects can withdraw their Consent at any time (Right to Withdraw Consent). However, this will not affect the lawfulness of the Processing activities based on Consent before its withdrawal.

To exercise any of these rights, Data Subjects can contact us through the following E-mail address: support@cyberspatia.com. The response to such requests will be provided within one month, although this period can be extended in certain situations (e.g., due to the complexity of the request).

Third-Party Links

Our Website may feature links to other external sites (“Third-Party Links”). In this regard, this Policy does not apply to such Third-Party links. It’s important to note that the owners of these linked websites are exclusively accountable for their privacy practices and the content they provide. We do not assume responsibility for, endorse, or exercise control over the content and privacy practices of third-party websites.

When you visit a third-party website, you will be subject to the terms and conditions outlined in their respective privacy policies, and it is advisable to carefully review and understand these policies.

Cookies

We utilize Cookies, which are small data files with unique identifiers placed on your device to identify your browser. Cookies serve various purposes, including collecting user information to enhance our platform, as well as storing preferences and settings. It is important to note that while you can manage your Cookie preferences in your account settings, disabling all Cookies may restrict your ability to use or access certain parts or all of our Website.

Additionally, our web pages may incorporate electronic images referred to as web beacons, also known as single-pixel gifs. These web beacons assist in the delivery of Cookies on our Website and help track user visits. We may also embed web beacons in our promotional e-mails or newsletters to determine if and when these communications are opened and acted upon.

Furthermore, we occasionally collaborate with other companies to place our web beacons on their websites or within their advertisements. This collaboration enables us to gather data on how often interactions with an advertisement on our Website lead to a purchase or other actions on the advertiser’s website.

Finally, the services we provide may include web beacons or similar technologies from third-party analytics providers, such as Google Analytics. These technologies help us compile aggregated statistics about the effectiveness of our promotional campaigns and other operations. These analytics providers may set or read their own Cookies or other identifiers on your device, allowing them to collect information about your online activities across various applications, websites, or other products.

For further details on how with Process your Personal Data through Cookies and web beacons, please visit our Cookies Policy.

Changes to the Website

We reserve the right to change this Policy at any time. In the event of a change to the Policy, the “Last Updated Date”, available at the end of this page, will also be updated. If the change is substantial, a notice will be placed on the Website.

Continuing to use the Website after the “Last Updated Date” will signify your acceptance of a consent to these alterations.

Applicable Law and Jurisdiction

This Policy, as well as the collection, Processing, or transmission of the Data Subject’s Personal Data, are governed by the provisions of the GDPR and by the legislation and regulations applicable in Portugal.

Any disputes arising from the validity, interpretation, or execution of this Policy, or which are related to the collection, Processing, or transmission of each User’s Personal Data, shall comply with the rules established on the Website’s Terms & Conditions.

The latest version of this Policy is dated June 14, 2024.