Enigma Eximio Lda., hereinafter referred to as Docnutry, undertakes to process your personal data in accordance with Regulation (EU) No. 2016/679 of 27 April 2016 (hereinafter referred to as the General Data Protection Regulation or GDPR), and other legislation in force on this matter.

Docnutry reserves the right to change the privacy policy, so it is advisable to read this document regularly.

Please read the following text to understand and become aware of the general privacy rules and how the personal data you provide to Docnutry is processed.

This policy identifies who we are, for what purpose we intend to use your data, how we process it, with whom we share it, for how long we keep it, as well as the contact methods available to you so that you can exercise your rights, 

Data controller

Enigma Eximio Lda. is responsible for processing personal data collected during use and/or registration on this website, within the meaning of the GDPR.

Docnutry's contact details are as follows:

(Docnutry) Enigma Eximio Lda
Straight Street No. 17 – Reguengo 2070-505 Valada
NIF 518738620
Email: info@docnutry.com
Phone: 936958668

Information collected

In order to become a customer in the Docnutry online store, you must register by filling out the form available on the respective website at www.Docnutry.com.

Personal data is collected at the time of customer registration or at the time of purchase. The following data is collected: name, gender, billing address, delivery address, date of birth, taxpayer number, telephone number, email address, product ordered and medical prescription where applicable. If the payment method is bank transfer, the following data will be collected: IBAN and name of the bank account holder. Electronic identification data may also be collected, which may include IP address; cookies or similar technologies; activity logs.

Providing the data requested when registering on the Docnutry website is mandatory so that the customer can use/purchase the services and products available.

The customer may update the information provided, whenever they wish and with complete autonomy, in the “My Account” area after logging in, by entering their username and password.

In order for you to subscribe to the Docnutry Blog, the following data is collected: name and email.

Use and purposes of the processing of the data subject's data

In general terms, Docnutry uses the data subject's data for various purposes, compliance with obligations arising from the law, management of the commercial relationship, supply of purchased products, provision of contracted services, adaptation of services and products to the customer's needs and interests, communication and information actions, to publicize campaigns, promotions, advertising and news about products and/or services, marketing.

Data retention period for the holder

The period of time during which data is stored and retained varies according to the purpose for which the information is processed. However, there are legal requirements that require data to be retained for a minimum period of time. Therefore, and whenever there is no specific legal requirement, data will be stored and retained only for the minimum period necessary for the purposes for which it was collected or subsequently processed, after which it will be deleted.

Like this,

– Personal data such as name, address, contact details, email, etc. will be kept for a period of 2 years, from the last contact. Data subjects may request the destruction/opposition of their data, prior to the defined period, and this will be complied with, provided that there are no legal requirements that prevent such action. This period may be extended, exceptionally, due to legal requirements.

– Data relating to purchase history is kept for 2 years from the date of purchase. Holders may request the destruction/opposition of their data, prior to the defined period, and this will be complied with, provided that there are no legal requirements that prevent such action. This period may be extended, exceptionally, due to legal requirements.

– Data for sending communications (e.g. marketing, blog, newsletter, etc.), it is not possible to know in advance the retention period. This data will be stored for as long as it is permitted by users and the relationship between them and Docnutry is maintained.

Subcontracted entities

In the context of processing the data subject's data, Docnutry uses or may use third parties, subcontracted by it, to, on behalf of Docnutry, and in accordance with the instructions given by it, process the data subject's data, in strict compliance with the provisions of the law and this Privacy Policy.

Docnutry undertakes to only subcontract entities that provide sufficient guarantees of implementing appropriate technical and organizational measures in order to ensure the protection of the rights of the data subject. All entities subcontracted by Docnutry are bound to the latter through a written contract regulating, in particular, the object and duration of the processing, the nature and purpose of the processing, the type of personal data, the categories of data subjects and the rights and obligations of the parties.

As part of Docnutry's normal operation, the data collected by Docnutry may be shared with the following entities:

– Carriers responsible for delivering orders

– Entities responsible for the payment processing service selected by the customer

– Entity responsible for Communication and Marketing at Docnutry

– Website service providers or IT support service providers

– In connection with the provision of advertising services, we may share some limited personal data (e.g. device identifiers, cookie identifiers) with ad exchanges or agencies that manage advertising on third-party websites and apps where you may see advertising.

– If the data subject contracts services from Docnutry that are provided by other entities responsible for the processing of personal data, the data subject’s data may be consulted or accessed by these entities, to the extent that this is necessary for the provision of said services.

– Under applicable legal terms, Docnutry may transmit or communicate the data subject’s data to other entities if such transmission or communication is necessary for the execution of the contract established between the data subject and Docnutry, or for pre-contractual steps at the request of the data subject, if it is necessary for compliance with a legal obligation to which Docnutry is subject or if it is necessary for the purpose of pursuing the legitimate interests of Docnutry or a third party.

If the data subject's data is transmitted to third parties, reasonable efforts will be made to ensure that the transmitter uses the data subject's data transmitted in a manner consistent with this Privacy Policy.

Transfer of data outside the European Union

Personal data collected and used by Docnutry may be made available to third parties established outside the European Union. If this transfer takes place, Docnutry undertakes to ensure that the transfer complies with the applicable legal provisions, in particular regarding the determination of the adequacy of such country with regard to data protection and the requirements applicable to such transfers.

Rights of personal data holders 

The Rights of Personal Data Holders are as follows:

– Right to information

– Right of access to personal data

– Right to erasure or right “to be forgotten”

– Right to rectify your personal data

– Right to limit the processing of your personal data

– Right to portability

– Right to object to processing

Procedures for exercising rights by the holder

The right of access, the right of rectification, the right of erasure, the right to limitation, the right to portability and the right to object may be exercised by the data subject by contacting the Data Controller, filling in the respective form that will be provided.

Docnutry will respond in writing (including by electronic means) to the holder's request within a maximum period of one month from receipt of the request, except in cases of special complexity, in which this period may be extended up to two months.

If the requests submitted by the holder are manifestly unfounded or excessive, in particular due to their repetitive nature, Docnutry reserves the right to charge administrative costs or refuse to comply with the request.

Cookies

In order to provide a better service to the user, we use cookies, i.e. small text files that are placed on the hard drive by a web page server. This technology is used, in particular, to: 

– Allow to improve the performance and browsing experience of its users, increasing, on the one hand, the speed and efficiency of response and, on the other, eliminating the need to repeatedly enter the same information;

– Placing cookies not only helps websites recognize the user’s device the next time they visit them, but is also essential for their operation. The cookies used on the website do not collect personal information that allows the user to be identified, but only store generic information, namely the user’s access method or location and the way they use the websites, among others. The user can always configure their browser to refuse cookies, however, in this case, the website or parts of it may not function as expected;

– Allows you to save your purchase history, list of interests and products in your shopping cart.

Personal data breach

In the event of a data breach and to the extent that such breach is likely to entail a high risk to the rights and freedoms of the data subject, Docnutry undertakes to communicate the personal data breach to the CNPD within 72 hours of becoming aware of the incident.

Under legal terms, communication to the holder is not required in the following cases:

– If Docnutry has applied appropriate protection measures, both technical and organizational, and these measures have been applied to the personal data affected by the personal data breach, especially measures that make the personal data incomprehensible to any person not authorized to access such data, such as encryption;

– If Docnutry has taken subsequent measures that ensure that the high risk to the rights and freedoms of the data subject is no longer likely to materialize; or

– If communication to the data subject implies a disproportionate effort for Docnutry. In this case, Docnutry will make a public communication or take a similar measure through which the data subject will be informed.

Links

Our website may contain links to third-party websites. Docnutry is not responsible for the privacy practices of such websites. We therefore recommend that you read their respective privacy statements. Docnutry cannot be held responsible, nor can it be held liable, for the content and activities of such websites.

Applicable law and jurisdiction

The Privacy Policy, as well as the collection, processing or transmission of the holder's Data, are governed by the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 and by the legislation and regulations applicable in Portugal.