Enigma Eximio Lda., hereinafter referred to as Docnutry, undertakes to process your personal data in accordance with Regulation (EU) No. 2016/679 of April 27, 2016 (hereinafter referred to as the General Data Protection Regulation or GDPR), and all other applicable legislation in this area.

Docnutry reserves the right to change its privacy policy; therefore, we recommend that you review this document regularly.

Please read the text below to understand and become familiar with the general privacy rules and how Docnutry processes the personal data you provide.

This policy explains who we are, the purposes for which we intend to use your data, how we process it, with whom we share it, how long we retain it, as well as the contact options available to you so that you can exercise your rights,

Data Controller

Enigma Eximio Lda. is the data controller for the personal data collected during the use of and/or registration on this website, as defined by the GDPR.

Docnutry’s contact information is as follows:

(Docnutry) Enigma Eximio Lda
Rua Direita No. 17 – Reguengo 2070-505 Valada
Tax ID 518738620
Email: [email protected]
Phone: +351 910 525 557

Information collected

To become a customer of the Docnutry online store, you must register by filling out the form available on the website at www.Docnutry.com

Personal data is collected at the time of customer registration or at the time of purchase. The following data is collected: name, gender, billing address, shipping address, date of birth, taxpayer ID, phone number, email address, product ordered, and prescription, when applicable. If the payment method is a bank transfer, the following data will be collected: IBAN and name of the bank account holder. Electronic identification data may also be collected, which may include IP address; cookies or similar technologies; and activity logs.

Providing the information requested during registration on the Docnutry website is required in order for the customer to use or purchase the available services and products.

Customers can update the information they have provided whenever they wish and entirely on their own in the “My Account” section after logging in with their username and password.

To subscribe to the Docnutry Blog, the following information is collected: name and email address.

Use and Purposes of the Data Subject’s Data Processing

In general, Docnutry uses the data subject’s data for various purposes, including compliance with legal obligations, management of the business relationship, delivery of purchased products, provision of contracted services, tailoring of services and products to the customer’s needs and interests, communication and informational activities to publicize campaigns, promotions, advertising, and news about products and/or services, as well as for marketing purposes.

Retention period for data subjects’ data

The length of time for which data is stored and retained varies depending on the purpose for which the information is processed. However, there are legal requirements that mandate the retention of data for a minimum period of time. Therefore, in the absence of a specific legal requirement, data will be stored and retained only for the minimum period necessary for the purposes for which it was collected or subsequently processed, after which it will be deleted.

Therefore,

– Personal data such as name, address, contact information, email, … will be retained for a period of 2 years from the date of the last contact. Data subjects may request the deletion of their data or object to its processing prior to the defined period, and such requests will be honored provided there are no legal requirements preventing such action. This period may be extended, in exceptional cases, due to court orders.

– Purchase history data is retained for 2 years from the date of purchase. Data subjects may request the destruction of or object to the processing of their data prior to the defined period, and such requests will be honored provided there are no legal requirements preventing such action. This period may be extended, in exceptional cases, due to court orders.

– Data used to send communications (e.g., marketing, blog posts, newsletters, etc.): It is not possible to determine in advance how long this data will be retained. This data will be stored as long as users consent to its retention and the relationship between them and Docnutry remains in effect.

Subcontractors

In connection with the processing of the data subject’s data, Docnutry uses or may use third-party entities, which it has subcontracted, to process the data subject’s data on behalf of Docnutry and in accordance with Docnutry’s instructions, in strict compliance with the provisions of the law and this Privacy Policy.

Docnutry is committed to subcontracting only entities that provide sufficient guarantees that they will implement appropriate technical and organizational measures to ensure the protection of the data subject’s rights. All entities subcontracted by Docnutry are bound to Docnutry by a written contract that specifies, in particular, the purpose and duration of the processing, the nature and purpose of the processing, the type of personal data, the categories of data subjects, and the rights and obligations of the parties.

As part of Docnutry’s normal operations, the data collected by Docnutry from data subjects may be shared with the following entities:

– Shipping companies responsible for delivering packages

– Entities responsible for the payment processing service selected by the customer

– The organization responsible for Communications and Marketing at Docnutry

– Website service providers or IT support service providers

– In connection with the provision of advertising services, we may share certain limited personal data (e.g., device identifiers, cookie identifiers) with ad exchanges or agencies that manage advertising on third-party websites and apps where you may see ads.

– If the data subject contracts with Docnutry for services that are provided by other entities responsible for processing personal data, the data subject’s data may be viewed or accessed by those entities to the extent necessary for the provision of such services.

– In accordance with applicable law, Docnutry may transfer or disclose the data subject’s data to other entities if such transfer or disclosure is necessary for the performance of the contract between the data subject and Docnutry, or for pre-contractual measures at the data subject’s request, if it is necessary to comply with a legal obligation to which Docnutry is subject, or if it is necessary for the purposes of pursuing the legitimate interests of Docnutry or a third party.

In the event that data is transferred from the data subject to a third party, reasonable efforts will be made to ensure that the recipient uses the data subject’s data in a manner consistent with this Privacy Policy.

Data Transfer Outside the European Union

Personal data collected and used by Docnutry may be disclosed to third parties located outside the European Union. If such a transfer occurs, Docnutry undertakes to ensure that the transfer complies with applicable legal provisions, particularly regarding the determination of that country’s adequacy with respect to data protection and the requirements applicable to such transfers.

Rights of Data Subjects

The rights of data subjects are as follows:

– Right to Information

– Right of access to personal data

– Right to erasure or the “right to be forgotten”

– Right to rectify your personal data

– Right to restrict the processing of your personal data

– Right to portability

– Right to object to processing

Procedures for the Data Subject to Exercise Their Rights

The right of access, the right to rectification, the right to erasure, the right to restriction of processing, the right to data portability, and the right to object may be exercised by the data subject by contacting the Data Controller and filling out the appropriate form that will be provided.

Docnutry will respond in writing (including electronically) to the data subject’s request within one month of receiving the request, except in particularly complex cases, in which case this period may be extended to two months.

If the requests submitted by the account holder are manifestly unfounded or excessive—particularly due to their repetitive nature—Docnutry reserves the right to charge administrative fees or to refuse to process the request.

Cookies

To provide a better service to our users, we use cookies—small text files that are stored on your hard drive by a web server. This technology is used, in particular, to:

– To improve the performance and browsing experience for your users by, on the one hand, increasing the speed and efficiency of responses and, on the other hand, eliminating the need to repeatedly enter the same information;

– The use of cookies not only helps websites recognize the user’s device the next time they visit, but is also essential for the websites to function properly. The cookies used on this website do not collect personally identifiable information; they store only general information, such as how and where the user accesses the site and how they use the websites, among other things. You can always configure your browser to reject cookies; however, in that case, the website or parts of it may not function as expected;

– Allow users to save their purchase history, wish list, and items in their shopping cart.

Personal Data Breach

In the event of a data breach, and to the extent that such a breach is likely to pose a high risk to the rights and freedoms of the data subject, Docnutry undertakes to report the personal data breach to the CNPD within 72 hours of becoming aware of the incident.

Under the law, notification to the data subject is not required in the following cases:

– If Docnutry has implemented appropriate technical and organizational safeguards, and those safeguards have been applied to the personal data affected by the personal data breach—particularly measures that render the personal data unintelligible to any person not authorized to access such data, such as encryption;

– If Docnutry has taken subsequent measures to ensure that the high risk to the data subject’s rights and freedoms is no longer likely to materialize; or

– If notifying the data subject would require a disproportionate effort on Docnutry’s part. In such a case, Docnutry will issue a public notice or take a similar measure to ensure that the data subject is informed.

Links

Our website may contain links to third-party websites. Docnutry is not responsible for the privacy practices of such websites. We therefore recommend that you read their respective privacy statements. Docnutry cannot be held liable, nor can it be held responsible, for the content and activities of such websites.

Applicable Law and Jurisdiction

The Privacy Policy, as well as the collection, processing, or transmission of the data subject’s data are governed by the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, and by the applicable laws and regulations in Portugal.