Privacy Policy

1. Scope and Purpose of this Privacy Policy

The Municipality of Arouca, the entity responsible for providing the website and mobile application supporting the Digital Commercial District – Arouca Digital, defines and implements a set of practices to ensure the proper protection of the personal data of all individuals who interact with these platforms.

Committed to transparency and compliance with applicable legal obligations, the Municipality has prepared this Privacy Policy to disclose and communicate the rules governing the processing of personal data in the context of using the digital platforms associated with the Arouca Digital project. This policy, while aligned with the Institutional Privacy Policy of the Municipality, is limited to data processing operations arising from interaction with the website and mobile application.

2. What Legal Framework Is This Policy Based On?

This Privacy Policy is drawn up in accordance with:

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR);
Law No. 58/2019 of 8 August;
Law No. 41/2004 of 18 August, as amended;
Guidelines from the Portuguese Data Protection Authority (CNPD).

Data processing is carried out in accordance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability.

3. Who Is the Data Controller?

The data controller for the data collected through the Arouca Digital platform is the Municipality of Arouca, headquartered at Praça do Município, 4540-001 Arouca, NIPC 506637294.

However, whenever a purchase process is completed through the platform, the participating merchants of Arouca Digital will have access to the necessary personal data to complete the transaction (e.g., name, contact, delivery address, order details). In such cases, the merchants act as independent data controllers and commit to processing users’ data in accordance with the GDPR.

Each user should review the legal identity of each merchant, as well as their specific sales terms, privacy policies, and the contact details provided for exercising data rights. It is the user’s responsibility to be informed about these conditions when interacting with each economic operator.

4. What Are Personal Data and What Categories Do We Process on Arouca Digital?

Under the GDPR, personal data refers to any information relating to an identified or identifiable natural person. Within the scope of using the Arouca Digital platform, the following data are processed, including for consumers and merchants, when applicable:

Identification and Contact Data: Name, tax ID (NIF), identification document, date of birth, phone number, email, address, login credentials, payment details.
Platform Interaction Data: Purchase history, booked services, visited pages, searches performed.
User Profile: Preferences, interests, interactions, and browsing behavior.
Location Data: Information regarding the approximate or precise location of the user, collected only with their explicit consent. This data is used exclusively for application features that depend on geolocation, such as displaying maps or relevant content for the user’s geographical area. Location data is not shared with third parties and is not used for marketing or profile creation purposes.

In addition to the categories above, Arouca Digital may process other personal data provided that such processing:

Is necessary to comply with legal or regulatory obligations;
Results from the execution of a contract with the data subject;
Is carried out based on the explicit consent of the data subject, particularly for marketing, notifications, or content personalization;
Is based on a legitimate interest, duly considered, of the Municipality or involved economic operators, such as for fraud prevention, information security, user experience improvement, or aggregated statistical analysis.

Whenever it is necessary to collect and process additional categories of data, data subjects will be clearly and transparently informed, and their rights will be safeguarded.

5. In What Situations Do We Process Your Personal Data?

a) Users

Create an account on the platform;
Make purchases, bookings, or interactions;
Provide consent for communications;
Use features or request support.

b) Merchants

Request to join the platform;
Formalize contracts with the Municipality;
Manage products, sales, and orders;
Participate in communications or campaigns.

Data may be processed digitally, in writing, or in person.

6. For What Purposes Do We Process Your Personal Data?

Arouca Digital processes your data exclusively for the purposes communicated and relevant to the platform’s operation, namely:

a) Users

User account management;
Transaction and delivery processing;
Institutional and marketing communications (with consent);
Compliance with legal obligations (e.g., tax).

b) Merchants

Registration and validation as a participant;
Contractual, tax, and promotional management;
Technical support and sales monitoring;
Institutional promotion (with consent).

Processing is conducted in line with the principle of data minimization, collecting only data necessary for each purpose.

7. What Is the Legal Basis for Processing Your Personal Data?

The legal grounds include:

a) Users

Consent: e.g., marketing, notifications.
Contract execution: e.g., orders and bookings.
Legal obligation: e.g., accounting and security.
Legitimate interest: e.g., platform improvement.

b) Merchants

Execution of contract with the Municipality;
Compliance with legal and regulatory duties;
Legitimate interest in promoting local commerce;
Consent, when applicable (e.g., publications).

All processing is conducted with security and confidentiality safeguards.

8. How Long Do We Keep Your Personal Data?

We retain your data only for as long as necessary for the purposes for which they were collected, and additionally whenever needed to comply with legal obligations applicable to the Municipality.

9. To Whom Do We Disclose Your Personal Data?

Your personal data may be disclosed to third parties, always with legal basis and for legitimate, specific purposes, including:

Service providers acting on behalf of or for the Digital District, such as transport companies, payment services, or technology providers, strictly to the extent required to deliver contracted services;
Public entities or administrative authorities, such as the Tax Authority, where the law mandates disclosure or availability of data;
Merchants on the Digital District platform, when the user makes a direct purchase or request for products or services offered by these merchants. In such cases, the personal data strictly necessary for managing the order, invoicing, delivery, or requested service will be shared with the responsible merchant, who will act as an independent data controller regarding the data received. Users are advised to consult each merchant’s privacy policy for more information on their data processing practices.

10. What Are Your Data Protection Rights and How Can You Exercise Them?

You may exercise the following rights at any time:

Right of access;
Right to rectification;
Right to erasure;
Right to restriction of processing;
Right to object;
Right to data portability;
Right not to be subject to automated decisions.

To do so, contact:

Data Protection Officer – Municipality of Arouca
Email: epd@cm-arouca.pt
Address: Praça do Município, 4540-001 Arouca

11. How Do We Protect Your Personal Data?

Restricted access;
Secure and encrypted channels;
Access control and monitoring;
Regular audits;
System backup and redundancy;
Continuous improvement policy.

12. Updates to This Privacy Policy

This Policy may be reviewed periodically. Any relevant changes will be communicated via the Arouca Digital website and mobile app.