Gomes Equestre – Personal Data Protection Policy
Gomes Equestre is responsible for the collection and processing of personal data obtained through digital means, namely using this website. The company is committed to respecting users’ privacy, ensuring the confidentiality, integrity, and security of the data received, in strict compliance with the General Data Protection Regulation (GDPR – Regulation (EU) 2016/679) and Portuguese Law No. 58/2019 of August 8.
This Personal Data Protection Policy outlines our practices regarding retention, processing, and access to personal information. By accepting this policy, you authorize Gomes Equestre to process your personal data, which you confirm to own, as well as data related to your commercial and contractual relationship, and its management, under the terms defined herein (Article 6(1)(a) and (b) of the GDPR).
You also declare that you are fully informed that the processing of your personal data, previously provided by you, may include all operations carried out by automated or manual means, as defined in Article 4(2) of the GDPR.
Additionally, you acknowledge your rights to access, rectify, object to, restrict, port, and delete your personal data, under Articles 15 to 22 of the GDPR. These rights may be exercised by requesting the designated email address. You also have the right to lodge a complaint with the National Data Protection Commission (CNPD), in accordance with Article 77 of the GDPR and Article 57 of Law No. 58/2019.
Please read the following terms carefully:
1. PREAMBLE
This Personal Data Protection Policy, hereinafter referred to as the “Protection Policy,” aims to inform you about:
1.1. The commitments made by Gomes Equestre regarding the protection of personal data, in compliance with the GDPR (Regulation (EU) 2016/679), which governs the protection of natural persons regarding the processing of personal data and the free movement of such data.
1.2. How Gomes Equestre processes your personal data, particularly those obtained through digital means, via its website and/or digital applications.
2. DEFINITIONS
To this policy, the following definitions apply as per Article 4 of the GDPR:
• “Personal Data”: any information relating to an identified or identifiable natural person.
• “Data Subject”: the identified or identifiable natural person to whom the data relates.
• “Data Controller”: the entity that determines the purposes and means of processing personal data – in this case, Gomes Equestre;
• “Processor”: an external entity that processes personal data on behalf of Gomes Equestre, under a written contract ensuring GDPR compliance (Article 28);
3. COMMITMENTS UNDERTAKEN
3.1. PRINCIPLES OF PERSONAL DATA PROTECTION
• “Processing”: any operation performed on personal data, whether by automated means, including collection, recording, organization, storage, alteration, consultation, use, transmission, dissemination, deletion, or destruction.
3. COMMITMENTS UNDERTAKEN
Gomes Equestre ensures the protection of users’ personal data, in compliance with the GDPR and Law No. 58/2019, concerning all legal obligations applicable to the processing of personal data through its websites, digital applications, or other means (including clients, potential clients, job applicants, etc.).
Appropriate technical and organizational measures have been implemented (Article 32 of the GDPR) to ensure the security, confidentiality, and integrity of personal data processed, along with internal awareness policies for staff, suppliers, and partners to ensure GDPR compliance.
3.1. PRINCIPLES OF PERSONAL DATA PROTECTION
Gomes Equestre undertakes to process personal data in accordance with the principles established in Article 5 of the GDPR, namely:
• Lawfulness, fairness, and transparency: data is processed lawfully, fairly, and transparently.
• Purpose limitation: data is collected for specific, explicit, and legitimate purposes and not further processed in an incompatible manner.
• Data minimization: only data strictly necessary for the defined purposes is processed.
• Accuracy: data must be accurate and kept up to date.
• Storage limitation: data is kept only for as long as necessary for purposes (Article 5(1)(e));
• Integrity and confidentiality: data is processed securely, protected from unauthorized access, destruction, or accidental loss.
Gomes Equestre demands the same level of protection from all its processors, in accordance with Article 28 of the GDPR.
4. PERSONAL DATA PROCESSING
4.1. HOW PERSONAL DATA IS COLLECTED
Gomes Equestre collects personal data in its physical stores and via its website and/or digital applications, with the data subject’s explicit consent or based on another lawful condition under Article 6 of the GDPR.
Data collection may occur in the following situations:
• At physical stores of Gomes Equestre;
• During registration/account creation on the website or applications.
• While browsing the website or applications (collection of technical data such as IP, logs, or cookies, under Article 8 of Law No. 41/2004, as amended by Law No. 46/2012);
• When purchasing products or services online.
• When subscribing to the Gomes Equestre newsletter.
• When participating in contests, promotional campaigns, product tests, or surveys.
• When applying for job opportunities.
• When interacting on Gomes Equestre’s social media (comments, messages, images);
• Whenever you voluntarily provide personal data and consent to its processing.
4.2. WHY IS PERSONAL DATA COLLECTED
Customer Relationship Management
Gomes Equestre collects personal data to manage commercial relationships with clients and potential clients, specifically to:
• Enable website and app navigation with a personal account and related services;
• Allow online ordering of products and services.
• Provide after-sales services;
• Collect customer feedback through surveys and tests;
• Enable participation in contests, questionnaires, and marketing activities;
• Conduct statistical, financial, and business analysis and manage digital traffic, based on Gomes Equestre’s legitimate interest (Art. 6(1)(f) of the GDPR), to improve user experience and services;
• Send promotional and marketing communications about Gomes Equestre’s products, services, campaigns, and events, with prior consent (Art. 6(1)(a) of the GDPR and Art. 13-A of Law No. 41/2004, as amended by Law No. 46/2012).
These communications may be sent via email, phone, SMS, or MMS, based on the data subject’s consent and right to object at any time (Art. 21 of the GDPR).
Fraud Prevention
Personal data may also be processed for fraud prevention, including:
• Ensuring secure transactions, avoiding identity theft and payment fraud (legitimate interest, Art. 6(1)(f) GDPR);
• Automated audits of online payments;
• Disclosure of data to third parties such as service providers or, where required by law, to public or judicial authorities (Art. 6(1)(c) GDPR).
In such cases, Gomes Equestre may withhold transactions until the situation is resolved. The data subject will be informed and may verify their identity (right to information – Arts. 13 and 14 GDPR).
In online forms, mandatory fields are marked with an asterisk. Failure to provide such data prevents the request or order from being processed. Non-mandatory data is optional.
Recruitment and Human Resources Management
Gomes Equestre collects job application data through a dedicated form in-store or on the website. This data is processed based on pre-contractual measures (Art. 6(1)(b) GDPR) or the company’s legitimate interest in managing recruitment processes (Art. 6(1)(f)).
If not selected, candidate data is retained under the conditions specified in clause 4.4.
4.3. LEGAL BASIS FOR PROCESSING
Gomes Equestre processes personal data based on one or more of the legal bases set out in Article 6 of the GDPR:
• Legitimate interest (Art. 6(1)(f)): to protect activities, customize offers, and fight fraud;
• Contract performance or pre-contractual measures (Art. 6(1)(b)): to process orders, provide services, or manage applications;
• Legal obligation (Art. 6(1)(c)): e.g., for tax or judicial purposes;
• Explicit consent (Art. 6(1)(a)): for marketing, cookies, etc.
Gomes Equestre will only process personal data if:
• The data subject has given explicit consent for one or more purposes;
• Processing is necessary for contract performance;
• Processing is necessary for the company’s legitimate interests, without overriding the fundamental rights and freedoms of the data subject, especially in the case of minors.
4.4. DATA RETENTION PERIOD
In accordance with Article 5(1)(e) of the GDPR and Article 28 of Law No. 58/2019, Gomes Equestre retains data only for as long as necessary for the purposes for which it was collected, or for the legally required period.
• Information request data: retained only as long as needed to respond;
• Direct marketing data: retained until consent is revoked or the right to object is exercised. Gomes Equestre will retain only the minimum necessary data to ensure this right;
• Job application data: retained for up to 12 months after the last activity;
• Cookies: stored until deleted by the user in their browser settings.
4.5. RECIPIENTS OF PERSONAL DATA
Access to personal data is restricted to Gomes Equestre employees who need it for customer service, sales, recruitment, or HR management purposes.
Gomes Equestre does not share data with third parties, except:
• Processors (IT service providers, hosting, customer support, payment services), under written contracts with security and confidentiality guarantees (Art. 28 GDPR);
• Judicial or administrative authorities, when legally required (Art. 6(1)(c) GDPR).
Gomes Equestre ensures that recipients implement adequate protection measures and that data is processed securely.
5. ABOUT COOKIES
What are cookies?
Websites, applications, and digital platforms may use cookies or similar technologies to improve your browsing experience. Cookies are small text files stored on your device (computer, tablet, smartphone) that record information about your preferences and interactions with the website.
Under Article 5 of Law No. 41/2004, as amended by Law No. 46/2012, the installation of cookies requires the informed and explicit consent of the user, except for cookies that are strictly necessary for the website’s technical operation.
Our use of cookies
When browsing the Gomes Equestre website, cookies are used for the following purposes:
• Technical purposes (essential cookies), e.g., to identify sessions, maintain preferences or shopping carts, ensuring the basic operation of the website;
• Statistical analysis and traffic management, to evaluate website usage and improve content and features (based on legitimate interest, Art. 6(1)(f) GDPR);
• Audience targeting and advertising, including remarketing and personalized ads (with explicit consent, Art. 6(1)(a) GDPR);
• Geolocation, whenever using specific features like nearby store suggestions.
Cookies may be:
• Session cookies, which are automatically deleted when you close your browser;
• Persistent cookies, which remain on your device until they expire or are manually deleted.
5.1. OTHER COOKIES
Third-party cookies
With your consent, third parties (e.g., advertising agencies, analytics platforms) may install cookies for statistical or advertising purposes. These cookies are governed by their own privacy policies, over which Gomes Equestre has no direct control.
These cookies allow:
• Personalizing ads based on your browsing habits;
• Evaluating marketing campaigns;
• Displaying relevant content on other websites you visit.
Social media
The Gomes Equestre website may include social media components (e.g., “share” buttons, plugins) that allow users to interact directly with those platforms. These elements may collect browsing data even without user interaction, as long as the user is logged into the respective social network.
The use of such data is the sole responsibility of the involved social networks and is governed by their privacy policies (e.g., Facebook, Instagram, YouTube, etc.).
We recommend reading those policies to understand how your data is processed and what control options you have.
Shared devices
If you use a shared device, cookies may influence the content displayed based on other users’ browsing activity. Gomes Equestre cannot guarantee that the content shown will match the personal history of a single user.
We recommend adjusting device access and privacy permissions whenever possible.
Cookie settings
Users may change their cookie preferences at any time through their browser settings. Disabling certain cookies may affect website functionality or prevent the use of certain features.
Gomes Equestre is not responsible for any negative impact on navigation or services caused by cookie deactivation.
Instructions for managing cookies in major browsers:
• Google Chrome
• Mozilla Firefox
• Microsoft Edge
• Safari
• Internet Explorer
For other devices (smartphones, tablets), refer to the help menu of the respective browser.
6. SECURITY MEASURES AND DATA PROCESSORS
Gomes Equestre has implemented appropriate technical and organizational measures to ensure a level of personal data security appropriate to the risk, in accordance with Article 32 of the GDPR. These measures aim to protect personal data against destruction, loss, alteration, unauthorized disclosure, or accidental or unlawful access.
These measures include, in particular:
• Physical and logical access control;
• Internal information security procedures;
• Data encryption and pseudonymization (where applicable);
• Employee training on data protection;
• Regular risk assessments and security testing.
Gomes Equestre requires its processors (service providers processing data on its behalf) to provide the same level of protection through written agreements that ensure compliance with Article 28 of the GDPR.
Any Gomes Equestre employee with access to personal data is bound by confidentiality obligations under Article 29 of the GDPR.
7. EXERCISING YOUR RIGHTS
Under Articles 12 to 23 of the GDPR, data subjects may exercise the following rights at any time and free of charge:
• Right of access to your personal data (Art. 15);
• Right to rectification of inaccurate or incomplete data (Art. 16);
• Right to erasure ("right to be forgotten") when applicable (Art. 17);
• Right to restriction of processing, in certain situations (Art. 18);
• Right to data portability, when processing is based on consent or a contract (Art. 20);
• Right to object to processing, particularly for direct marketing purposes (Art. 21);
• Right to withdraw consent, where processing is based on consent (Art. 7(3)).
To exercise any of these rights, including the right to be forgotten, you may contact Gomes Equestre via the email address: geral@gomesequestre.com
To process your request, we may require identification data (name, surname, email, address, or other information to confirm your identity), as provided for in Article 12(6) of the GDPR.
If you believe your data is being processed in violation of applicable law, you also have the right to lodge a complaint with the supervisory authority, which in Portugal is the Comissão Nacional de Proteção de Dados (CNPD), under Article 77 of the GDPR and Article 57 of Law No. 58/2019.
8. CHANGES TO OUR PROTECTION POLICY
Gomes Equestre reserves the right to amend this Personal Data Protection Policy at any time, in compliance with legal or regulatory changes, or if it intends to use personal data for purposes other than those initially communicated, as per Article 13(3) and Article 14(4) of the GDPR.
Any changes will be published on this page, along with the update date. In the case of significant changes affecting the purposes or legal basis of the processing, Gomes Equestre will notify the data subjects directly, whenever required by law.
Contact for inquiries or rights requests: geral@gomesequestre.com
