SUMA and its subsidiaries, including ECOVISION, are committed to ensuring the security of personal data.

SUMA has prepared this Privacy Notice to disclose the principles, terms and conditions under which it collects, uses, stores and processes personal data, in accordance with the Personal Data Protection Law of the Sultanate of Oman, promulgated by Royal Decree No. 6/2022 (hereinafter referred to as the ‘Law’).

The processing of personal data described in this Notice concerns the personal data of citizens who have a relationship with SUMA and the Group companies.

Who is responsible for processing your personal data?

SUMA is the entity responsible for processing personal data collected through websites and digital platforms managed for ECOVISION and other SUMA Group companies, in accordance with the law. Contact: privacy@suma.pt , +351 217 997 700.

What personal data do we collect?

The personal data we collect depends on the context of your interactions with SUMA, within the scope of its commercial activity and in compliance with its legal obligations.

SUMA collects and processes personal data that is voluntarily provided by the data subject through various contacts established in person, via the website, by telephone, by post or by email.

Any information provided by the data subject will only be used for the purpose described and in strict compliance with data protection legislation.

What are the purposes that precede the collection of your personal data and what is the basis for its processing?

SUMA ensures that your personal data is processed within the scope of the purpose for which it was collected, or for purposes compatible with the initial purpose for which it was collected. In addition, we process your personal data for legally established purposes.

Customer support services

SUMA uses customers' Personal Data for customer support purposes, including responding to customer enquiries. This usually requires the use of certain personal contact information and information about the reason for the customer's enquiry (e.g. requests for information, service requests, complaints about a product or service, general questions, suggestions, compliments, environmental communication programmes, etc.). In these situations, the processing of your data is necessary for the performance of the contract to be concluded between you and SUMA, or for the performance of pre-contractual steps at your request. If you do not provide your data, we will not be able to provide you with the requested or contracted services. Your data will be kept for this purpose for the duration of the contract(s), plus 10 years after termination. The data of potential customers will be kept for 2 years. Customers' personal data may be processed by SUMA for the purpose of managing disputes. In these situations, processing is carried out to the extent necessary to comply with applicable legal obligations or to ensure the protection of the rights of SUMA or the data subject, in accordance with the legislation of the Sultanate of Oman, with the data being kept for the period necessary to exercise those rights.

Marketing Communications

ECOVISION, with the customer's consent (where necessary), uses the customer's Personal Data to provide them with information about new goods, products or services (e.g. marketing communications or campaigns and promotions). This may be done via email, advertisements, SMS, telephone calls and postal mail, to the extent permitted by applicable law. Some of ECOVISION's campaigns and promotions are conducted on third-party websites and/or social networks. This use of the customer's Personal Data is voluntary, which means that the customer may withdraw their consent whenever they wish. Your data will be kept for this purpose until the data subject exercises their right to withdraw consent.

Management of Complaints and Contacts Received

In your relationship with ECOVISION, you may send us suggestions or complaints regarding the services provided by ECOVISION; in these situations, your data will be collected to analyse and resolve the situation underlying your request/complaint, and will be processed to the extent necessary to comply with applicable legal obligations or to ensure the protection of the rights of the data subject or ECOVISION, in accordance with the legislation of the Sultanate of Oman.

Events

At events promoted by ECOVISION, the processing of your personal data is necessary to ensure the management of your registration and participation in the event. Images may also be collected, based on your consent. This use of your personal data is voluntary, which means that you can withdraw your consent whenever you wish. Your data will be kept for this purpose until the data subject exercises their right to withdraw consent.

Supplier Management

The processing of your data is necessary for the execution of the contract to be concluded between you and ECOVISION, or for the performance of pre-contractual procedures at your request. If you do not provide your data, we will not be able to fulfil our contractual obligations. Your data will be stored for this purpose for the duration of the contracts, plus 10 years after termination. The data of potential customers will be kept for 2 years.

The personal data of suppliers may be processed by ECOVISION for the purpose of litigation management. In these situations, the processing is carried out to the extent necessary to comply with applicable legal obligations or to ensure the protection of the rights of ECOVISION or the data subject, in accordance with the legislation of the Sultanate of Oman, and the data is kept for the period necessary to exercise these rights.

The data of ECOVISION's suppliers, in particular employees, may be communicated to ECOVISION's customers in order to comply with legal or contractual obligations.

Recruitment

ECOVISION, following an open recruitment process or a spontaneous application, will process your data for the purposes of selecting and recruiting candidates, as necessary for the execution of pre-contractual procedures.  The personal data collected will be kept for a maximum of 2 years in cases where your application has not been considered for any vacancy. Based on your consent, we will keep your data for a period longer than 2 years if you wish your data to be considered for a future vacancy that matches your profile.

Video Surveillance System

ECOVISION has a video surveillance system in place at its premises to ensure the safety of people and property. Your image is captured simply by entering our premises; no sound is recorded. This data may be disclosed to criminal police or judicial authorities upon request. The images collected are kept for a maximum period of 30 days from the moment they are captured (unless other applicable legislation determines a longer period). The images are processed exclusively for security and protection purposes, in accordance with the legislation of the Sultanate of Oman.

Recording of telephone calls

As a result of your telephone contact and within the scope of ECOVISION's activity, we may record calls, subject to prior notification and based on your consent, for the management of the pre-contractual and contractual relationship, as well as to improve our services and control their quality. Call recordings will only be kept for the period necessary to fulfil the above purposes, in accordance with the applicable legislation in the Sultanate of Oman.

How long do we keep your personal data?

The personal data collected and processed is kept, in accordance with its purpose, in compliance with the applicable legal deadlines.

In cases where no legal time limit applies to the retention and storage of personal data, such data will only be stored and retained for the appropriate period and to the extent necessary, taking into account the purposes for which it was collected, unless, at any time, the data subject, within the legal limits, exercises their rights to erasure or withdraws their consent.

Once the maximum retention period has been reached, personal data will be irreversibly anonymised (anonymised data may be retained) or securely destroyed.

For marketing and contact purposes, your personal data will be retained from the moment your consent is obtained and if, within this period, you have not withdrawn your consent.

What are the rights of personal data subjects?

Under the applicable legislation in the Sultanate of Oman, you may exercise the following rights:

• Right of Access: obtain confirmation as to whether or not your personal data is being processed and, if so, access it. In this case, SUMA reserves the right to charge a reasonable fee, taking into account administrative costs.
• Right of Rectification: to obtain the rectification of inaccurate personal data concerning you and to request that your incomplete personal data be completed or updated.
• Right to Erasure: to request the erasure of your personal data, except in cases where there are legal grounds for retaining it.
• Right to Transfer and Copy: receive the personal data you have provided to us in a structured, machine-readable format, as well as request the transmission of your personal data to another data controller.
• Right to Withdraw Consent: whenever the processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of the processing carried out up to that date.
• Right to be informed of data breaches: you will be informed if there is a breach of your personal data that may affect your rights, in accordance with applicable legislation.

To exercise your rights, you should contact us using the contact details provided in the section ‘Contact details of the Data Controller’.

The data subject also has the right to lodge a complaint with the competent authority in the Sultanate of Oman, the Ministry of Transport, Communications and Information Technology (MTCIT), if they consider that their personal data has not been lawfully processed by SUMA.

Contact details of the Data Controller

To contact SUMA regarding the processing of your personal data or to exercise your rights, please use the following address: privacy@suma.pt.

What security measures are in place?

SUMA and the other companies that make up the SUMA GROUP, including ECOVISION, are committed to implementing appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, accidental loss, alteration, dissemination or unauthorised access. An adequate level of security is considered to be applied in relation to the risks that the processing presents, given the nature of the data to be protected.

To this end, SUMA carries out all its activities using systems that aim to ensure the security of your personal data, through the creation of procedures that prevent unauthorised access, accidental loss and/or destruction of your personal data, committing itself to respect and comply with the legislation on the protection of personal data.

Why do we share your personal data?

SUMA may share your personal data with third parties, who will have access to it. Such third parties include public authorities, partners, service providers, among others. In the course of its business, SUMA may use subcontractors, who will access and process your personal data in accordance with our instructions.

To this end, we ensure that such subcontractors offer sufficient guarantees of the implementation of appropriate technical and organisational measures, so that the processing meets the requirements of the applicable legislation in the Sultanate of Oman and ensures the protection of the rights of personal data subjects.

SUMA may also share your personal data when such sharing is necessary or appropriate in light of applicable legislation, to comply with legal obligations to which it is subject, to respond to requests from public authorities, in the event that the vital interests of the personal data subject or a third party are at stake, for the protection of SUMA's rights and property, or when you have given us your prior consent.

Under what circumstances do we transfer your personal data to third countries?

The activity conducted by SUMA may involve the transfer of your personal data to countries outside the Sultanate of Oman, whenever this is necessary within the scope of the services used by SUMA.

In such situations, all appropriate measures will be taken to ensure the protection of your personal data in accordance with the applicable legislation in the Sultanate of Oman, including verification that the destination country or recipient entity offers an adequate level of protection or that adequate safeguards are in place for the transfer.

One such situation may arise in the context of SUMA's presence on social networks, where SUMA has limited influence over the data processing carried out by the respective operators (e.g. member management or general information management). In situations where we have no influence, we seek to ensure, as far as possible, that these operators act in accordance with the privacy and data protection requirements set out in the applicable legislation. However, in many cases, we have no control over the data processing carried out by these operators, nor do we have full knowledge of the processing operations they carry out.

Social media operators manage their own infrastructure, apply their own privacy and data protection policies, and maintain a direct relationship with their users. They are therefore responsible for processing data associated with user profiles, to which SUMA has no access.

For more information on the processing of data carried out by social network operators, data subjects may consult the respective privacy policies available on the official websites of each platform.

How do we use cookies?

For more information about cookies and how ECOVISION uses them on its website, please see our Cookie Notice.

Changes to the Privacy Notice

All updates to the Privacy Notice will be communicated via a notice on the website's home page: https://ecovision.om/ , so that such changes can be immediately understood. Continued use of this website after the publication of the changes means that the user has taken note of them, without prejudice to the fact that, whenever legally required, it may be necessary to obtain your specific consent for certain processing of personal data.