Privacy Notice
(CLIENTS)
Data Controller
- Controller: REGAENERGY GROUP, S.A. (“REGAENERGY”)
- Head Office: Avenida Engenheiro Duarte Pacheco, Nº26, piso 12, 1070-111 Lisboa
- VAT number: 516438999
- Contact: rgpd@regaenergy.com
Purpose, legal basis and storage periods of personal data
The Client’s data (when the latter is an individual or, if it is a legal entity, the personal data of its legal representatives and employees) is processed for the following purposes and on the following legal grounds and retention periods:
| Purpose of the processing | Basis for processing | Storage period |
| Payment processing and billing for REGAENERGY services | Legitimate interest in processing payments and invoicing.
Performance of a contract to which the data subject is party, in the case of a client who is an individual (“contractual performance”). Compliance with a legal obligation. |
Personal data with tax relevance: 10 years.
All other personal data: Until the purpose for which the data was collected ceases to exist or up to 1 (one) year after the end of the contractual relationship. |
| Provision and performance of services by REGAENERGY. | REGAENERGY’s legitimate interest in performing contracts entered with clients.
Contractual performance in the case of clients who are individuals. Compliance with a legal obligation. |
Up to 1 (one) year after the end of the contractual relationship. |
| Responding to contacts and contact requests, whether by phone or through the website. | REGAENERGY’s legitimate interest in responding to requests from potential clients.
Also, contractual performance in the case of clients who are individuals. |
Until the purpose for which the data was collected ceases to exist. |
| Commercial prospecting, specifically market research, telephone and email contacts, and meetings to present REGAENERGY.
In this specific case, REGAENERGY will collect personal data such as email address and name. |
REGAENERGY’s legitimate interest in contacting companies to present its services.
These contacts will only be made to professional addresses following the provision of contact details or any interaction with REGAENERGY or through information collected on the Internet. |
Until the purpose for which the data was collected ceases to exist. |
| Analysis and response to complaints made by clients. | REGA ENERGY’s legitimate interest in responding to client complaints.
Compliance with a legal obligation. |
Until the purpose for which the personal data was collected ceases to exist. In the case of complaints submitted in the Complaints Book, 3 (three) years. |
Client data processed based on contract performance is essential for entering into a contract with REGAENERGY. If the Client does not provide their data, it will not be possible to enter a contract with REGANERGY.
If the Client is a legal entity, it shall guarantee that it is authorized to transmit the data of its legal representatives and employees to REGAENERGY, which will treat such data confidentially, exclusively for the purposes and on the grounds mentioned above.
Recipients of personal data and transfers.
The Client’s personal data may be provided to the service providers of REGANERGY who process personal data (“processors“), including REGAENERGY’s subsidiaries (i.e., commercial companies owned by REGAENERGY, directly or indirectly). Any service provider will process the personal data of the data subjects, in the name and on behalf of the Controller, under the strict obligation to follow REGAENERGY’s instructions and the processing purposes indicated above. REGAENERGY shall ensure that such processors provide sufficient guarantees for the implementation of appropriate technical and organizational measures in such a way that the processing meets the requirements of the applicable legislation and ensures the security and protection of the rights of data subjects, in accordance with the outsourcing agreement concluded with those processors.
The Client’s personal data may also be provided to service providers who process personal data but who act as controllers, such as statutory auditors or law firms.
In certain situations, the personal data of data subjects may also be transmitted to third parties, including competent authorities and regulatory bodies, when such data communications are necessary or appropriate (i) in light of the applicable law, (ii) for compliance with legal, regulatory obligations and/or judicial or administrative orders, (iii) by determination of the National Data Protection Commission or other competent supervisory authority, or (iv) to respond to requests from public or government authorities, such as tax authorities, courts, and regulatory bodies.
The Client’s personal data may also be transferred outside the E.U./EEA, in which case the controller will inform the Supplier/Service Provider of this. The transfers in question will be carried out in strict compliance with the applicable legislation on data processing and Chapter V of the GDPR, being transferred under an Adequacy Decision of the European Commission, where applicable, or through the adoption of the European Union Standard Contractual Clauses for international data transfers.
More information on EU standard contractual clauses can be found here: https://eur-lex.europa.eu/legal-content/PT/TXT/HTML/?uri=CELEX%3A32021D0914
More information on the countries covered by adequacy decisions can be found here: https://www.edpb.europa.eu/sme-data-protection-guide/international-data-transfers_pt.
Data subject rights
Under the law, the data subject may at any time exercise their rights in relation to personal data concerning them (in some cases, and depending on the terms of the contract in force, these rights may be exercised through the Supplier or Services Provider in which the data subject is integrated):
- Access: the data subject has the right to access his or her personal data.
- Rectification: the data subject has the right to obtain the rectification of inaccurate personal data concerning him/her, as well as the right to have his/her personal data completed.
- Erasure: the data subject has the right to request the erasure of their data in certain cases, namely, but not limited to, personal data that are no longer necessary for the purpose for which it was collected or processed, in which the data subject withdraws consent on which the data processing is based, among others.
- Portability: in certain cases, the data subject may request the personal data concerning him or her that he or she provided to REGAENERGY, in a structured, commonly used and machine-readable format and the right to transmit such data to another controller.
- Restriction of Processing: the data subject has the right to request the restriction of the processing of his or her data in certain cases, including when the processing is unlawful and the data subject opposes to the erasure of his/her data (and requests the restriction of their use instead) and when REGAENERGY no longer needs the personal data for the purposes of processing, but these are required by the Candidate for the purposes of declaration, exercise, or defense of a right in a judicial proceeding, among others;
- Objection: the data subject may object to the processing of his or her data, for reasons relating to his or her particular situation, and in cases where the data is processed (i) for the purposes of the legitimate interests pursued by us or by a third party, or is processed for purposes other than those for which the data was collected and is not carried out with the consent of the data subject or on the basis of provisions of law of the European Union or Member States, or (ii) the personal data is processed for the purposes of direct marketing, or (iii) the personal data is processed for the purposes of scientific or historical research or for statistical purposes.
The data subject also has the right to lodge a complaint with the National Data Protection Commission (www.cnpd.pt). In any case, if the data subject has any questions or wishes to exercise any rights in relation to his/her personal data, the Candidate shall address a request to the controller at the following address: rgpd@regaenergy.com
Version
13.08.2025
