Privacy Notice
(SUPPLIERS AND SERVICE PROVIDERS)
Data Controller
- Controller: REGAENERGY GROUP, S.A. (“REGAENERGY”)
- Head Office: Avenida Engenheiro Duarte Pacheco, Nº26, piso 12, 1070-111 Lisboa
- VAT number: 516438999
- Contact: rgpd@regaenergy.com
Purpose, legal basis and storage periods of personal data
The Supplier/Services Provider’s data (when the latter is an individual or, if it is a legal entity, the personal data of its legal representatives and employees) is processed for the following purposes and on the following legal grounds and retention periods:
| Purpose of the processing | Basis for processing | Storage period |
| Management of the contractual relationship between REGAENERGY and its suppliers and service providers; performance of the contract. | REGAENERGY’s legitimate interest in executing contractual relationships and prospective business relationships with suppliers and services providers. | Until the purpose for which the data was collected ceases to exist. |
If the Supplier/Service Provider is legal entity, it shall guarantee that it is authorized to transmit the data of its legal representatives and employees to REGAENERGY, which will treat such data confidentially, exclusively for the purposes and on the grounds mentioned above.
Recipients of personal data and transfers
The Supplier/Service Provider’s personal data may be provided to the service providers of REGANERGY who process personal data (“processors“), including REGAENERGY’s subsidiaries (i.e., commercial companies owned by REGAENERGY, directly or indirectly). Any service provider will process the personal data of the data subjects, in the name and on behalf of the Controller, under the strict obligation to follow REGAENERGY’s instructions and the processing purposes indicated above. REGAENERGY shall ensure that such processors provide sufficient guarantees for the implementation of appropriate technical and organizational measures in such a way that the processing meets the requirements of the applicable legislation and ensures the security and protection of the rights of data subjects, in accordance with the outsourcing agreement concluded with those processors.
The Supplier/Service Provider’s personal data may also be provided to service providers who process personal data but who act as controllers, such as statutory auditors or law firms.
In certain situations, the personal data of data subjects may also be transmitted to third parties, including competent authorities and regulatory bodies, when such data communications are necessary or appropriate (i) in light of the applicable law, (ii) for compliance with legal, regulatory obligations and/or judicial or administrative orders, (iii) by determination of the National Data Protection Commission or other competent supervisory authority, or (iv) to respond to requests from public or government authorities, such as tax authorities, courts, and regulatory bodies.
The Supplier/Service Provider’s personal data may also be transferred outside the E.U./EEA, in which case the controller will inform the Supplier/Service Provider of this. The transfers in question will be carried out in strict compliance with the applicable legislation on data processing and Chapter V of the GDPR, being transferred under an Adequacy Decision of the European Commission, where applicable, or through the adoption of the European Union Standard Contractual Clauses for international data transfers.
More information on EU standard contractual clauses can be found here: https://eur-lex.europa.eu/legal-content/PT/TXT/HTML/?uri=CELEX%3A32021D0914
More information on the countries covered by adequacy decisions can be found here: https://www.edpb.europa.eu/sme-data-protection-guide/international-data-transfers_pt.
Data subject rights
Under the law, the data subject may at any time exercise their rights in relation to personal data concerning them (in some cases, and depending on the terms of the contract in force, these rights may be exercised through the Supplier or Services Provider in which the data subject is integrated):
- Access: the data subject has the right to access his or her personal data.
- Rectification: the data subject has the right to obtain the rectification of inaccurate personal data concerning him/her, as well as the right to have his/her personal data completed.
- Erasure: the data subject has the right to request the erasure of their data in certain cases, namely, but not limited to, personal data that are no longer necessary for the purpose for which it was collected or processed, in which the data subject withdraws consent on which the data processing is based, among others.
- Portability: in certain cases, the data subject may request the personal data concerning him or her that he or she provided to REGAENERGY, in a structured, commonly used and machine-readable format and the right to transmit such data to another controller.
- Restriction of Processing: the data subject has the right to request the restriction of the processing of his or her data in certain cases, including when the processing is unlawful and the data subject opposes to the erasure of his/her data (and requests the restriction of their use instead) and when REGAENERGY no longer needs the personal data for the purposes of processing, but these are required by the Candidate for the purposes of declaration, exercise, or defense of a right in a judicial proceeding, among others;
- Objection: the data subject may object to the processing of his or her data, for reasons relating to his or her particular situation, and in cases where the data is processed (i) for the purposes of the legitimate interests pursued by us or by a third party, or is processed for purposes other than those for which the data was collected and is not carried out with the consent of the data subject or on the basis of provisions of law of the European Union or Member States, or (ii) the personal data is processed for the purposes of direct marketing, or (iii) the personal data is processed for the purposes of scientific or historical research or for statistical purposes.
The data subject also has the right to lodge a complaint with the National Data Protection Commission (www.cnpd.pt). In any case, if the data subject has any questions or wishes to exercise any rights in relation to his/her personal data, the Candidate shall address a request to the controller at the following address: rgpd@regaenergy.com
Version
13.08.2025
