PRIVACY POLICY
GTC – Sistemas Digitais de Vídeo, Lda. ("GTC," "we") respects users' privacy and is committed to protecting personal data in a transparent manner and in accordance with the General Data Protection Regulation (GDPR), applicable national legislation, and the guidelines of the Portuguese Data Protection Authority (CNPD).
1. Data Controller
The data controller is GTC – Sistemas Digitais de Vídeo, Lda., headquartered at [full address], registered under NIPC [tax number].
You can contact us through the following means:
-
General email: geral@gtc.pt
- Telephone: +351 214 158 120
If a Data Protection Officer (DPO) is appointed, their contact details will be disclosed in this policy and on the website.
2. Purpose of this Policy
This Privacy Policy aims to clearly and accessibly explain:
-
What types of personal data we may collect when you use our website and services;
-
Under what circumstances and for what purposes we process them;
-
The legal grounds that justify the processing;
-
How long we retain the data;
-
With whom we may share them;
-
The rights available to data subjects;
-
How we ensure information security.
It applies to all users of the gtc.pt website, subdomains, contact forms, landing pages, electronic communications (such as newsletters), and interactions related to events or campaigns promoted by GTC.
3. Personal Data Processed
During interactions with GTC, we may collect and process personal data generally falling into the following categories:
-
Identification and contact details: such as name, surname, email, phone number, company, and job title;
-
Website usage data: such as IP address, cookies, browsing logs, date and time of access;
-
Communication-related data: subscription preferences, interactions with newsletters or campaigns;
-
Data provided through events, meetings, or forms: information voluntarily shared by the user.
We do not request or intend to process special categories of personal data (e.g., health, religion, political opinion). If such data is inadvertently provided, it will be deleted.
4. Legal Grounds for Processing
GTC ensures that personal data is only processed when there is an appropriate legal basis, namely:
-
Performance of a contract or pre-contractual steps: when processing is necessary to provide information, quotations, proposals, or manage contractual relationships;
-
Compliance with legal obligations: when required by law, e.g., for accounting purposes;
-
Legitimate interest: when necessary to ensure the secure functioning of the website, prevent fraud, improve services, or communicate with existing customers, provided that such interests are balanced with the rights and freedoms of the data subject;
-
Consent: when the user gives explicit authorization, such as subscribing to newsletters or receiving marketing communications. Consent can be withdrawn at any time.
5. Purposes of Processing
Personal data is processed for specific, explicit, and legitimate purposes, including:
-
Website management: ensuring technical operation, personalizing user experience, and monitoring performance;
-
Handling requests: responding to inquiries, providing product and service information, and processing support requests;
-
Institutional and marketing communications: sending newsletters, event invitations, product updates, and other relevant information, only with prior consent or in compliance with an existing contractual relationship;
-
Event management: registrations, scheduling meetings, and follow-up of initiatives in which the user participates;
-
Legal compliance: accounting, taxation, and responding to competent authorities.
6. Data Retention
GTC retains personal data only for as long as strictly necessary to fulfill the purposes of processing or for the periods required by law. In general:
-
Contact and commercial interaction data are retained while an active relationship exists and up to [24 months] after the last meaningful contact;
-
Marketing data are retained until consent is withdrawn or for a maximum period defined in internal retention policies;
-
Data linked to legal obligations, such as accounting records, are kept for the legally required periods;
-
Security logs are stored for the period needed to detect and respond to incidents.
After these periods, data will be securely deleted or anonymized.
7. Data Sharing
GTC does not sell or commercially exploit personal data. However, data may be shared in the following cases:
-
Public authorities: when required for legal compliance;
-
Service providers: acting as processors and only processing data on behalf of and under GTC’s instructions, with adequate contractual safeguards;
-
Partners: when necessary to perform requested services or with the data subject’s consent.
In all cases, appropriate security and confidentiality measures are ensured.
8. International Transfers
When processing involves transfers outside the European Economic Area, GTC ensures the application of recognized safeguards such as the European Commission’s Standard Contractual Clauses, along with additional technical and organizational measures to protect privacy.
9. Security
GTC adopts internal policies and appropriate technical measures, including:
-
Access control and restricted authentication;
-
Encryption of data in transit and at rest, where applicable;
-
Access logs and monitoring;
-
Regular backups and recovery plans;
-
Internal training on data protection and confidentiality.
Although we take these measures, we acknowledge that no system is completely invulnerable. We maintain incident response plans and notify authorities and data subjects when legally required.
10. Data Subject Rights
In accordance with applicable law, users may exercise the following rights:
-
Right of access: obtain confirmation of processing and access to personal data;
-
Right to rectification: correct inaccurate or outdated data;
-
Right to erasure: request deletion of data, where applicable;
-
Right to restriction: temporarily restrict processing in certain circumstances;
-
Right to portability: receive provided data in a structured, interoperable format;
-
Right to object: object to processing based on legitimate interest, including direct marketing;
-
Right to withdraw consent: whenever processing is based on consent.
Requests must be made in writing to info@gtc.pt, and GTC may require proof of identity. Responses will be provided within 1 month, extendable in complex cases.
11. Complaints
Data subjects also have the right to lodge a complaint with the competent supervisory authority. In Portugal, the authority is:
Comissão Nacional de Proteção de Dados (CNPD)
Av. D. Carlos I, 134, 1st floor, 1200‑651 Lisbon
Telephone: (+351) 213 928 400
Email: geral@cnpd.pt
Website: www.cnpd.pt
12. Minors
The GTC website and services are not intended for minors. Data processing based on consent is only valid for individuals over the age of 13. If data from minors are collected without valid consent from legal guardians, such data will be deleted.
13. Links to Third Parties
The GTC website may contain links to external websites that have their own privacy policies. GTC is not responsible for the privacy practices of third parties and recommends reading their policies.
14. Updates
GTC may update this Privacy Policy periodically as a result of legal, regulatory, or organizational changes. The current version will always be available on gtc.pt, indicating the date of the last update. We recommend reviewing this document regularly.
15. Contacts
For any questions, to exercise your rights, or to obtain further information about our privacy policy, please contact us at:
Email: geral@gtc.pt
Telephone: +351 214 158 120
Address: