Privacy Policy - Whistleblowing Channel

This Privacy Policy describes how personal data will be processed when you submit a report to Nhclima regarding violations (or attempted violations) of European Union law that are detrimental to the public interest.
This policy was updated on February 12, 2025.
This Privacy Policy may be updated from time to time.
The most recent version will always be available on this platform.

1. Data Controller

Nhclima – Ventilação e Climatização, Lda. (Nhclima) is the data controller for personal data pursuant to Regulation (EU) 2016/679 (GDPR) and supplementary legislation on personal data protection in effect in the countries where it operates. You may contact us with general inquiries using the following contact information:
Address: Nhclima – Ventilação e Climatização, Lda. Rua do Outeiro 160, 4770-452 Requião
Email: info@nhclima.com
To learn how Nhclima processes your personal data, please consult the Privacy Policy available on the Nhclima website.

2. Person Responsible for the Reporting Channel

Reports should preferably be submitted through this platform. Nhclima has appointed a person responsible for receiving and following up on reports. The identity of the reporter, as well as any information that directly or indirectly reveals their identity, is confidential and accessible only to the person responsible for receiving and following up on reports. This obligation of confidentiality extends to anyone who has received information regarding reports, even if they are not responsible for or authorized to receive and handle them.

3. Personal Data We Process

For the purposes of the GDPR and this Privacy Policy, “personal data” means information relating to an identified or identifiable natural person (“data subject”); a natural person is considered identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, online identifiers, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
Your personal data will be processed if you do not wish to remain anonymous and choose to identify yourself as the complainant, as well as the personal data related to the accused or other third parties mentioned in the complaint.
Only personal data relevant to the handling of the report will be processed; all other data will be deleted.

4. Purposes of Processing

The personal data collected through Nhclima’s reporting channel will be processed for the following purposes:

• To identify the whistleblower, if they choose to do so (name, email address, and other personal data resulting from the whistleblower’s interactions with the person responsible for handling the report), in the context of reporting violations (or attempted violations) of European Union law that are harmful to the public interest;
• To communicate with the whistleblower;
• To take the appropriate internal actions to verify the allegations contained in the report and, where applicable, to put an end to the reported violation, including by opening an internal investigation or notifying the competent authority to investigate the violation;
• Identify the parties against whom the complaint is filed;
• Identify other third parties mentioned in the report.

5. Legal Basis for Processing

Personal data will be processed on the legal basis of compliance with a legal obligation to which Nhclima is subject, namely under Law No. 93/2021 of December 20, which requires the establishment of a reporting channel; as well as the legitimate interest of the Data Controller in preventing and/or addressing irregularities covered by Law No. 93/2021 of December 20.

6. Recipients of Personal Data

The identity of the whistleblower, as well as any information that directly or indirectly allows for the deduction of their identity, is confidential and accessible only to the person designated by Nhclima to receive and follow up on reports.
This obligation of confidentiality extends to anyone who has received information regarding reports, even if they are not responsible for or authorized to receive and process such reports.
The personal data processed may need to be disclosed to the competent authority investigating the violation.

7. Security of Personal Data

We will handle your personal information with the utmost care and respect for your rights.
We have implemented appropriate security measures to prevent the loss, unauthorized use or access, alteration, or disclosure of your personal data. Likewise, we limit access to your information solely to employees, service providers, and other third parties who have a legitimate need to process such information; they will only process your personal data in accordance with Nhclima’s instructions and will be subject, at all times, to a duty of confidentiality. All security measures deemed appropriate for this platform have been implemented. The platform developer does not have access to any data submitted to it.

8. Retention of Personal Data

Personal data that is clearly irrelevant to the handling of the complaint is not retained and is immediately deleted. We will maintain a record of the complaints received, which will be retained by Nhclima for at least five years and, regardless of this legal period, for as long as any judicial or administrative proceedings related to the complaint remain pending.

9. How to Exercise Your Rights

As a data subject, you have the right to request:

• Access to your information processed by us, that is, confirmation as to whether or not any data concerning you is being processed by us and, if so, to request access to your personal data and information such as the purposes of the processing or the recipients to whom your personal data has been or will be disclosed, among other details;
• Rectification of your personal data when it is inaccurate, out of date, or incomplete;
• When we process your data based on your consent, the right to withdraw that consent at any time, without this affecting the lawfulness of the processing carried out up to that point;
• The erasure of the data we hold about you under specific circumstances, namely when you withdraw your consent and we have no overriding legitimate interest, or when the purpose for which the information was collected no longer applies;
• The portability of your data to you or to another organization; that is, under certain circumstances, you may have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format;
• Restriction of the processing of your personal data under specific circumstances, namely when we are considering an objection you have raised;
• To object to the processing of your personal data when it is carried out based on the legitimate interests of Nhclima or a third party. The data subject has the right to object at any time, for reasons related to their particular situation, to the processing of their personal data. The data controller shall cease processing the personal data unless it can demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims.
• To exercise any of the above rights, please contact our Data Protection Officer (DPO) at dpo@nhclima.com.

10. How to Contact the Regulatory Authority

If you are dissatisfied with our use of your personal data or with our response to your request to exercise your rights, you may file a complaint with the National Data Protection Commission (CNPD) using the methods provided at www.cnpd.pt.

11. Questions?

If you have any questions or need further clarification, please contact our Data Protection Officer at dpo@nhclima.com.