Privacy Policy

COMMITMENT

We are committed to providing our clients with a privacy policy that offers an overview of how their data is processed and their rights in this matter, in accordance with Regulation 2016/679 of the European Parliament and Council – General Data Protection Regulation (GDPR) – and other applicable privacy and data protection laws, including local legislation complementing the GDPR.

DATA CONTROLLER

The entity responsible for processing personal data is MICROSKILLS – INNOVATION AND TECHNOLOGY, LDA.a company incorporated under Portuguese law, with headquarters at Rua Eng.º Adelino Amaro da Costa, n.º 177, Junqueiros, 2425-333 Carvide, Monte Real e Carvide parish, Leiria district, with a share capital of €5,000.00 (five thousand euros) (hereinafter referred to as “NYMALIS”).NYMALIS”).

NYMALIS may also be involved in certain processing activities as a joint controller or subcontractor, and this will be communicated to the data subject before processing.

DATA PROTECTION OFFICER (DPO)

NYMALIS appoints a Data Protection Officer (DPO).

Qualquer esclarecimento relativo a políticas ou práticas relativas à privacidade e tratamento da informação poderá ser solicitado ao DPO designado através do envio de correio electrónico (aoliveira@nymalis.pt) ou para a sede da NYMALIS, ao cuidado do DPO.

The DPO can also be contacted to unsubscribe from services, revoke consent, or submit complaints regarding legal violations or this privacy policy.

PROCESSING OF PERSONAL DATA

The data provided within the relationship established between clients, their employees, and NYMALIS is processed in compliance with the following principles:

  • Lawfulness, fairness, and transparency;
  • Specific, explicit, and legitimate purposes;
  • Adequate, relevant, and limited to what is necessary, considering the purposes for which the data is processed;
  • Accurate and, if necessary, updated (appropriate measures are taken to ensure that inaccurate data is erased or corrected considering the purposes for which they were collected);
  • Retained only for the necessary period and in accordance with legal requirements;

tratados de uma forma que garanta a sua segurança, incluindo a proteção contra o seu tratamento não autorizado ou ilícito e contra a sua perda, destruição ou danificação acidental, adotando as medidas técnicas ou organizativas adequadas.

PURPOSE, BASIS, AND RETENTION

PURPOSE

NYMALIS processes personal data to provide services under benefits programs.

LEGAL BASIS

Presentation, proposal, conclusion, and execution of contracts, pre-contractual diligence, and management support, with intervention by:

  • Legitimate interest of the controller or third parties in identifying, assessing risks, informing, clarifying, and advising on solutions and products;
  • Consent of the Data Subject;
  • Compliance with legal and regulatory obligations.

RETENTION

Until the legal limitation period for all obligations arising from contracts with clients expires.

For prospecting, commercial actions, proposal preparation, newsletter dispatch, promotional material, and event invitations:

  • Consent of the Data Subject;
  • Legitimate interests in the development and growth of the controller's business activity.
  • While consent remains valid;
  • During a commercial relationship with the data subject and up to six months after its termination.

For compliance with legal obligations (supervisory, tax, fiscal, or judicial authorities):

  • Legitimate interests in monitoring activities by the controller or third parties;
  • Compliance with legal and regulatory obligations;
  • For the assertion, declaration, or defense of rights in legal proceedings;
  • Until the expiration of the limitation or expiration period for exercising rights;
  • Applicable legal period (specific to each legal and regulatory obligation to be fulfilled).
  • All data is received and stored for the minimum legally established period of 10 years, unless a longer period is justified for the assertion, exercise, or defense of rights in legal proceedings.
  • In compliance with obligations related to anti-money laundering and counter-terrorism financing, data will be retained for a period of 7 years.

DATA COMMUNICATION

Personal data may be processed by other entities, such as subcontractors or joint controllers, to whom NYMALIS may subcontract its processing.

NYMALIS employees and all parties involved in the respective contract who require such data to fulfill pre-contractual diligence or contractual/legal obligations for insurance mediation activities will have access to personal data.

The disclosure of personal information to NYMALIS's business partners always assumes that these entities comply with data protection laws, even when they process personal data separately. Upon request, NYMALIS provides access to the privacy policies of these partners.

Personal data may also be processed by other insurance companies for the purpose of settling claims in which they are involved.

RIGHTS OF DATA SUBJECTS

The Data Subject has the right to request from NYMALIS, through a written request addressed to the DPO: 

  • Access, under the legally established terms and conditions, to their Personal Data being processed;
  • Correction or updating of inaccurate or outdated Personal Data concerning them;
  • Completion of missing Personal Data when the existing data is incomplete;
  • Deletion, in cases specifically provided for by law, of Personal Data concerning them;
  • Restriction, under the conditions provided by law, of the processing of their Personal Data;
  • Data portability, requesting personal information whenever the processing is based on consent or contract performance;              
    Objection to the processing of personal information, when, with valid justification, they demonstrate the applicable legal basis and a legitimate interest.

Through a written request addressed to the DPO, the Data Subject is also entitled to: 

  • Withdraw their consent, although the withdrawal of consent does not affect the lawfulness of processing based on consent previously provided;
  • Object to processing based on reasons related to their particular situation, when the data processing is based on the legitimate interest of the controller or third parties;
  • Receive from the controller, in a commonly used and machine-readable digital format, the personal data concerning them that was provided by them and processed by automated means based on:
    • Consent provided by the Data Subject, or
    • A contract concluded, and may request, in writing, the direct transmission of such data to another controller whenever technically feasible.

The Data Subject may also request detailed information from the DPO (purpose/legal basis/retention periods) and submit complaints about how their personal data is processed. This is without prejudice to their right to lodge complaints directly with the competent authority (National Data Protection Commission).

DATA COLLECTION

For the purposes of managing the pre-contractual and contractual relationship and fulfilling the duties of information, clarification, transmission, advice, assistance, and registration required by applicable legislation, NYMALIS may collect information about the Data Subject that it considers relevant for assessing risks and determining contractual conditions with insurers. This information may be collected from publicly accessible sources, public agencies, industry associations, existing digital platforms, or specialized companies, to supplement or confirm the information provided by the Data Subject.

The collection of data by NYMALIS is strictly necessary and includes name, email address, residential address, phone and mobile numbers, as well as relevant information such as profession, language, postal code, and location.

LEGAL AND CONTRACTUAL OBLIGATIONS OF THE DATA SUBJECT

The Data Subject, whether a client of NYMALIS or an employee of a client, is legally or contractually required to provide certain personal data necessary for fulfilling pre-contractual and contractual obligations, as well as for meeting legal requirements imposed on NYMALIS.

The Data Subject is obligated to keep NYMALIS informed of any changes to their personal data, particularly under the terms and conditions specified in applicable policies.

TRANSFER OF PERSONAL DATA TO OTHER COUNTRIES OR INTERNATIONAL ORGANIZATIONS

The transfer of personal data to countries outside the European Union occurs only when necessary for executing orders or requests from the Data Subject, by legal requirement, or if explicit authorization has been granted.

If third-country service providers are required, they will be obligated to comply with written instructions in this regard by signing an agreement with the EU’s standard contractual clauses and certification models to ensure compliance with the data protection standards applicable within the EU.

The Data Subject will always be informed in advance about any potential data transfer under the conditions described above.

SECURITY OF PERSONAL DATA

NYMALIS employs the best available means to protect users' personal data against unauthorized access, disclosure, alteration, or destruction. To ensure data security and maximum confidentiality, NYMALIS:

 Handles information with absolute confidentiality, following internal security and confidentiality policies and procedures, updated periodically as necessary and in compliance with legally established terms and conditions. Considering the nature, scope, context, and purposes of data processing, as well as the risks posed to the User’s rights and freedoms, NYMALIS commits to applying the necessary and appropriate technical and organizational measures at both the definition and processing stages to protect User data and comply with legal requirements.

PROFILING

In principle, we do not process data automatically for the purpose of creating commercial profiles; however, profiling may be required in connection with contracted or prospective services. 

We may use profiling to provide advice and recommendations about products and services, using assessment tools. In such cases, the Data Subject will be informed in advance. This enables communication and advertising targeted to individual preferences. NYMALIS applies all appropriate measures to safeguard the rights and freedoms of the Data Subject in this context. In cases where client profiling is conducted exclusively for commercial purposes, the Data Subject may object to this profiling by contacting the Data Protection Officer via the above-mentioned contact details.

COOKIES

Please refer to Cookies Policy NYMALIS’s Cookies Policy.

CHANGES TO THE PRIVACY POLICY

NYMALIS reserves the right to amend this privacy policy at any time without prior notice. Regular consultation of our Privacy Policy is therefore recommended.