1. Applicable Legislation

The processing of personal data carried out by RCG is in strict compliance with current national and community legislation, namely Regulation (EU) 2016/679 of the European Parliament and Council, of April 27, 2016 (General Data Protection Regulation - GDPR), and Law No. 58/2019, of August 8, which ensures the implementation of the GDPR in the Portuguese legal order, as well as the guidelines issued by European and national control authorities.

2. Scope and Updates

This policy applies to all personal data processing activities carried out by RCG.

RCG reserves the right to periodically update this Privacy Policy. Whenever it does so, the update date will be reflected at the end of the document. Substantial changes will be communicated to data subjects (who have subscribed to receive communications) through usual channels, namely by email.

3. Principles of Personal Data Processing

The processing of personal data by RCG is guided by the general principles set out in the GDPR:

• Lawfulness, fairness and transparency: We process data lawfully, fairly and transparently in relation to the data subject.
• Purpose limitation: We collect data for determined, explicit and legitimate purposes, not subsequently processing them incompatibly with the same.
• Data minimization: We only process data that is adequate, relevant and strictly necessary for the purposes in question.
• Accuracy: We adopt measures to ensure that inaccurate data is deleted or rectified without delay.
• Storage limitation: We keep data only for the period necessary for the purposes for which they are processed.
• Integrity and confidentiality: We guarantee the security of personal data, protecting them against unauthorized or unlawful processing, loss, destruction or accidental damage, through appropriate technical and organizational measures.

4. What Personal Data We Process

In the context of the activities developed by RCG, Data Subjects include, without limitation: clients and former clients, potential clients, partners, job candidates, collaborators, suppliers, complainants and visitors to our facilities or platforms.

Proteção de Menores: Protection of Minors: RCG does not request or voluntarily collect personal data from minors under 18 years of age. If RCG verifies that it has inadvertently collected data from a minor, it will proceed with its immediate elimination. The collection of data from minors only occurs lawfully when provided by parents or legal representatives, with express consent (e.g., for the provision of health services to the minor), or through CCTV systems for the security of people and property.

We emphasize that you are not obliged to share your personal data. However, refusal to provide essential data may prevent RCG from providing contracted services, supplying products or responding to requests.

Categories of personal data processed:

• Identification data: Name, civil identification number, date of birth.
• Tax data: Tax Identification Number (NIF).
• Contact data: Address, email address, telephone/mobile number.
• Payment data: IBAN, billing data.
• Health data: Clinical history, special needs or dietary references (only those strictly necessary for the provision of contracted health services).
• History and transactional data: History of service provision, complaint resolution and transactional history.
• Access data: Verification and recovery credentials on the Website.
• Subscription data: Preferences for receiving communications and newsletters.

5. Purposes and Lawfulness Bases

RCG only processes personal data when there is a lawfulness basis that legitimizes this processing (Consent, Contract Execution, Compliance with Legal Obligation or Legitimate Interest).

6. Retention Periods

RCG keeps personal data only for the period strictly necessary for the execution of the specific purposes for which they were collected, or for compliance with prescription periods and legal obligations.

7. Sharing of Personal Data

Personal data may be shared with third parties in strictly necessary situations:

• Subcontractors: Service provider companies to RCG (e.g., software suppliers, accounting, information system management). These entities are bound by rigorous written contracts (Data Processing Agreements), only being able to process data for the established purposes and guaranteeing appropriate technical measures.
• RCG Group: Internal sharing with other group companies, complying with applicable data protection rules.
• Official Entities: In compliance with legal obligations, data may be transmitted to judicial, tax (AT), administrative or regulatory authorities.

8. International Transfers (Outside EEE)

In the scope of its activities, RCG may use partners or service providers whose servers are located outside the European Economic Area (EEA), such as in Portuguese-speaking countries.

RCG guarantees that any transfer of data outside the EEA is carried out with maximum rigor, applying:

• Adequacy decisions adopted by the European Commission for the destination country; or,
• Standard Contractual Clauses (SCC) for data protection adopted by the European Commission, complemented, when applicable, with additional security measures.

9. Rights of Data Subjects

Under the GDPR, and as a data subject, you enjoy the following rights, which you can exercise free of charge:

• Right of Access and Information: Obtain confirmation about whether your data is processed, access it and obtain clear information about that processing.
• Right to Rectification: Request correction of inaccurate data or completion of incomplete data.
• Right to Erasure ("Right to be forgotten"): Request deletion of your data, provided there are no legal grounds (e.g., billing) that require their conservation.
• Right to Restrict Processing: Request suspension of the processing of your data in certain circumstances.
• Right to Portability: Receive the data you provided to RCG in a structured, commonly used and machine-readable format, or request its transmission to another controller.
• Right to Object: Object to the processing of data for certain purposes (e.g., direct marketing).
• Right to Withdraw Consent: Whenever processing is based on consent, you have the right to withdraw it at any time, without affecting the lawfulness of the processing carried out until that date.

10. Exercise of Rights and Complaints

To exercise any of your rights, or to clarify doubts about the processing of your personal data, you should contact our Data Protection Officer (DPO) through the following means:

• Email: dpo@reabilitar-em-casa.com
• Address: Lagoas Park Oeiras, Edif. 7, Piso 1 Sul, 2740-244 Porto Salvo

To guarantee the security of your data, RCG may request additional information that helps confirm your identity before responding to the request. RCG does not require sending a copy of the Citizen Card for the exercise of these rights.

If you consider that RCG has violated your rights or data protection legislation, you have the Right to file a complaint with the national control authority:

• Comissão Nacional de Proteção de Dados (CNPD) – www.cnpd.pt

11. Security and Confidentiality

RCG adopts rigorous technical and organizational measures to protect your personal data against destruction, loss, alteration, disclosure or unauthorized access. These include control of physical and logical accesses, data encryption (whenever technically feasible), regular backups and internal audits.

Despite our efforts to protect your data, we warn that the transmission of information over the Internet is never completely secure, so any sharing through open channels is done at your own risk.

12. Cookie Policy

RCG does not use cookies on its website. Our site does not use tracking, analysis, or any type of cookies, including essential or technical cookies.

We do not use Google Analytics, Facebook Pixel, or any other data analysis or marketing tool. Our site works completely without cookies.