Personal Data Protection, Privacy and Cookies Policy
WINNING, LDA, with its registered office at Palacete dos Ulmeiros, Alameda das Linhas de Torres nº 152 E14, Lisbon, with share capital of €107,142.85 (one hundred and seven thousand, one hundred and forty-two euros and eighty-five cents), registered at the Lisbon Commercial Registry Office under the single registration and legal person number 510.098. 711 (referred to as ‘WINNING’), establishes, through this Personal Data Protection and Privacy Policy (‘Policy’), the guidelines for the protection and management of the personal data that it processes in its capacity as data controller in connection with the use of our website https://winning-consulting.com (‘Website’).
When data processing is carried out for the Alan Allman Associates ecosystem, WINNING, Lda., Alan Allman Associates Portugal, SA. and Alan Allman Associates International are considered separate entities, but jointly responsible for processing the data in question for these specific purposes. For all other processing, the entities of the group are autonomous and carry out the respective processing as individual controllers.
Intro
The protection of privacy and personal data is a fundamental commitment of WINNING to each holder of personal data (‘Holder’) who collaborates with us or uses the company’s digital platforms and services. With the application of the General Data Protection Regulation (‘GDPR’), EU Regulation 2016/679, of 27 April 2016, in force since 25 May 2018, and the publication of the national Enforcement Law, Law 58/2019, of 8 August, WINNING remains strongly committed to protecting the privacy and personal data of its Data Subjects. To this end, the company continually updates its Personal Data Protection and Privacy Policy in accordance with the principles and standards of the GDPR.
As part of its activity, WINNING collects and processes different categories of personal data and is subject to the applicable legislation, which defines how this processing should be carried out and guides the technical and organisational security and protection measures that must be implemented to safeguard this data.
In this page, which is part of our general data protection and privacy policy, we explain what personal data we collect, record, use, store and share about you in the context of your use of our website. Please read it carefully.
Data processed when using the website
By using our website you do not have to provide us with any personal data, except for cookies.
Why do we need your personal data?
We may process and store personal data from visitors to our site who accept the functionality of cookies that are not necessary for the management of the site’s functionalities.
When you visit the WINNING website, information such as pages visited, clicks, views, type of device, operating system and browser used is recorded. We use cookies to improve your browsing experience by personalising content and analysing website traffic. Some cookies are strictly necessary for the basic operation of the website, while others collect data for statistical and marketing purposes. All the information collected complies with the GDPR guidelines and is intended solely to optimise the experience and performance of the website.
In this case, your data is processed for the management of the website’s functionalities, during the persistence time of each cookie, as described in the table below, based on your consent, pursuant to Art. 6(1)(a) of the GDPR.
Cookies
Cookies are small text files stored on your computer via your browser, which retain information related to your browsing preferences and allow statistical analyses. These files identify the visitor and make it possible to personalise web pages, facilitating the flow of data between the different pages of the same site.
Online identifiers stored in cookies may, alone or together, be considered personal data relating to an identified or identifiable natural person.
In the European Union, the use of cookies is regulated by the e-Privacy Directive (Directive 2002/58/EC).
What data does our website's cookies process?
The data processed by cookies includes various online identifiers, such as session identifiers and specific cookies (_ga, _gid), browser type and version, operating system, device type (mobile or desktop), screen resolution, country of origin and user preferences, such as consent status and visual settings. In addition, the cookies used make it possible to personalise content, such as YouTube video player settings, and to distinguish between human visitors and bots for site security (e.g. _cf_bm, cf_clearance). This data enables a more personalised and secure browsing experience.
What are the cookies on our website?
Our website uses cookies and similar technologies. Strictly necessary cookies are used to make the website work; all other cookies — such as statistics (Google Analytics) and embedded content from third parties (YouTube, Google Maps, social networks) — are only placed after you give your consent through our cookie banner. You can change or withdraw your consent at any time. For a complete and up-to-date list of the cookies we use, their purpose and duration, please see our Cookie Policy.
Data sharing with third parties
As a rule, we do not share the data of visitors to our website. However, in order to maintain and improve our services, your personal data may be shared with service providers, other data controllers or, in some cases, public bodies and organisations.
We may be required to disclose your personal data in response to requests from courts, law enforcement authorities or other regulatory bodies. Whenever possible, we will inform you in advance and ensure that we disclose only the minimum necessary, taking into account the specific purpose to protect your privacy.
If the controller is located outside the EU, we will apply appropriate safeguards to ensure the protection of your data. These safeguards may include: verification of the adequacy decision of the European Commission (EC) for the country of destination, the implementation of appropriate safeguards for the transfer or, in the case of internal transfers, the application of binding corporate rules.
Who carries out processing operations on our behalf?
WINNING uses subcontractors for the purpose of processing personal data, within the parameters defined by law. These entities are obliged, under the terms of contracts entered into with them, to keep confidential and guarantee the security of the data to which they have access, and may not use this data for any other purpose, nor carry out any type of analysis or relationship with other data they hold.
We may share some of your personal data with the following subcontractors:
Subcontractor | Region |
U.S. |
When a subcontractor is established in a country outside the EU, we apply the necessary safeguards, which may include: confirmation of the European Commission’s (EC) adequacy decision for transfers to a given country; that transfers are subject to adequate guarantees; or, if the transfer is internal to the organisation, compliance with the binding rules applicable to companies.
Where personal data is transferred outside the European Union, such transfers are made on the basis of an adequacy decision (such as the EU-U.S. Data Privacy Framework) or the European Commission’s Standard Contractual Clauses.
How do we guarantee the security of personal data?
We are aware of, aware of and constantly reviewing and improving the measures in place to protect your personal data from unauthorised access, accidental loss, disclosure or destruction.
To prevent loss, disclosure, unauthorised use or access and to ensure appropriate use of your information, we use appropriate and reasonable physical, technical and administrative procedures to safeguard the personal data we collect and process. We keep data to the extent required or permitted by law.
When and whenever we collect, transfer or store sensitive information we use a variety of additional security technologies and procedures to help protect your personal data from unauthorised access, use or disclosure.
Social Networks
If you choose to share information via social networks such as LinkedIn, Facebook, Instagram or Twitter, the information you share, including your name and preferences, will be visible to visitors to your personal pages. We recommend that you carefully read the data protection policies of the social networks in question, as these will apply to the processing of your personal data by these third parties.
How can you exercise your rights?
WINNING is not legally required to appoint a Data Protection Officer, but has appointed an internal Privacy Officer. You can contact the Privacy Officer by email at privacy@winning.pt, or by post: Privacy Officer, Palacete dos Ulmeiros, Alameda das Linhas de Torres, n.º 152, Escritório 14, 1750-149 Lisboa, Portugal.
Your Rights
a) Right to Information: You have the right to obtain information from the Data Controller, namely identity and contact details; purposes of the processing; legal basis for the processing; recipients of the personal data;
b) Right of Access: The data subject has the right to obtain confirmation from the data controller as to whether or not personal data concerning him/her is being processed and, if so, the right to access his/her personal data;
c) Right to Rectification: The data subject has the right to obtain the rectification of inaccurate personal data concerning him/her and the right to have incomplete personal data completed;
d) Right to Erasure: In certain situations, you may have the right to have your personal data erased;
e) Right to Restriction of Processing: In certain situations, you may have the right to obtain restriction of the processing of your personal data;
f) Right to Portability: In certain situations, you may have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format and you may have the right to transmit this data to another controller;
g) Right to object: In certain situations, you may have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data and we may be obliged to cease processing your personal data;
h) Right not to be subject to automated decisions: You have the right not to be subject to any decision taken solely on the basis of automated processing, including profiling, which produces effects in your legal sphere or significantly affects you in a similar way.
Complaint
If you are dissatisfied with the way we use your personal data or with the response to your request to exercise your rights, you can lodge a complaint with the Supervisory Authority:
Comissão Nacional de Proteção de Dados (CNPD)
Avenida D. Carlos I, n.º 134, 1200-651 Lisboa,
+351 213 928 400 (telephone), +351 213 976 832 (fax) or geral@cnpd.pt (e-mail address)
Reviews
This policy was revised on 21 October 2024, ensuring its compliance with current legal, regulatory and operational requirements. It is a revision and integration of our ‘GDPR’ and ‘Privacy’ policies and is subject to regular changes and updates.
As far as possible, we will communicate any changes to this policy, but we also invite data subjects to consult it regularly to stay informed of any updates.