Privacy and data protection policy

This Privacy and Data Protection Policy explains how DECOR PITA – MATERIAIS DE CONSTRUÇÃO, S.A., hereinafter referred to as “Decorpita”, collects, uses, retains, discloses and protects personal data processed in connection with:

a) Access to and use of the website www.decorpita.pt, hereinafter referred to as the “Website”;

b) Use of the chatbot made available through the Website;

c) Communications submitted through the email addresses, telephone numbers and other communication channels published on the Website;

d) Technical data required for the operation, maintenance, security and protection of the Website;

e) Other digital interactions directly related to the use of the Website.

 

This Policy applies to Website visitors and Users and to natural persons who contact Decorpita through the communication channels published on the Website.

As at the publication date of this Policy, the Website does not provide:

a) Contact forms;

b) Online quotation request forms;

c) Newsletter subscriptions;

d) Restricted areas for customers or trade professionals;

e) User registration or account creation;

f) Online job applications or curriculum vitae submissions;

g) Facilities for uploading plans, photographs, designs or other documents;

h) Online purchasing or payment functionality.

 

The future introduction of any such functionality will require this Policy to be reviewed and, where necessary, specific privacy information to be provided at the point at which personal data are collected.

The controller responsible for the processing of personal data is:

DECOR PITA – MATERIAIS DE CONSTRUÇÃO, S.A.

Registered office:
Estrada do Casal da Coxa, no. 2
2600-056 Rondulha
Vila Franca de Xira
Portugal

Corporate and taxpayer identification number: 503 150 541
Telephone: +351 263 287 320
General email: geral@decorpita.pt
Website: www.decorpita.pt

Decorpita’s full corporate details are available in the Legal Notice and Corporate Information.

For any matter relating to the processing of personal data or the exercise of data subject rights, Decorpita may be contacted at:

Email: privacidade@decorpita.pt

Postal address:

DECOR PITA – MATERIAIS DE CONSTRUÇÃO, S.A.
For the attention of: Data Protection
Estrada do Casal da Coxa, no. 2
2600-056 Rondulha
Vila Franca de Xira
Portugal

As at the publication date of this Policy, Decorpita has not formally appointed a Data Protection Officer.

The email address privacidade@decorpita.pt is a functional Decorpita contact for privacy and data protection matters. It does not, in itself, constitute the contact address of a formally appointed Data Protection Officer.

The appointment of a Data Protection Officer is mandatory for companies only under certain circumstances set out in the GDPR. Assessing this need is the responsibility of the data controller.

Personal data means any information relating to an identified or identifiable natural person.

Personal data may include:

a) Name;

b) Postal address;

c) Telephone number;

d) Email address;

e) Company and professional role, where linked to a natural person;

f) The content of communications submitted to Decorpita;

g) IP address;

h) Session or device identifiers;

i) Technical browser or device information;

j) Access and usage logs;

k) The content of messages submitted through the chatbot;

l) Any other information that directly or indirectly identifies a natural person.

 

Information relating exclusively to a legal entity does not, in itself, constitute personal data. However, information relating to its representatives, employees or professional contacts may constitute personal data.

Decorpita may collect personal data as follows:

 

5.1. 5.1. Directly from the data subject

Personal data may be collected where the data subject:

a) Contacts Decorpita by email;

b) Contacts Decorpita by telephone;

c) Uses the chatbot made available through the Website;

d) Requests information concerning products, services, showrooms, brands or business areas;

e) Requests a commercial contact;

f) Otherwise communicates with Decorpita in connection with information published on the Website.

 

5.2. 5.2. Automatically through use of the Website

Certain technical data may be collected when the Website is accessed, including:

a) IP address;

b) Date and time of access;

c) Browser type and version;

d) Operating system;

e) Device type;

f) Pages viewed;

g) Referral source;

h) Technical session logs;

i) Information required to prevent, detect and investigate security incidents;

j) Information relating to cookies and similar technologies, in accordance with the Cookie Policy.

 

5.3. 5.3. Through technology service providers

Certain personal data may be processed through service providers responsible for:

a) Website hosting;

b) Technical maintenance;

c) The security of their systems;

d) Email services;

e) The technology used to operate the chatbot;

f) Website usage analytics, should an analytics tool be implemented.

 

Such service providers may only process personal data to the extent required to provide the relevant services and in accordance with the contractual terms established by Decorpita.

Depending on the relevant interaction, Decorpita may process the following categories of personal data:

 

6.1. 6.1. Identification data

Name and other identification details voluntarily provided by the data subject.

 

6.2. 6.2. Contact details

Email address, telephone number, postal address or other contact details provided by the data subject.

 

6.3. 6.3. Professional information

Company, job title, professional activity and relationship with the represented organisation.

 

6.4. 6.4. Communications data

The content of messages, enquiries, questions, responses, the subject matter of the communication and the history of communications with Decorpita.

 

6.5. 6.5. Chatbot data

The content of messages submitted, the date and time of the interaction, technical session data and other identifiers required for the operation and security of the tool.

 

6.6. 6.6. Technical and usage data

IP address, device type, browser, operating system, pages viewed, session duration, security logs and other technical data required for Website operation.

Decorpita does not intend to collect personal data through the Website that are not adequate, relevant or necessary for the purposes identified in this Policy.

Decorpita processes personal data in accordance with the following principles:

a) Lawfulness, fairness and transparency;

b) Purpose limitation;

c) Data minimisation;

d) Accuracy;

e) Storage limitation;

f) Integrity and confidentiality;

g) Accountability.

 

Only personal data that are adequate, relevant and necessary for the purposes identified in this Policy will be processed.

These principles derive from the GDPR and the Portuguese legislation ensuring its implementation within the national legal order.

8.1. 8.1. Technical operation of the Website

Purposes:

a) Providing access to and navigation of the Website;

b) Correctly displaying Website content;

c) Ensuring that pages and functionalities operate correctly;

d) Diagnosing technical errors or failures;

e) Carrying out updates and maintenance;

f) Ensuring compatibility with different devices and browsers.

 

Legal basis:

Decorpita’s legitimate interests in providing a functional, secure and accessible Website.

 

8.2. 8.2. Website and systems security

 

Purposes:

a) Preventing unauthorised access;

b) Detecting attempted intrusions;

c) Preventing fraud and misuse;

d) Investigating technical or security incidents;

e) Protecting Decorpita’s systems, networks and information;

f) Maintaining security logs.

 

Legal basis:

Decorpita’s legitimate interests in protecting its systems, information and Users and compliance with applicable statutory security obligations.

 

8.3. 8.3. Responding to communications

 

Purposes:

a) Receiving and responding to messages;

b) Providing information concerning Decorpita;

c) Responding to questions concerning products, services, brands, showrooms or business areas;

d) Referring the enquiry to the appropriate department;

e) Requesting further information;

f) Maintaining a record of the communication;

g) Following up on the matter submitted.

 

Legal basis:

a) Taking steps at the request of the data subject prior to entering into a contract, where the enquiry relates to a potential purchase, proposal or commercial relationship;

b) Decorpita’s legitimate interests in receiving, organising and responding to communications submitted to it;

c) Compliance with a legal obligation, where applicable.

 

8.4. 8.4. Initial commercial enquiries

 

Purposes:

a) Understanding the requirements submitted;

b) Identifying the relevant business area or team;

c) Enabling a Decorpita representative to contact the interested party;

d) Preparing a potential meeting or commercial response;

e) Following up on the commercial opportunity submitted.

 

Legal basis:

a) Taking pre-contractual steps at the data subject’s request;

b) Decorpita’s legitimate interests in managing its commercial activities and responding to expressions of interest.

 

Processing for this purpose does not constitute registration for promotional communications or a newsletter.

 

8.5. Legal compliance and legal claims

a) Complying with statutory or regulatory obligations;

b) Responding to public authorities or courts;

c) Preventing and investigating fraud;

d) Retaining evidence of relevant communications;

e) Establishing, exercising or defending Decorpita’s rights;

f) Managing complaints or disputes.

 

Legal basis:

a) Compliance with a legal obligation;

b) Legitimate interests in fraud prevention and the defence of legal rights;

c) The establishment, exercise or defence of legal claims.

9.1. 9.1. Chatbot purposes

The chatbot may be used to:

a) Answer general questions concerning Decorpita;

b) Provide information on products, services, brands, showrooms and business areas;

c) Assist Users in locating information available on the Website;

d) Provide relevant contact channels;

e) Direct Users to the appropriate department or service;

f) Support initial informational or commercial enquiries.

 

9.2. 9.2. Data processed

Depending on the technical configuration of the tool, the following data may be processed:

a) The content of messages submitted by the User;

b) The date and time of the interaction;

c) Technical session data;

d) IP addresses or other technical identifiers;

e) Device and browser information;

f) Logs required for diagnostics, security and operation of the tool.

 

9.3. 9.3. Legal bases

Processing may be based on:

a) Decorpita’s legitimate interests in providing assistance and improving access to information;

b) Taking steps at the User’s request prior to entering into a contract, where the conversation concerns a potential commercial enquiry;

c) Compliance with statutory or security obligations, where applicable.

 

9.4. 9.4. Nature of chatbot responses

Chatbot responses are provided for general information purposes only.

They do not constitute:

a) A legally binding offer;

b) Final confirmation of a price;

c) A guarantee of availability;

d) A definitive technical specification;

e) Confirmation of an order or contract award;

f) A guaranteed manufacturing, supply, delivery or installation lead time;

g) Technical advice tailored to the specific conditions of an individual project.

 

Material information should be confirmed directly with a Decorpita representative.

 

9.5. 9.5. Automated decision-making

The chatbot will not be used to make decisions based solely on automated processing that produce legal effects concerning the User or similarly significantly affect the User.

The GDPR recognizes a person’s right not to be subject—except under conditions provided for by law—to decisions based solely on automated processing that produce legal effects or similarly significant effects.

9.6. 9.6. Information that should not be submitted

Users should not submit through the chatbot:

a) Passwords;

b) Authentication codes;

c) Full banking details;

d) Identification documents;

e) Health data;

f) Biometric data;

g) Information revealing racial or ethnic origin;

h) Political opinions;

i) Religious or philosophical beliefs;

j) Information concerning sex life or sexual orientation;

k) Confidential third-party information;

l) Unnecessary personal data relating to third parties.

 

Decorpita may delete information that is manifestly excessive, unnecessary or inappropriate for the purpose of the interaction.

Browsing the Website for information purposes does not require the User to provide their name, telephone number or email address directly.

The chatbot may be used without the User identifying themselves, unless the User voluntarily provides contact details or identification is required to follow up on the enquiry.

Where a User wishes to receive a subsequent response, be contacted by a Decorpita representative or initiate a commercial enquiry, it may be necessary to provide certain contact information.

Failure to provide the required data may prevent Decorpita from:

a) Identifying the enquiry;

b) Responding to the question submitted;

c) Contacting the User;

d) Referring the matter to the appropriate department;

e) Following up on an expression of commercial interest.

Personal data may only be accessed internally by personnel and departments that require the information to respond to the enquiry, operate the Website or comply with legal obligations.

To the extent strictly necessary, personal data may also be processed by:

a) Website hosting providers;

b) Website development and technical maintenance providers;

c) Information technology service providers;

d) Cybersecurity service providers;

e) Email and communications service providers;

f) The provider of the technology used to operate the chatbot;

g) Analytics or statistical service providers, should such tools be implemented;

h) Legal advisers, auditors, insurers and other professional consultants;

i) Public authorities, courts or regulatory bodies where required by law or pursuant to a lawful request.

 

Where an entity processes personal data on Decorpita’s behalf, it will act as a processor and will be subject to documented instructions, confidentiality duties and appropriate security obligations.

Decorpita does not sell or otherwise trade personal data.

Based on the technical configuration planned for the launch of the Website, Decorpita does not intend to transfer personal data to countries outside the European Economic Area.

Decorpita will seek to appoint service providers that process personal data within the European Economic Area.

Before the Website and chatbot become operational, Decorpita will confirm with its technical service providers:

a) The location of infrastructure and servers;

b) The location of processing operations;

c) The use of sub-processors;

d) Whether personal data may be accessed from third countries;

e) The mechanisms applicable to any international transfers.

 

Where a service provider involves a transfer of personal data outside the European Economic Area, Decorpita will ensure that an appropriate legal transfer mechanism is in place and will update this Policy where necessary.

The GDPR requires that any transfer to third countries be covered by an adequacy decision, appropriate safeguards, or another applicable legal basis.

Personal data processed exclusively in connection with:

a) Use of the Website;

b) Chatbot interactions;

c) Informational digital communications;

d) Initial commercial enquiries that do not result in a contractual relationship;

 

will generally be retained for a maximum period of 12 months from the date of the last relevant interaction.

Personal data may be deleted before the end of that period where they are no longer required for the purpose for which they were collected.

Personal data may be retained for a longer period where required to:

a) Comply with a legal obligation;

b) Investigate a security incident;

c) Prevent or investigate fraud;

d) Resolve a complaint;

e) Establish, exercise or defend legal claims;

f) Comply with a decision or instruction issued by a competent authority.

 

Where a Website or chatbot interaction results in a proposal, order, contract, complaint or commercial relationship, the necessary data may be transferred to Decorpita’s commercial records and retained for the applicable statutory or contractual periods.

Following expiry of the applicable retention period, personal data will be securely deleted or anonymised.

Portuguese legislation permits retention for the periods necessary to demonstrate compliance with obligations and mandates destruction or anonymization once the purpose has ceased and there is no other legal basis for retaining the data.

The Website may use cookies and similar technologies required for:

a) Technical operation;

b) Security;

c) Session management;

d) Remembering User preferences;

e) Operation of the chatbot.

 

Decorpita is confirming with its technical service providers whether an analytics or Website usage measurement tool will be implemented.

Where an analytics tool using cookies or technologies that are not strictly necessary is subsequently introduced:

a) Its use will be identified in the Cookie Policy;

b) The relevant providers, purposes and retention periods will be disclosed;

c) Any legally required preferences or consent will be obtained;

d) Users will be able to accept, reject or configure their preferences;

e) This Policy will be updated where necessary.

 

Full information concerning the cookies used will be provided in the Cookie Policy and the relevant cookie preference panel.

Decorpita implements technical and organisational measures considered appropriate to the risks associated with the processing of personal data.

Such measures are intended to protect personal data against:

a) Destruction;

b) Loss;

c) Alteration;

d) Unauthorised disclosure;

e) Unauthorised access;

f) Misuse;

g) Unlawful processing;

h) Accidental or malicious incidents.

 

Depending on the systems used, such measures may include:

a) Access controls;

b) User profiles and permission management;

c) Authentication mechanisms;

d) Network and device protection;

e) Backups;

f) Software updates;

g) Technical monitoring;

h) Activity logging;

i) Encryption, where appropriate;

j) Confidentiality obligations;

k) Staff training and awareness;

l) Incident management procedures;

m) Service provider assessments.

 

The GDPR requires the controller to implement technical and organizational measures appropriate to the risk.

No Internet transmission or information system can, however, be considered completely secure.

Subject to applicable law and the circumstances of the relevant processing, data subjects may exercise the following rights:

 

16.1. 16.1. Right of access

The right to obtain confirmation as to whether their personal data are processed and to access those data and related processing information.

 

16.2. 16.2. Right to rectification

The right to request the correction of inaccurate, incomplete or outdated personal data.

 

16.3. 16.3. Right to erasure

The right to request erasure where the statutory requirements are met.

The right to erasure is not absolute and may not apply where personal data must be retained to comply with a legal obligation, resolve a complaint or establish, exercise or defend legal claims.

 

16.4. 16.4. Right to restriction of processing

The right to request that the use of personal data be temporarily restricted in the circumstances provided by law.

 

16.5. 16.5. Right to object

The right to object, on grounds relating to the data subject’s particular situation, to processing based on Decorpita’s legitimate interests.

 

16.6. 16.6. Right to data portability

The right to receive personal data provided to Decorpita in a structured, commonly used and machine-readable format, where processing is based on consent or a contract and is carried out by automated means.

 

16.7. 16.7. Right to withdraw consent

Where processing is based on consent, the data subject may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

 

16.8. 16.8. Rights concerning automated decision-making

The right not to be subject, except in the circumstances permitted by law, to a decision based solely on automated processing that produces legal effects or similarly significantly affects the data subject.

The rights of access, rectification, erasure, restriction, objection, and portability are recognized by the GDPR and detailed by the CNPD.

Requests may be submitted in writing to:

Email: privacidade@decorpita.pt

or

Postal address:

DECOR PITA – MATERIAIS DE CONSTRUÇÃO, S.A.
For the attention of: Data Protection
Estrada do Casal da Coxa, no. 2
2600-056 Rondulha
Vila Franca de Xira
Portugal

The request should clearly state:

a) The data subject’s name;

b) The right being exercised;

c) The personal data or processing activity concerned;

d) Contact details for the response;

e) Any information reasonably required to locate the relevant data.

 

Where Decorpita has reasonable doubts concerning the identity of the requester, it may request additional information strictly necessary to confirm that identity.

The exercise of data subject rights is generally free of charge.

Decorpita will respond without undue delay and, in principle, within one month of receipt, without prejudice to any extension permitted by law due to the complexity or number of requests.

Without prejudice to any other administrative or judicial remedy, data subjects have the right to lodge a complaint with the competent supervisory authority:

Comissão Nacional de Proteção de Dados — CNPD

Avenida D. Carlos I, n.º 134, 1.º
1200-651 Lisboa
Portugal

Telephone: +351 213 928 400
Email: geral@cnpd.pt

Data subjects may contact Decorpita first through privacidade@decorpita.pt so that the matter can be reviewed and, where possible, resolved directly.

The indicated contacts correspond to the contact details currently published by the CNPD.

The Website, chatbot and Decorpita’s services are not specifically directed at children.

Decorpita does not intend to knowingly collect children’s personal data through the Website or chatbot without the appropriate involvement of their legal representatives where required.

A legal representative who believes that a child’s personal data have been improperly provided should contact Decorpita through privacidade@decorpita.pt

Decorpita does not request through the Website or chatbot personal data revealing:

a) Racial or ethnic origin;

b) Political opinions;

c) Religious or philosophical beliefs;

d) Trade union membership;

e) Genetic data;

f) Biometric data used for unique identification;

g) Health data;

h) Information concerning sex life or sexual orientation.

 

Users should not submit such information through the chatbot or other communications unless it is strictly necessary and a valid legal basis applies.

Where such information is provided voluntarily and is not required, Decorpita may delete it.

The Website may contain links to:

a) Social media platforms;

b) Mapping services;

c) Manufacturer or brand websites;

d) Videos;

e) Digital catalogues;

f) Other third-party services.

 

Where a User accesses a third-party service, the processing of personal data may be subject to that third party’s own terms and privacy policy.

Decorpita does not continuously control the privacy, security or data retention practices of external services.

Decorpita will maintain procedures intended to identify, assess and manage security incidents involving personal data.

Where a personal data breach is likely to result in a risk to the rights and freedoms of natural persons, Decorpita will make any notifications required by law to the competent supervisory authority.

Where a breach is likely to result in a high risk, affected data subjects will be informed in accordance with applicable law.

Decorpita may amend or update this Policy where necessary, including as a result of:

a) Legislative or regulatory changes;

b) Guidance issued by supervisory authorities;

c) Changes to the Website;

d) The introduction of new services or functionality;

e) A change to the chatbot provider;

f) The introduction of forms, newsletters or restricted areas;

g) The implementation of analytics or statistical tools;

h) Changes to technical service providers;

i) Changes to processing purposes or legal bases;

j) Organisational or operational changes.

 

The updated version will be published on the Website together with the date of the latest update and the applicable version number.

This Policy shall be interpreted in accordance with:

a) Regulation (EU) 2016/679 — General Data Protection Regulation;

b) Portuguese Law no. 58/2019 of 8 August;

c) Portuguese privacy and electronic communications legislation;

d) Any other applicable statutory and regulatory provisions.

 

Law No. 58/2019 ensures the implementation of the GDPR within the Portuguese legal system.

Enquiries concerning this Policy or the processing of personal data may be submitted to:

DECOR PITA – MATERIAIS DE CONSTRUÇÃO, S.A.

Data protection: privacidade@decorpita.pt
General email: geral@decorpita.pt
Telephone: +351 263 287 320
Last updated: 01.09.2026
Version: 1.0