PRIVACY AND COOKIES POLICY
General Data Protection Regulation
(Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016)
1.Data Controller
CALHEIROS EMBALAGENS, S.A. (hereinafter "CALHEIROS"), headquartered at Rua das Macieiras, 220, 4445-502 Ermesinde, VAT Number (NIPC) 500 207 976, is a commercial company dedicated to the production and development of printed packaging in paperboard and micro-flute. In this capacity, it collects and processes personal data, assuming the position of Data Controller, with all inherent duties.
Contacts:
Address: Rua das Macieiras, 220, 4445-502 Ermesinde, Portugal
Telephone: +351 229 773 220
Email: geral@calheiros.pt
Data Protection/Privacy Officer: privacidade@calheiros.pt
2. Purposes and Legal Basis for Processing
CALHEIROS processes personal data for the following purposes and based on the following legal grounds:
A) Performance of a contract and pre-contractual measures: Management of the commercial relationship, order processing, and invoicing.
B) Compliance with legal obligations: Responses to tax authorities, judicial bodies, and other public authorities.
C) Legitimate Interest: Processing necessary for the legitimate interests pursued by the controller, which may include:
- Ensuring network and information security;
- Fraud prevention;
- Exercising or defending rights in legal proceedings;
- Improving the services provided.
A balancing test was conducted between the interests of the controller and the rights and freedoms of the data subject, pursuant to Article 6(1)(f) of the GDPR.
D) Consent of the Data Subject:
- Sending marketing communications, newsletters, and news or promotions (via email marketing);
- Personalizing the browsing experience and analyzing web traffic through tracking technologies (e.g., Facebook/Meta Pixel).
3. Processing Operations and Data Categories
CALHEIROS may collect and process:
- Identification and Contact Data: Name, address, VAT number, email, telephone (collected during service provision or via website forms).
- Browsing and Interaction Data: IP address, device type, browser, approximate geographic location, and interactions with our website and email campaigns (email opens, clicks), collected through cookies and pixels.
The processing of this data aims at administrative management, service provision and, upon consent, marketing communication and consumer profile analysis to send relevant information.
4. Retention Period Data will be stored:
- For contractual/legal purposes: For the period required by law (e.g., 10 years for tax records).
- For marketing purposes (newsletter): Until the data subject exercises their right to object or withdraws consent (via "unsubscribe" or direct contact), or for an internally defined period of inactivity, after which the data will be anonymized or deleted.
5. Confidentiality, Subprocessors, and Data Transfer
CALHEIROS is committed to secrecy and confidentiality. We do not sell personal data to third parties. However, we use technological partners and service providers who act as Subprocessors, namely:
- Accounting, insurance, and IT service providers;
- Email marketing management platforms (e.g., MailerLite);
- Web analytics and digital advertising providers (e.g., Meta Platforms Ireland Ltd./Facebook).
International Transfers: Some subprocessors may be located or have servers outside the European Economic Area (EEA). In such cases, CALHEIROS ensures that data transfers occur under adequate safeguards, namely through European Commission Adequacy Decisions (such as the EU-US Data Privacy Framework) or through the execution of Standard Contractual Clauses approved by the European Commission.
6. Rights of the Data Subject Under Articles 15 to 22 of the GDPR, the data subject enjoys the following rights, exercisable at any time via email to privacidade@calheiros.pt:
1. Right of Access (Art. 15): To obtain confirmation of whether their data is being processed and to receive a copy of said data.
2. Right to Rectification (Art. 16): To correct inaccurate or incomplete data.
3. Right to Erasure / "Right to be Forgotten" (Art. 17): To request the deletion of data, subject to legal conservation requirements.
4. Right to Restriction of Processing (Art. 18): To request the suspension of processing in specific situations.
5. Right to Data Portability (Art. 20): To receive data in a structured, commonly used, and machine-readable format.
6. Right to Object (Art. 21): To object to processing based on legitimate interests or for direct marketing purposes.
7. Right to Withdraw Consent (Art. 7[3]): To withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
The data subject also has the right to lodge a complaint with the National Data Protection Commission (CNPD) at www.cnpd.pt.
COOKIES AND TRACKING TECHNOLOGIES POLICY
1. What are Cookies and Pixels?
Cookies are small text files stored on the user's device when visiting a website. They allow the website to recognize the device on subsequent visits, storing preferences or settings. We also use tracking technologies like the Facebook Pixel to analyze marketing effectiveness and present content tailored to your interests.
2. Types of Cookies Used
- Essential Cookies: Necessary for the website to function.
- Analytical and Performance Cookies: To understand how visitors use the site.
- Advertising and Targeting Cookies (including Facebook Pixel): To record your visit and the links followed, used to show relevant ads on other platforms (Remarketing).
3. Cookie Management When accessing our website, you are presented with a consent management tool (Cookie Banner) where you can accept or reject non-essential cookies. You may, at any time, change your preferences through your browser settings or through the privacy management tools of third-party platforms (e.g., Facebook ad settings).
For more information on how to manage cookies in the most popular browsers:
Updated on: March 11, 2026