PRIVACY POLICY

Introduction

Personal data relating to individuals belonging to each participating startup may be processed in the framework of the Blue Bio Value Acceleration Program. Please find below the information regarding such processing.

Data Controller

The joint controllers of the personal data processed in the framework of the Blue Bio Value Acceleration Program are the following:

1. MAZE Impact S.A., a company incorporated under Portuguese Law, with tax identification number 514 933 879, with registered office at Avenida Estados Unidos da América, n.º 119, 9º Esquerdo, Lisboa, Portugal;
2. Fundação Oceano Azul, a Foundation (non-profittable organization) incorporated under Portuguese Law, with tax identification number 514 165 421, with registered office at Oceanário de Lisboa, Esplanada D. Carlos I, 1990-005 Lisboa, Portugal;
3. BBA – Associação Nacional para os Biorecursos Marinhos e Biotecnologia Azul, an Association (non-profittable organization) incorported under Portuguese Law, with tax identification number 513625089, with registered office at Biocant Park – Parque Tecnológico de Cantanhede, Núcleo 04, Lote 2, 3060-197 Cantanhede.

Purposes for the processing

The personal data submitted by the participants in the application form for Blue Bio Value Acceleration Program will be processed for the purposes of commercial and marketing activities; organization and carrying out of the project, as well as delivering the correspondent prizes and perks; analysis of past projects in order for the joint controllers to evaluate their progress.

Legal basis for the processing

Regarding the commercial and marketing activities, the legal basis relied upon is the participant’s consent (article 6.1. (a) GDPR).

Regarding the: (i) organization and carrying out of the project and the delivery of the correspondent prizes and perks; and (ii) analysis of past projects; the legal basis relied upon is that the processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (article 6.1. (b) GDPR).

Recipients of personal data

The joint controllers may communicate the participants’ personal data to:

• Contractors for the provision of services that comprise one or more of the purposes mentioned above. Contractors will process the data only on documented instructions from the joint controllers and under the terms of the contracts entered.
• Third parties whenever it is in compliance with a legal obligation or court order to which the joint controllers are subject.

Storage periods

The joint controllers shall store the personal data for different periods, according to the aforementioned purposes:

• Regarding the commercial and marketing activities, the personal data will be stored until the participants withdraw their consent or oppose to such communications.
• Regarding the organization and carrying out of the project and the delivery of the correspondent prizes and perks, the personal data will be stored for the shortest amount of time possible to fulfill the purposes for which the data is being processed.
• Regarding the analysis of past projects for the joint controllers to evaluate their progress, the personal data will be stored for the shortest amount of time possible to fulfill the purposes for which the data is being processed.

The joint controllers may retain the participants’ personal data for longer periods for statistical purposes, limited however to the minimum necessary for such purpose and using anonymization.

Participants’ rights over their personal data

Participants, as data subjects, have the following rights:

• Right of access: participants have the right to request the joint controllers for information regarding the processing of their personal data and, if requested, a copy of their data subject to processing;
• Right of rectification: in case of incomplete or inaccurate data, participants have the right to request their rectification;
• Right to erasure: participants have the right to request the erasure of their personal data subject to processing by the joint controllers.
  However, this right is limited in certain situations, for example, when the processing of data is necessary to comply with legal obligations to which the joint controllers is subject, or when such processing is necessary for the establishment, exercise or defense of legal claims.
• Right to restriction: participants have the right to request the joint controllers to restrict the processing of their personal data or to suspend processing activities in cases where:
  • Participants contest the accuracy of their personal data, for a period of time that allows the joint controllers to verify its accuracy;
  • The processing is no longer necessary for the joint controllers but the data is required by the participants for the establishment, exercise or defense of legal claims;
  • The participants have objected to processing, until verified whether the legitimate interests of the joint controllers or third parties override those of the participants.
• Right to portability: participants have the right to receive their personal data, provided through a contract or based on consent, in a structured format, in common use and machine-readable format. They also have the right to have their data transmitted to another controller, whenever technically possible;
• Right to object: participants have the right to object to the processing of their personal data in cases where the data is processed based on the legitimate interests of the joint controllers, except in cases in which the joint controllers presents compelling and legitimate reasons that prevail over the rights of the data subjects;
• Automated individual decision-making, including profiling: participants have the right not to be subject to any decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.
• Right to withdraw consent: where consent is used as a legal basis for processing the personal data, participants shall have the right to withdraw their consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Participants also have the right to lodge a complaint to the Portuguese Data Protection Authority («Comissão Nacional de Protecção de Dados») if they consider that their rights over their personal data have been infringed.

As part of a request to the joint controllers regarding any of the rights identified above, participants may be asked to prove their identity in order to ensure that personal data is shared only with the respective data subject. The exercise of rights is free, except in cases of manifestly unfounded or excessive requests, in which case a reasonable fee may be charged taking into account the costs.

The data subject may excise her rights by contacting Fundação Oceano Azul through the email address powerfulideas@bluebiovalue.com.