Privacy Policy

1. Our Privacy Commitment


MCretail, SGPS, S.A. is a company that conducts its activities with transparency and security in the processing of personal data. This commitment extends to our daily relationship with our investors, partners, customers, and suppliers.

The privacy and security of the data you entrust to us are a priority for us. We are committed to only collecting, storing, processing, transmitting, or deleting personal data of our investors, partners, customers, and suppliers with transparency and ensuring that such personal data is essential to provide the best services.

We inform you how we use your personal data and for what purposes, ensuring that we collect, share, and store it following the best practices in the field of security and personal data protection. When your personal data is collected, stored, processed, transmitted, or deleted by other entities, we require the same level of privacy and security.

We want you to feel confident that your data is safe with us, as we are always committed to protecting your privacy, and we take our responsibilities regarding the protection of your personal data very seriously and diligently.

2. Who is Responsible for Your Personal Data


MCretail, SGPS, S.A., headquartered at Rua João Mendonça, nº 529, 4464-501 Senhora da Hora, Matosinhos, registered at the Commercial Registry Office under the unique corporate and registration number 501532927, with a share capital of €1,000,000,000.00, hereinafter referred to as MC, is responsible for processing your personal data under the General Data Protection Regulation and the complementary data protection legislation in force in the countries where it operates. Regarding items vi, vii, and viii of point 4, the companies identified in Annex I are Jointly Responsible for Processing your Personal Data.

3. Personal Data We May Collect


In this Privacy Policy, the term “Personal Data” means the set of information that relates to you and allows us to identify you, directly or indirectly. Your personal data may include, for example, your name, your tax identification number, your contacts (physical or electronic), your transactions, and your interactions with us. We may also receive your personal data from other companies, particularly when they collect, process, or store it under a service provision contract. MCretail, SGPS, S.A. may collect the following categories of personal data:

  • Investor/shareholder identification and contact data – full or abbreviated name, citizen card number, tax identification number, address, phone, email, and number of shares held;
  • Customer identification and contact data – full or abbreviated name, address, phone, email;
  • Supplier data – in the case of individuals, full name and tax identification number; in the case of legal entities, name and contacts of the representative;
  • Partner data – in the case of individuals, full name and tax identification number; in the case of legal entities, name and contacts of the representative;
  • Candidate data – identification data, contact data, professional data, areas of interest, and data contained in the curriculum vitae.
     

4. How, Why, and with What Legitimacy We Use Your Personal Data


In our daily activities, we need to process some of your personal data. However, we only do so when necessary to fulfill contractual or legal obligations, when legitimate interests of the company are at stake, or when we have your consent for this purpose. In any case, whatever the situation, we can assure you that we will only process the data we need for each purpose, for the necessary time, and that we will always keep you informed. Thus, we use your personal data for the following purposes:

  i. Providing information in response to requests arising from the relationship with investors/shareholders and internal reporting;

  ii. Operationalizing partnership actions within the scope of Corporate Social Responsibility;

  iii. Fulfilling regulatory reporting duties;

  iv. Fulfilling communication and brand projects and actions;

  v. Providing information/opportunities – within the scope of ‘talk to us,’ you can interact with us and send us an email so we can provide you with information and/or inform you about opportunities;

  vi. Managing applications
   a. Spontaneous applications – within these applications, the companies identified in Annex I are Jointly Responsible for Processing your Personal Data and will analyze whether the candidates’ interests and skills fit the opportunities that arise in the different businesses of the Sonae group;
    b. Spontaneous and specific applications by area/business of MC – within these applications, the companies identified in Annex I are Jointly Responsible for Processing your Personal Data and will analyze whether the candidates’ interests and skills fit the opportunities that arise in MC, with specific information for this processing activity being provided at the time of account creation for the Recruitment and Selection process;
    c. Applications for a specific position – within these applications, the companies identified in Annex I are Jointly Responsible for Processing your Personal Data, with specific information for this processing activity being provided at the time of account creation for the Recruitment and Selection process.

5. How Long We Keep Your Personal Data


We retain your personal data only for the period necessary to fulfill the purposes identified in the previous point and to comply with the law. Once the maximum retention period is reached, your personal data will be anonymized or securely destroyed/deleted.

6. With Whom We May Share Your Personal Data


In some cases, we may disclose your personal data to other companies in the Sonae Group. In these cases, we require them to have appropriate security measures in place to protect your personal data. When required by law, we may have to disclose your personal data to authorities or third parties, in which case our control over how your personal data is protected is limited.

7. How You Can Exercise Your Personal Data Protection Rights


You have the right to exercise the following rights:

  • Right to Information: Request additional information about how we use your personal data;
  • Right of Access: Access or request access to the personal data you have provided us;
  • Right to Portability: Request the transmission of the personal data you have provided us;
  • Right to Rectification: Request the correction or update of your personal data;
  • Right to Erasure: Request the deletion of your personal data, when permitted by law or contract;
  • Right to Restriction: Request the limitation of how we use your personal data while we correct or clarify any doubts about its content or how we use it;
  • Right to Object: We provide a channel for you to contest decisions based on your personal data.

You also have the right to withdraw or change, at any time, the consent you have given us to use your personal data, when the processing is based on consent. The exercise of these rights is excepted when your personal data is used to safeguard the public interest, particularly in cases of crime detection and prevention, or when they are subject to professional secrecy. To exercise your personal data protection rights or whenever you have any questions about how we use your personal data, you should contact us by sending an email to the following address: dadospessoais@sonaemc.com You can also contact our Data Protection Officer (DPO) via the following email: dpo@sonaemc.com. If you are dissatisfied with how we use your personal data or with our response to your request to exercise your rights, you can file a complaint with the National Data Protection Commission (CNPD):

  • Address: AV. D. Carlos I, 134, 1º, 1200-651 Lisbon
  • Phone: +351213928400
  • Fax: +351213976832
  • Email: geral@cnpd.pt.

8. How We Protect Your Personal Data


We have a variety of information security measures, aligned with national and international best practices, to protect your personal data, including technological controls, administrative, technical, physical measures, and procedures that ensure the protection of your personal data, preventing its misuse, unauthorized access and disclosure, loss, improper or inadvertent alteration, or unauthorized destruction. We are committed to continuous improvement in information security, as we are in our daily activities. Among others, we highlight the following measures:

  • Restricted access to your personal data only by those who need it for the purposes we have outlined above;
  • Storage and transfer of personal data only in a secure manner;
  • Protection of information systems to prevent unauthorized access to your personal data;
  • Implementation of mechanisms that ensure the integrity and quality of your personal data;
  • Continuous monitoring of information systems to prevent, detect, and prevent the misuse of your personal data;
  • Redundancy of storage, processing, and communication equipment for personal data to avoid loss of availability.

9. Updates to this Privacy Policy


This Privacy Policy may be updated from time to time, which will be disclosed on our website.
 

Annex I


Sonae – SGPS, S.A., headquartered at Lugar do Espido, Via Norte, 4470-150 – Maia, registered at the Maia Land/Commercial Registry Office under NIPC 500 273 170.

  • Contact for the Data Protection Officer (“DPO”) of the above-identified company:  dpo@sonae.pt

MCMKT Brands, Lda., headquartered at Rua João Mendonça, n.º 505, 4464-501 – Senhora da Hora, registered at the Maia Land/Commercial Registry Office under NIPC 509 744 907.

Mundo Note – Papelaria, Livraria e Serviços, S.A., headquartered at Rua João Mendonça, n.º 505, 4464-501 – Senhora da Hora, registered at the Maia Land/Commercial Registry Office under NIPC 517 309 505.

ZU, Produtos e Serviços para Animais, S.A., headquartered at Rua João Mendonça, n.º 505, 4464-501 – Senhora da Hora, registered at the Maia Land/Commercial Registry Office under NIPC 517 309 599.

MC – Shared Services, S.A., headquartered at Lugar do Espido, Via Norte, 4470-177 – Maia, registered at the Maia Land/Commercial Registry Office under NIPC 509 211 690.

Modelo Continente Hipermercados S.A., headquartered at Rua João Mendonça, n.º 505, 4464-503 – Senhora da Hora, registered at the Porto Land/Commercial Registry Office under NIPC 502 011 475.

Continente Hipermercados S.A., headquartered at Estrada da Outurela, n.º 118 – Edifício Imopólis, Bloco D, 2790-114 – Carnaxide, registered at the Cascais Land/Commercial Registry Office under NIPC 501 591 109.

BB Food Service, S.A., headquartered at Rua João Mendonça, n.º 529, 4464-503 – Senhora da Hora, registered at the Porto Land/Commercial Registry Office under NIPC 508 879 990.

Bom Momento – Restauração, S.A., headquartered at Rua João Mendonça, n.º 529, 4464-503 – Matosinhos, registered at the Porto Land/Commercial Registry Office under NIPC 508 891 922.

Pharmacontinente – Saúde e Higiene, S.A., headquartered at Rua João Mendonça, n.º 529, 4464-503 – Senhora da Hora, registered at the Porto Land/Commercial Registry Office under NIPC 508 037 514.

Brio – Produtos de Agricultura Biológica, S.A., headquartered at Rua João Mendonça, n.º 529, 4464-501 – Matosinhos, registered at the Lisbon Land/Commercial Registry Office under NIPC 508 486 076.

Elergone Energia, Lda., headquartered at Rua de Almeiriga, n.º 586, 4450-608 – Leça da Palmeira, registered at the Porto Land/Commercial Registry Office under NIPC 508 625 521.

Go Well – Promoção de Eventos, Catering e Consultoria S.A., headquartered at Estrada da Outurela, n.º 118, Edifício Imopólis, Bloco D, 2790-114 – Carnaxide, registered at the Lisbon Land/Commercial Registry Office under NIPC 505 831 929.

H&W - Mediadora de Seguros, S.A., headquartered at Rua João Mendonça, n.º 529, 4464-503 – Senhora da Hora, registered at the Porto Land/Commercial Registry Office under NIPC 516 528 777.

  • Contact for the Data Protection Officer (“DPO”) of the above-identified companies: dpo@sonaemc.com.

Sohi Meat Solutions - Distribuição de Carnes, S.A., headquartered at Zona Industrial de Santarém – Quinta do Mocho, 2005-002 – Várzea, registered at the Porto Land/Commercial Registry Office under NIPC 514 183 578.

IGI Investimentos e Gestão Imobiliária, S.A., headquartered at Lugar do Espido, Via Norte, 4470-177 – Maia, registered at the Maia Land/Commercial Registry Office under NIPC 501 913 246.

MCRetail, SGPS, S.A., headquartered at Rua João Mendonça, n.º 529, 4464-503 – Senhora da Hora, registered at the Porto Land/Commercial Registry Office under NIPC 501 532 927.

Sonae Holdings, S.A., headquartered at Lugar do Espido, Via Norte, 4470-150 – Maia, registered at the Maia Land/Commercial Registry Office under NIPC 506 440 613.

SparkFood, S.A., headquartered at Lugar do Espido, Via Norte, 4470-177 – Maia, registered at the Porto Land/Commercial Registry Office under NIPC 516 540 408.

SFS, Gestão e Consultoria, S.A., headquartered at Lugar do Espido, Via Norte 4470-177 Maia, registered at the Maia Land/Commercial Registry Office under NIPC 513 922 369. 

  • Contact for the Data Protection Officer (“DPO”) of the above-identified company: dpo@sonaefs.pt

Universo, IME, S.A., headquartered at Lugar do Espido, Via Norte 4470-177 Maia, registered at the Maia Land/Commercial Registry Office under NIPC 514 665 122. 

  • Contact for the Data Protection Officer (“DPO”) of the above-identified company: dpo@universo.pt.