Prolacto Lacticínios de São Miguel, S.A. values the privacy of its users and is committed to protecting the personal data collected and processed through its website. This policy outlines the contexts in which data is collected, the purposes of processing, and the rights of data subjects, in accordance with Regulation (EU) 2016/679 – General Data Protection Regulation (GDPR) and future amendments.

1. Collection of Personal Data
Prolacto may collect personal data in the following contexts:

• Subscription to institutional communications: Only the email address is collected and retained for the duration of the subscription or until the data subject requests cancellation. Invalid or persistently bounced addresses will be deleted.
• Contact forms, information requests, or participation: The data provided is processed exclusively for the purposes indicated in each form. To ensure proper functionality, a session cookie with a random identifier is used and deleted when the browser is closed.
• Whistleblower Portal: Data submitted is processed based on legal obligations and confidentiality guarantees, and is used solely for the analysis and follow-up of received reports.
• Website security and monitoring: To ensure system security, data such as access date and time, IP address, browser type, and visited pages are collected.

2. Legal Basis
Data processing is carried out based on:

• The data subject’s consent;
• Compliance with legal obligations;
• Execution of contracts;
• Prolacto’s legitimate interest, particularly in ensuring system security and service quality.

3. Rights of Data Subjects
Under the GDPR, data subjects have the right to:
​

• Access their data;
• Request rectification or deletion;
• Restrict or object to processing;
• Withdraw consent, where applicable;
• Lodge a complaint with the supervisory authority (CNPD).

These rights may be exercised using the contact form.

4. Cookies
Prolacto’s website uses session cookies to ensure the proper functioning of forms and enhance user experience. These cookies do not collect personal data and are deleted when the browser is closed.