AIRBAGSZENTRUM - SOCIEDADE UNIPESSOAL, LDA., legal entity no. 508263069, with registered office at R. 10, Zona Industrial de Rio Meão, no. 356, 452-475 Rio Meão, Portugal, hereinafter referred to as Zentrum, as the controller of personal data, undertakes to protect the privacy and rights of personal data subjects.
We have developed this Privacy Policy to explain how, as controllers, we process users’ personal data when they visit our website, in accordance with the General Data Protection Regulation (Regulation (EU) No. 679/2016 of the European Parliament and of the Council, of 27 April, hereinafter the “GDPR”) and other applicable legislation on personal data protection.
Through this policy, we intend to inform you about the collection and processing of personal data, the cases in which the provision of personal data is necessary, the periods for which we retain personal data, the categories of personal data we process, their purposes and legal bases, data transmission and international transfers, the rights available to personal data subjects and how you can contact us.
· Processing of personal data
The GDPR defines “personal data” as any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, a contact detail, location data, electronic identifiers or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Data subjects are the persons to whom the personal data relate.
Zentrum is responsible for the processing of personal data listed in this Privacy and Personal Data Processing Policy, since it decides which data are collected, the purposes for which they are collected and the means of processing such data.
Zentrum is committed to keeping your data properly protected by implementing technical and organisational measures intended to ensure their security and prevent their disclosure, loss and misuse, as well as their unauthorised processing, access or any other form of unlawful processing, such as the creation and implementation of data protection policies and the adoption of IT security and network system solutions.
However, users must adopt additional security measures, namely ensuring that they use properly configured electronic devices and browsers, with an active firewall, antivirus and/or other forms of logical or even physical security.
· Necessary information
Access to and use of our website do not depend on users providing personal data. You will only have to provide us with personal data if you wish to create an account, make a purchase or schedule a service, submit an application through the contacts available on our website, subscribe to our newsletter or contact us. The fields marked on the forms, with the exception of the message field, are mandatory; therefore, if you choose not to provide them, we may be unable to provide the services, information or clarifications requested.
In some cases, you may also give us your consent for the additional processing of personal data, or some of such data, where applicable. In this case, we will specifically inform the user about the scope of the consent and the purposes pursued by the processing activities.
· Retention periods
Zentrum retains personal data in an identifiable format for the shortest period necessary to fulfil the purposes pursued through the processing of personal data. After that period, we will cease processing the personal data and will delete them at periodic intervals, unless the continued processing and storage of the data is required by law or the user grants us consent for that purpose.
· Categories of data, purposes and legal bases for processing
1. To respond to communications addressed by the user to Zentrum
If you send us a communication, namely requesting information or clarification, through the telephone contacts or email address we provide, through the forms made available for that purpose and also through the AI Assistant Chat, we will process your personal data for the purpose of responding to your request, on the legal basis of our legitimate interest in managing the contact established and responding to your request, as well as, where applicable, in the pursuit of pre-contractual or even contractual steps at the request of the data subjects.
The data concerned include identification data, such as first name and surname, contact data, such as email address and, where applicable, telephone contact, other information necessary to complete the request, such as vehicle make, model, year and part, and the content of the communication addressed by the user to Zentrum, including attachments.
We will retain such personal data during the processing of the request/communication and until the moment when the personal data are no longer necessary to fulfil these purposes. If the request is submitted by a customer, we may retain the personal data during the maintenance of the contractual relationship or for a longer period, up to 10 years, if necessary to comply with a legal obligation, namely, but not exclusively, of a tax nature.
It should be noted that the submission of the user’s communication through the forms depends on their acceptance of the website Terms and Conditions [insert link[VHA1] ], as well as the use of the AI Assistant Online Chat depends on their acceptance of the Terms of Use [insert link[VHA2] ]; therefore, if they do not agree with them, Zentrum may be unable to provide the requested service and/or services.
2. For recruitment purposes
We may process personal data for recruitment purposes if you send us an unsolicited application through the contact form or contacts made available on the website, even if these are not intended for that purpose. The processing of personal data in question is carried out on the legal basis of taking pre-contractual steps at the request of the data subjects, our legitimate interest in managing the applications sent to us, compliance with legal obligations and, in some cases, your consent.
The data included here may cover identification data, such as first name and surname, date of birth, civil identification number/validity of the identification document, tax identification number, Social Security number, contact data, such as address, email address and telephone contact, and data relating to academic background and professional experience, for example, qualifications, certifications, personal and professional experience and curriculum vitae.
We will retain these personal data during the period in which your application is under review, until the recruitment process is completed, for a period of two years if you are not selected, or until you withdraw your consent, where applicable.
We may also process other personal data on the basis of compliance with legal obligations to which we are subject and for the periods imposed by applicable legislation.
3. For registration and account creation purposes
If you register to create an account through the form created for this purpose on our website, we will process your personal data for the purpose of responding to your request, on the legal basis of our legitimate interest in managing the contract established and responding to your request, as well as, where applicable, in taking pre-contractual steps at the request of the data subjects.
The data concerned include identification data, such as first name, surname and date of birth, contact data, such as email address, telephone contact and full address, tax data, such as name and tax identification number, the access credentials chosen by the user and other information necessary to complete the request.
The personal data provided in this context will be used to respond to requests for information, process orders and offers or authorise access to specific information. The user will have the right to change or delete all personal information found on the “My Account” page.
We will retain such personal data for as long as the user’s account is maintained and until the moment when the personal data are no longer necessary to fulfil these purposes. Since the request is made by the data subject themselves, with a view to entering into an agreement with Zentrum, we may retain the personal data during the maintenance of the contractual relationship or for a longer period, up to 10 years, if necessary to comply with a legal obligation, namely, but not exclusively, of a tax nature.
It should be noted that, given the specific nature of this activity, and since the data subject themselves registers as a Zentrum user, in addition to the legal bases already set out, Zentrum understands that, by registering, the data subject expressly consents to the provision of their personal data on the website or through any other suitable means of dissemination operated by Zentrum. This consent may be withdrawn at any time.
It should be noted that the submission of the user’s communication through the forms depends on their acceptance of the website Terms and Conditions [insert link[VHA3] ], and this Privacy and Personal Data Processing Policy; therefore, if they do not agree with them, Zentrum may be unable to provide the requested service and/or services. Additionally, the user may also agree to receive offers from Zentrum’s partners by simply declaring that they accept the collection of their data for that purpose.
4. For the purpose of ensuring your purchase request for one of the products made available
If you send us a request to purchase a product through the form available on our website or through the contacts we provide, we will process your personal data for the purpose of responding to your request and selling such products, on the legal basis of our legitimate interest in managing the contract established and responding to your request, as well as, where applicable, in taking pre-contractual steps and performing a contract at the request of the data subjects.
The data concerned include identification data, such as first name, surname and full address, contact data, such as email address and telephone contact, and other optional information for completing the request, such as date of birth, tax identification number and company name, where applicable. In this context, users’ banking data may also be collected in order to complete their respective purchases, and Zentrum uses external service providers to process payments and, to that extent, cannot be held responsible for the improper use of data in that context.
We will retain such personal data during the processing of the order and until the moment when the personal data are no longer necessary to fulfil the purposes described above. Since the request is made by a customer, we may retain the personal data during the maintenance of the contractual relationship or for a longer period, up to 10 years, if necessary to comply with a legal obligation, namely but not exclusively of a tax nature.
It should be noted that the submission of the user’s purchase through the form depends on their acceptance of the website Terms and Conditions [insert link[VHA4] ]; therefore, if they do not agree with them, Zentrum may be unable to provide the requested service and/or services.
5. For newsletter subscription purposes
If you provide us with your data, such as name and email address, and your consent for this purpose, Zentrum may contact you for marketing purposes related to its services, namely through a periodic newsletter, on the legal basis of our legitimate interest in advertising our services and products. This consent may be given by completing the appropriate field in a specific form provided on our website. You may object to this processing at any time using the button indicated for that purpose.
6. For the purpose of ensuring access to our services and our website (Cookies)
On the basis of our legitimate interests, namely ensuring the proper functioning of the services and our website and preventing misuse, we may process access data, such as the date and time of the user’s visit to our service, for the purpose of determining the level of access and traffic to the website. For the purpose of preventing damage through interference with information systems, we may process data with the aim of detecting attacks on our website due to unusual activities, diagnosing failures, and preventing and detecting fraud.
All data are pseudonymised, which means that the data are processed in such a way that they cannot be attributed to a specific person without the use of additional information.
The collection of this information is, as a rule, also recorded through cookies.
Personal data subjects are therefore informed that Zentrum collects cookies or connection tokens when browsing the website. These technologies enable Zentrum to provide a better browsing experience when users use the website.
Zentrum safeguards that, with the exception of essential cookies, website users may at any time change the settings of their computers or mobile devices and restrict the acceptance of cookies, namely through the option to change cookie preferences. However, we warn that, depending on the selections made, the use of some website features may be affected, even if only partially.
Due to the technical procedures for transmitting information over the Internet, the transmission of access data to external content service providers is inevitable. External content service providers are responsible for ensuring that the information technology systems they use comply with legal privacy requirements.
For more information, please consult our Cookie Policy [insert link].[VHA5]
· Transmission of personal data and international transfers
Zentrum may transmit your personal data to third parties, namely if such transmission is necessary so that we can provide you with the services rendered, for statistical purposes or to comply with legal obligations to which we are subject.
We may share personal data of website users, namely with providers of IT, legal and administrative advisory services, website hosting services, website content provision services and information technology security services, as well as with public authorities in compliance with legal obligations. Whenever Zentrum shares personal data of website users with external service providers, as well as with public authorities in compliance with legal obligations, it undertakes to assess the level of protection implemented by such third parties in these matters and, if it deems it necessary, to enter into a data protection agreement with them.
This website may contain links to social networks such as Facebook, Instagram, WhatsApp, LinkedIn, among others, owned by third parties, which display a button through which messages may be sent to the corresponding social network for various purposes, such as communications, recommendations or content sharing. The legal basis for the transmission of data in this case is Zentrum’s legitimate interests in advertising its services. The service providers concerned are responsible for ensuring that the processing of the personal data transmitted takes place in accordance with privacy requirements.
The personal data subject is expressly warned that, when disclosing personal data on Zentrum’s public channels, such as its Facebook, Instagram, WhatsApp, LinkedIn page, among others, such information may be viewed and used by third parties.
Zentrum also warns that the website may contain links, hyperlinks, to third-party websites, products or services, which are not covered by this Privacy Policy. Zentrum therefore cannot be held liable, under any circumstances, for the content, accuracy, truthfulness or legitimacy of such websites or for the misuse of data collected or processed through them.
Zentrum draws the attention of its customers and the general public to this fact and to the need, before using such websites, to carefully read the rules regarding the processing of personal data established by such third parties.
Zentrum advises:
o Not including personal, confidential and/or sensitive data in communications sent to it, for example bank card numbers;
o Exercising caution when exposing personal data and when circulating such data on the internet;
o Not browsing websites of dubious reputation;
o Parents or legal guardians monitoring the sending of personal data by minors.
Zentrum is not responsible for personal data or other unsolicited information sent to it in any publicly accessible area that it administers or manages, and generally deletes them insofar as they are not appropriate, relevant and limited to the purposes pursued by it.
· Rights of data subjects
As a personal data subject, you have the following rights:
1. Right of access
At any time, you have the right to obtain confirmation from us as to whether personal data concerning you are being processed and, if so, to access such data and the information provided for by law.
2. Right to rectification
As a personal data subject, you have the right to obtain the rectification of inaccurate personal data concerning you, without undue delay. Taking into account the purposes of the processing, the user has the right to have incomplete personal data completed, including by means of an additional statement.
3. Right to erasure (“right to be forgotten”)
You have the right to obtain the erasure of your personal data, without undue delay, in certain circumstances provided for by law, including where your personal data are no longer necessary for the purpose for which they were collected or processed, or where you decide to withdraw consent, if this is the legal basis for the processing and there is no other basis allowing it. This right may be limited in certain situations, including where processing is necessary for the establishment, exercise or defence of legal claims or for compliance with a legal obligation requiring processing.
4. Right to restriction of processing
In certain situations provided for by law, you have the right to obtain the restriction of the processing of your personal data. These situations include cases where you contest the accuracy of your personal data, for a period enabling Zentrum to verify their accuracy, and cases where you have objected to processing, until it is verified whether Zentrum’s legitimate grounds override yours.
5. Right to data portability
If the processing is based on consent or on a contract to which the data subject is a party, the data subject has the right to receive the personal data they have provided to us in a structured, commonly used and machine-readable format. They also have the right to request that we transmit their data directly to another controller, where technically feasible.
6. Right to object
If we process your personal data for direct marketing purposes, the data subject has the right to object, at any time, to the processing of personal data concerning them for marketing purposes, with effect for the future, including profiling, insofar as it is related to direct marketing. In this case, the personal data will no longer be processed for that purpose.
The data subject also has the right, at any time, with effect for the future and on grounds relating to their particular situation, to object to the processing of personal data based on the legitimate interests of Zentrum or third parties. In this case, we will cease processing unless compelling legitimate grounds for such processing are established which override the interests, rights and freedoms of the data subject, or unless the processing is necessary for the establishment, exercise or defence of legal claims.
7. Right to withdraw consent
If the processing is based on consent, the data subject has the right to withdraw consent at any time, without affecting the lawfulness of the processing based on consent up to the time of its withdrawal. In this case, unless there is another legal basis requiring or allowing it, such as compliance with a legal obligation or a contract to which the data subject is a party, your personal data will no longer be processed.
8. Right to lodge a complaint
The data subject also has the right to lodge a complaint with the competent supervisory authority, the Portuguese Data Protection Commission, at https://www.cnpd.pt/cidadaos/participacoes/.
You may exercise your rights freely and free of charge by sending us a communication to the contacts indicated below. For this purpose, we may require evidence proving that you are the personal data subject who wishes to exercise such rights.
· How can you contact us?
You may request from us any information you consider necessary regarding the processing of your data through the contact form available on our website, or by email at: geral@zentrum-group.com.
You may also contact our data protection officer:
E-mail: info@hedadpo.pt
Letter: HEDA – DATA PROTECTION OFFICERS, Rua de João Ramalho, no. 141, 4200-342 Porto
The exercise of the personal data subject’s rights is free of charge, unless the request is manifestly unfounded or excessive, in which case a reasonable fee may be charged, taking into account the costs incurred.
If the personal data subject exercises any of their rights, Zentrum will analyse the respective request and is expected to respond within 1 (one) month.
Information is provided in writing, and may also be provided orally if the data subject so requests. Zentrum verifies the identity of the data subject before responding to their requests. If it verifies that the requests are unfounded or excessive, Zentrum reserves the right to charge a fee for the response.
· Updates
This Privacy Policy may be subject to periodic updates, and Zentrum therefore recommends that it be consulted regularly.
Version 2, dated 05 September 2025.