INFORMATION

Sierra Portugal, S.A., Sierra Spain Real Estate Services, S.A.U., Sierra Italy S.r.l., Sierra Italy Agency S.r.l., Sierra Germany GmbH, Sierra Romania Real Estate Services, SRL and Sierra IG, SGOIC, S.A., Paracentro –  Gestão, Projetos e Consutoria, S.A., Sierra Maroc Services Sarl, Ioannina Development of Shopping Centres S.A  (fully identified hereinafter) in their capacity as joint controllers, provide, pursuant to the GDPR (General Data Protection Regulation; Regulation (EU) 2016/679, of 27 April 2016) and any further legislation on data protection that is applicable, upon collection of personal data from the data subject, the following information:

Additional Information:

A – Rights of the data subject

• The data subject may exercise before the controller with respect to the personal data concerning him/her and upon verification of the legal conditions, the following rights:
  Right to withdraw consent at any time for any personal data processed under this legal ground, without affecting the lawfulness of processing based on consent before its withdrawal,
  Right of access,
  Right to rectification,
  Right to erasure (right to be forgotten),
  Right to the restriction of processing,
  Right to object,
  Right to portability.
• The data subject also has the right to lodge a complaint with the Portuguese supervisory authority, CNPD (www.cnpd.pt) or with your national supervisory authority.

B – Provision of personal data: The provision of personal data in this context is neither a statutory or contractual requirement, nor is it a requirement necessary to enter into a contract; the data subject is not obliged to provide his/her personal data.

C- Essence of the Joint Controllership arrangement

The joint controllers have entered into an arrangement which enables them to process business contacts of their counterparties’ representatives, either current or prospective business associates, in a centralized and shared way in order to facilitate the management of that information, the setting up of business meetings but also to enable the engagement into commercial opportunities that the joint-controllers may single-out as relevant for those counterparties.

The personal data collected is stored and shared through the Salesforce CRM platform will only be used to such purposes and is only accessible to a restricted number of workers who are tasked with dealing with the joint controllers’ counterparties and their representatives. As this is a shared platform the joint controllers have determined that Sierra Portugal, S.A., shall manage the platform and will deal with every data subject’s request concerning their data protection rights notwithstanding the fact that any data subject may directly contact a different joint controller. Sierra Portugal, S.A.’s DPO shall also act on any request by data subjects regarding the processing activities by the joint controllers, again, without prejudice to the right of every data subject to direct their requests to a different DPO. If and when this Joint Controllership agreement comes to an end, the joint controllers shall be deemed individual controllers for any subsequent processing activity of the personal data collected up until that moment. In the latter case, the joint controllers shall, without undue delay and whenever possible, inform the data subjects of the termination of the relationship of the parties, of the severance of the databases and of the new Duty to Inform applicable to such surviving datasets and related processing activities. Upon termination of the joint controllership agreement the parties shall perform an adequate assessment of the personal data collected and shall only continue to process the data which relates to their activity and that may still be of relevance for the purposes stated above.