Privacy Notice and Consent Statement

Identification of the Data Controller

The data controller for the personal data collected through this survey is Rovensa, S.A., with its registered office at Ed. Central Office, Av. Dom João II 45 8º, 1990-084 Lisboa – Portugal, corporate entity No. 514194910, which can be contacted via email at dataprotection@rovensa.com and by phone at +351 213 222 750 (Rovensa).

Data Protection Officer

The data subject may contact Rovensa’s Data Protection Officer (DPO) for any questions regarding the processing of their personal data or the exercise of their rights, via email at dataprotection@rovensa.com or by mail to the address indicated above, marked “Attn: Data Protection Officer.”

Personal Data Collected

The following personal data is collected as part of the survey:

• professional identification and contact information: first name, last name, work email, and company;
• professional profile data: country/market, crop, type of operation or activity, approach used (biological, conventional, or integrated), challenges and interests related to biosolutions; and
• optional comments that may be provided by the participant.

The provision of identification and professional contact information, as well as the profile data marked as mandatory on the form (namely country/market, culture, and profile questions/challenges), is necessary for the submission and analysis of the survey; failure to provide this information prevents completion of participation. Filling out the remaining fields is optional, and omitting them will only limit the analysis of the profile and the delivery of content tailored to the user’s interests.

Purposes and Legal Basis

Personal data is processed for the following purposes, each of which is subject to the data subject’s specific, prior, informed, free, and unambiguous consent, pursuant to Articles 6(1)(a), and 7 of the GDPR, in conjunction, with regard to electronic commercial communications, with the applicable rules of the Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications):

• marketing and sales: sending commercial and informational communications (including by email), analyzing and segmenting profiles, sharing data with the Rovensa Group’s regional Marketing and Sales teams, and potentially uploading data to an email marketing platform; and
• product development: aggregated and individualized analysis of responses for the purposes of market research, identifying needs, and developing and improving Rovensa’s range of biosolutions.

The data subject may withdraw their consent at any time, without providing a reason and without affecting the lawfulness of the processing carried out based on the consent provided up to that point, by contacting the addresses listed in section 1 or using the unsubscribe link included in each commercial communication.

Recipients of the Data

Personal data may be disclosed to the following categories of recipients, exclusively for the identified purposes and within the limits of the consent provided:

• authorized employees of the Marketing, Sales, Communications, and Product Development teams at Rovensa and other entities within the Rovensa Group, including regional teams in the countries where the Group operates;
• service providers acting as Rovensa’s processors, specifically providers of website hosting, development, and maintenance services (WordPress), email marketing platforms, and analytical tools, subject to a data processing agreement in accordance with Article 28 of the GDPR.

International Data Transfers

Whenever, in the course of the Rovensa Group’s or its subcontractors’ activities, data is transferred outside the European Economic Area, Rovensa ensures that such transfers are carried out under one of the mechanisms provided for in Chapter V of the GDPR, namely European Commission adequacy decisions or approved standard contractual clauses, and adopts the additional technical and organizational measures that prove necessary.

Retention Periods

Personal data is retained for the period strictly necessary to fulfill the purposes for which it was collected, namely:

• for marketing and sales purposes, as long as the data subject does not withdraw their consent and, in any case, for a maximum period of 2 years from the last actual contact with the data subject, after which the data will be deleted or anonymized;
• for product development purposes, for a maximum period of 3 years from the date of collection, after which the data will be anonymized for statistical purposes; and
• for longer periods required by law or necessary to safeguard rights in judicial, administrative, or arbitration proceedings.

Data Subject Rights

The data subject may, at any time, exercise the rights set forth in Articles 15 through 22 of the GDPR, namely the rights of access, rectification, erasure, restriction of processing, data portability, and objection, as well as the right to withdraw consent and the right not to be subject to decisions based solely on automated processing that produce legal effects or significantly affect the data subject.

These rights may be exercised by contacting the data controller or the Data Protection Officer (DPO) using the contact information provided in sections 1 and 2.

The data subject also has the right to file a complaint with the National Data Protection Commission (CNPD), located at Av. D. Carlos I, No. 134, 1st Floor, 1200-651 Lisbon (www.cnpd.pt).