| Version | Date | Author | Summary of changes | Approved by |
| 1.0. | 12-02-2026 | Bruno Belchior | Document creation (with external legal counsel, Morais Leitão). | João Fezas Vital (24/03/2026) |
The General Data Protection Regulation (“GDPR”) sets out a series of obligations designed to ensure the transparency and lawfulness of the processing of personal data by controllers and their respective processors.
In particular, the GDPR requires controllers to provide data subjects with clear, accessible and complete information on how their personal data are processed, ensuring they understand the purposes, legal bases, retention periods, categories of recipients, as well as the rights available to them.
Sugal Group values privacy and the protection of personal data and is committed to making all necessary information available in a transparent and accurate manner and in accordance with applicable legislation. In this respect, this Privacy Policy is intended to ensure that the information provided to data subjects fully complies with the GDPR and other relevant data protection rules.
Identification of the controller
The companies of Sugal Group ([1]) registered in European Union countries collect and process personal data in their capacity as controller.
For the exercise of the rights provided for in this document, in your capacity as data subject, or for any matter related to personal data protection, privacy or information security, you may contact Sugal Group through the following means:
Email: privacidade@sugal-group.com; and/or
Postal address:
| Company | Identification no. | Postal Address |
| Sugal – Alimentos, S.A. | 500277230 | Fonte das Somas, Apartado 6 2131-901 Benavente Portugal |
| Orfrutal – Comércio e Serviços, S.A. | 510881904 | Lugar da Fonte das Somas 2130-011 Benavente Portugal |
| CIFO – Sociedade de Fomento Agrícola, Lda | 503385417 | Apartado 144 2131-901 Benavente Portugal |
| S Agro, Unipessoal Lda | 516874500 | Fonte das Somas 2130-010 Benavente Portugal |
| Ag – Innov Coe, A.C.E. | 515672360 | Fonte das Somas 2130-010 Benavente Portugal |
| Sugal Andalucía, S.L.U. | B-86/093.721 | Carretera de la Estación, Km 3,5 41730 Las Cabezas de San Juan (Sevilla) España |
| Docelicia S.L.U. | B-86237435 | Carretera de la Estación, Km 3,5 41730 Las Cabezas de San Juan (Sevilla) España |
| Sugal B.V. | 55591027 | Weesperstraat 61 1018VN Amsterdam Netherlands |
For this purpose, you should indicate— briefly—the Sugal Group company, the subject matter at issue, and provide an email address, a telephone number or a postal address so that Sugal Group can respond to your enquiry.
Definition of personal data
Personal data means any information relating to an identified or identifiable natural person, regardless of its nature or medium (physical, audio or visual).
An identifiable natural person is one who can be identified, directly or indirectly, specifically by reference to an identifier such as a name, an identification number, location data, online identifiers, or to one or more factors specific to that natural person’s physical, physiological, genetic, mental, economic, cultural or social identity.
What categories of personal data we process
| Data | Examples |
| Identification and contact data | Name, Tax Identification Number, address, email address, telephone number. |
| Data arising from the contractual relationship | Business address, job role, process references (e.g., booking / bill of lading (B/L) number), content of communications, content of complaints and evidence/documents (e.g., emails and notes), record of interactions, change history (logs), transaction and contract history. |
| Browsing data | Internet browser, operating system, internet service provider, IP address, generic consent, user preferences (font, colour themes or other site settings), date and time of access. |
| Banking data | IBAN. |
Lawful bases and purposes of processing personal data
All personal data processing carried out by Sugal Group is lawful and based on valid lawful bases. Accordingly, Sugal Group may process your personal data in the following situations:
The provision of certain personal data (namely identification and contact data and banking data) is a necessary requirement for entering into a contract with Sugal Group, and failure to provide such data may prevent the conclusion or performance of the relevant contract.
Sugal Group processes personal data for specified, explicit and legitimate purposes, and such data may not subsequently be processed in a manner incompatible with those purposes, save in circumstances expressly permitted or required by law. Accordingly, Sugal Group processes only the personal data that is strictly necessary for the purposes indicated below and on the lawful bases mentioned therein.
Furthermore, Sugal Group retains data subjects’ personal data only for the period necessary to fulfil the purposes for which it is collected, as indicated in the table below, limiting its processing to what is strictly necessary.
| Lawful Bases | Purposes | Description | Storage Periods |
| Consent (recording of Microsoft Teams meetings) Performance of the contract Legitimate interests (in commercial management and service quality) | Management of relationships with customers (B2B) | Management of contacts and interaction history with representatives of customers (B2B) in SAP/Outlook for the execution and follow up of requests, orders and after sales service. | 2 years after the end of the relationship. Documents with tax/contractual value: up to 10 years. |
| Consent Legitimate interests (in ensuring the operation, management and improvement of the website) | Website management and improvement | Collection of data through cookies to improve website functionality and user preferences. | For essential cookies: during the session. For consent-based cookies: 1 year. |
| Compliance with a legal obligation Performance of the contract | Management of communications and interactions with customers | Exchange of information by email/portals/telephone for bookings, export/import documents and clarifications with customers and authorities. | 5 years (operational). Customs/tax documentation: up to 10 years. |
| Compliance with a legal obligation Legitimate interests (service improvement and defence of rights) | Recording and handling of complaints and information requests (Customer Service – SAC) | Receipt, analysis and response to complaints/requests via email, portals and the Complaints Book; recording of actions and history. | Complaints Book: 3 years after closure. Litigious cases: until expiry of the statutory time limits. Other contacts: applicable limitation period. |
| Consent Performance of the contract Legitimate interests (in operational coordination) | Management of contacts for freight forwarders and shipping lines (transport partners) | Management of contact details and professional data of contacts at freight forwarders/shipping lines for the planning and execution of transports. | 2 years after the end of the contractual relationship. |
| Compliance with a legal obligation Performance of the contract Legitimate interests (in ensuring service quality and the establishment, exercise or defence of legal claims) | Transport – Recording and handling of complaints and information requests (transport) | Recording, analysis and response to complaints and requests about transport (delays, damage, documentation). | 3 years after closure. Litigious cases: until expiry of the statutory time limits. |
| Compliance with a legal obligation Performance of the contract Legitimate interests (in ensuring the integrity and security of operations) | Supplier management | Managing contractual and commercial relationships with suppliers, including qualification, assessment, maintenance of data and compliance with legal and tax obligations. | 10 years after termination of the contract. |
| Legitimate interests (brand promotion) | Sending products linked to marketing campaigns (giveaways or competitions aimed at end consumers) | Collection of consumer data to send products related to competitions on social networks. | For the time necessary to deliver the product or to manage the specific campaign. |
| Legitimate interests (in developing the contractual relationship and capturing prospective customers) | Receipt, management and response to contacts | Receipt and response to contacts from customers, prospective customers and suppliers. | 5 years. |
| Performance of the contract Compliance with a legal obligation Legitimate interests (in preventing errors and fraud and ensuring efficiency) | Creation and maintenance of “business partner” records (customers, suppliers, employees) | Managing data necessary to establish commercial relationships, ensure the integrity of master data and enable financial, logistics and contractual operations. | 10 years after termination of the contract. |
| Legitimate interests (in ensuring the protection of people and property) | CCTV system | Capturing and recording images by cameras positioned in security critical areas to protect people and property. | 30 days after capture (deletion within 48 hours after expiry). Longer retention when permitted to investigate an incident or upon request of the competent authority. |
Right to Information — Articles 13 and 14 GDPR
The data subject has the right to be informed about the processing of their personal data, under Articles 13 and 14 GDPR. The information to be provided differs depending on whether the personal data were collected directly from the data subject (Article 13 GDPR) or indirectly from another source (Article 14 GDPR).
Right of Access — Article 15 GDPR
The data subject has the right to obtain confirmation as to whether personal data concerning them are being processed. If so, the data subject has the right to access their personal data and to obtain information, namely about the purposes of processing, the recipients or categories of recipients of the data, retention periods, the rights available to them, the source of the personal data and, where applicable, the existence of automated decision making and the carrying out of international transfers.
The controller must provide a copy of the personal data undergoing processing. Where the data subject makes the request by electronic means, the information must be provided in a commonly used electronic format, unless the data subject requests otherwise. The right to obtain a copy must not adversely affect the rights and freedoms of others.
For further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where a data subject’s requests are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may charge a reasonable fee considering the administrative costs of providing the information or communication or taking the requested action or may refuse to act on the request.
Right to Rectification — Article 16 GDPR
The data subject has the right to obtain from the controller, without undue delay, the rectification of inaccurate personal data concerning them. Considering the purposes of the processing, the data subject also has the right to have incomplete personal data completed.
Right to Erasure (Right to be Forgotten) — Article 17 GDPR
The data subject has, under the conditions laid down in the GDPR, the right to obtain the erasure of their personal data without undue delay.
Right to Restriction of Processing — Article 18 GDPR
The data subject has, under the conditions laid down in the GDPR, the right to obtain the restriction of processing. This right allows the data subject, for a given period, to have the processing of their data limited to mere storage.
Right to Data Portability — Article 20 GDPR
The data subject has, under the conditions laid down in the GDPR, the right to receive the personal data concerning them which they have provided to Sugal Group, in a structured, commonly used and machine-readable format, and the right to transmit those data to another controller.
In exercising the right to data portability, the data subject has the right to have the personal data transmitted directly from one controller to another, where technically feasible.
Right to Object to Processing — Article 21 GDPR
The data subject has, under the conditions laid down in the GDPR, the right to object at any time to the processing of their personal data, in which case Sugal Group shall cease processing unless it demonstrates compelling and legitimate grounds for the processing which override the data subject’s interests, rights and freedoms, or where the processing is necessary for the establishment, exercise or defence of legal claims.
The data subject has the right to object at any time, without the need for justification, to the processing of personal data for direct marketing purposes, if applicable, including profiling related to such marketing, in which case Sugal Group shall cease processing.
Right not to be Subject to Automated Individual Decision Making, including Profiling — Article 22 GDPR
Where applicable, the data subject has, under the conditions laid down in the GDPR, the right not to be subject to any decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.
In addition to the rights mentioned above, data subjects also have: (i) the right to withdraw their consent at any time, where consent is the lawful basis for the processing, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal; and (ii) the right to lodge a complaint with a supervisory authority:
To exercise the rights set out in this document as a data subject, or for any question related to personal data protection, privacy or information security, you may contact Sugal Group through the following channels:
For this purpose, you should indicate—briefly—the subject matter and provide an email address, a telephone number or a postal address so that Sugal Group can respond to your enquiry.
Disclosure of personal data to third parties
Sugal Group is committed to protecting data subjects’ privacy and personal data in accordance with the applicable legal provisions.
Sugal Group may disclose personal data to third parties where such disclosure is lawful, namely when: (i) it is necessary for the performance of a contract concluded with the data subjects; (ii) it is necessary to comply with legal or regulatory obligations; (iii) it is necessary for reporting to regulatory bodies or in legal proceedings in which Sugal Group defends its rights and legitimate interests; (iv) it is based on a legitimate interest of Sugal Group or a third party; or (v) it is authorised by the data subject.
Sugal Group may transfer personal data to third parties acting as processors, on its behalf and under its instructions. Sugal Group always ensures compliance with the applicable personal data protection rules, particularly those arising from the GDPR, ensuring that it uses only processors that provide sufficient guarantees to implement appropriate technical and organisational measures so that the processing complies with the requirements of the applicable data protection legislation and ensures a level of security appropriate to the risk. Such guarantees and obligations are always set out in a contract between Sugal Group and each of those third parties.
Specifically, and under certain conditions, your personal data may be shared with the following categories of recipients: web analytics platforms (such as Google Analytics) and advertising/social media platforms (such as Meta and Google Ads), transport companies, social media agencies, IT suppliers, other Sugal Group entities, consultants, freight forwarders, shipping lines, legal advisers, and audit service providers.
Additionally, Sugal Group may need to provide personal data to banks and insurers, as well as to public authorities and bodies, customs and tax authorities, and regulatory and supervisory authorities.
This Privacy Policy may be updated periodically, and you are therefore advised to consult it regularly.
Whenever material changes are made to this Privacy Policy—particularly changes affecting the purposes for which Sugal Group processes data subjects’ personal data—Sugal Group will ensure specific communication about such changes, using one or more communication channels established with you.
[1] This policy applies to the following entities: Sugal – Alimentos, S.A.; Orfrutal – Comércio e Serviços, S.A.; CIFO – Sociedade de Fomento Agrícola, Lda; S Agro, Unipessoal Lda; Ag – Innov Coe, A.C.E.; Sugal Andalucía, S.L.U.; Docelicia S.L.U.; Sugal B.V..
Sugal Group