Privacy statement
1. Who is responsible
With this privacy statement, BREA informs you about how personal data is handled within its organisation. It processes your personal data as part of its administration and is responsible for doing so. BREA ensures that the personal information you provide is treated confidentially as stipulated in the General Data Protection Regulation (GDPR), a European regulation that replaced the earlier national data protection laws.
BREA is registered in Portugal under the name Brain Rehabilitation EA, Unipessoal LDA as a sociedade por quotas, NIPC 519590074, address Rua de Cima de Santana 11B, 9940-213 Santo António, São Roque do Pico, Azores, Portugal, telephone +351 917 042 516, email info@brea.biz.
You can reach us by using the contact form.
2. Which data is being processed
BREA processes personal data received from you or your employer.
- When you order
- The buyer’s name, email address, telephone number, company name, tax number and billing address, and the delivery address for physical products; what was ordered, what it cost, and how it was paid for.
- When registering
- The participant’s name, and their email address, telephone number and discipline, and their company if given. We add what belongs to the training itself: attendance, any result achieved, and the certificate issued.
- When you write to us
- Your name, email address, the organisation, and the message itself.
- When you ask to be told about something
- Your email address, and which training or product it was about. If you sign up on the homepage to hear about new courses and dates, also your name, your discipline and any note you add.
- When you pay
- Card details are entered on our payment provider’s own page. BREA never receives or stores them; we receive only the fact that the payment succeeded, and a reference for it.
3. Why do we process it
BREA uses your personal data for the following purposes:
- The registration and administrative processing of your participation in the training you have chosen.
- Providing a training of your choice.
- Processing and shipping your order.
- To conduct analyses to improve service delivery.
- To provide you with the information you have requested and to respond to your questions.
- To comply with laws and regulations applicable to BREA.
We use personal data for nothing else without asking you first. There is no profiling and no automated decision-making.
4. Who else can see it
BREA does not sell personal data. We only share it with the parties that make an order happen, and only with what they need:
- Stripe
- Takes online payments. You are on Stripe’s own page while you pay, and Stripe processes your payment details as controller for that.
- Resend
- Delivers our email — order confirmations, bank transfer details, cancellations. It processes the recipient address and the content of the message on our instructions.
- Cloudflare
- Hosts this website and the database behind it.
- The carrier
- For a physical order, the delivery address is passed to the carrier.
- Our accountant
- Sees invoices, because the law requires them to be processed and filed.
- iSCR
- The CPCRT commission of the iSCR evaluates the information you send in for the certification process.
Everyone working for BREA, and every party we engage, is bound to keep your data confidential. Where a provider processes data outside the European Economic Area, that transfer rests on the European Commission’s standard contractual clauses.
5. How long do we keep it
We do not keep personal data longer than we need it.
- Orders, invoices and payments
- Ten years, which is the period Portuguese tax law requires for accounting records.
- Attendance, results and certificates
- Seven years, so that a certificate can be reissued and an accreditation checked.
- Messages you send us
- Until the conversation ends.
- A request to be told about new courses or dates
- Until you unsubscribe.
6. Keeping it safe
The site is served over an encrypted connection. Access to the administration is limited to the people who need it, and protected by individual accounts. Payment keys and other access keys are stored encrypted, and are never displayed once saved. We review these measures periodically.
7. Data you give us about other people
If you book places for other people, you give us their names, email addresses, telephone numbers and disciplines and, where you have it, their company. You confirm when you do so that you may, and that you have told them BREA is processing their data for that training. We use it only to run the training and to issue their certificate.
8. What are your rights under privacy legislation
You have the right to access, correct and delete your personal data, and to restrict or object to its processing. You may also request your personal data, and BREA is committed to providing it to you (data portability). Some data we cannot delete on request, because the law obliges us to keep it — an invoice, for instance — and we will tell you when this is the case. You have the right to withdraw your consent for the use of your personal data at any time. To use these rights, use the contact form; we answer within one month.
Naturally, we are happy to assist you if you have complaints regarding the processing of your personal data. However, should you still be unable to resolve the matter with us, you also have the right under privacy legislation to lodge a complaint with the privacy supervisory authority. In Portugal that is the Comissão Nacional de Proteção de Dados.
9. Cookies
This site sets no cookies at all, and there is no tracking on it. The cookie statement explains what it does instead, and why your shopping basket survives a reload without one.
10. Changes to this statement
We may amend this statement when the way BREA works changes. The date at the top tells you when it was last revised.