Privacy Notice
1. Introduction
This Privacy Notice (the “Notice”) sets out how Baby Sisters, Lda., a private limited company with Corporate Tax Identification Number 515.098.370 and registered office at Rua da Eira, n.º 54, 4.º Esq., 1495-233 Algés, hereinafter referred to as “BabySisters”, protects privacy and processes the Personal Data, as defined by the applicable personal data protection legislation, of its employees, clients, partners and any other natural persons with whom BabySisters interacts in the course of its business.
BabySisters is a company that provides childcare, supervision and children's entertainment services, making professionals available to look after children and to run recreational and play activities in hotels, birthday parties and other events that require professionals for childcare and children's entertainment. BabySisters also provides intermediation services for parents and legal guardians who wish to hire babysitting professionals on an occasional or regular basis, as well as training services for professionals who work, or wish to work, in these fields.
In the course of its business, BabySisters collects Personal Data from prospective clients through its digital platforms, as well as data relating to clients, professionals, partners and clients of its clients when it provides services to hotels and other corporate clients, including, where applicable, personal data relating to the identification and health of minors. The latter may include information such as allergies, food intolerances, medication, specific needs or other health information relevant to ensuring the appropriate and safe provision of the services, which will be processed in accordance with Article 9 of the GDPR. To carry out its business, BabySisters may also use external services and providers that involve the processing of Personal Data.
At BabySisters, we are committed to protecting the privacy and confidentiality of Personal Data and to maintaining a controlled environment, including by adopting physical, electronic, human and procedural measures appropriate to the risks associated with the processing operations carried out.
Under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 – General Data Protection Regulation (the “GDPR”), Law no. 58/2019 of 8 August, which implements the GDPR in the Portuguese legal system, and other applicable national personal data protection legislation, as well as the legislation applicable in the other countries where BabySisters provides services, BabySisters is, depending on the processing concerned, the controller of the Personal Data provided to it or collected in the course of its business, namely in its relationship with clients, prospective clients, professionals, partners, clients of clients and minors who receive the services provided by BabySisters (the “Data Subjects”).
By providing Personal Data to BabySisters, Data Subjects acknowledge and accept that it may be processed in accordance with this Notice. Whenever the processing of Personal Data is necessary for entering into or performing a contract, or for taking pre-contractual steps at the Data Subject's request, the processing may be carried out on that basis. In the other cases where the processing depends on the Data Subject's consent, the Personal Data will be collected and processed on the basis of freely given, specific, informed and unambiguous consent, in accordance with the applicable legislation.
Data Subjects may, under the terms and conditions set out in the applicable legislation, exercise the right to erasure of their Personal Data under Article 17 of the GDPR and, where the processing is based on their consent, withdraw that consent at any time under Article 7(3) of the GDPR. Withdrawing consent does not affect the lawfulness of processing carried out on the basis of consent previously given and may, where the Personal Data is necessary to provide a given service, affect BabySisters' ability to provide it.
Not providing certain Personal Data, where it is necessary for entering into or performing a contract, for taking pre-contractual steps or for complying with legal obligations, may prevent or limit BabySisters' ability to provide the services requested. Where the provision of Personal Data depends on the Data Subject's consent, refusing to give that consent may likewise prevent or limit the provision of certain services.
BabySisters may provide its services in different jurisdictions. Whenever the personal data protection legislation of a given country sets additional or more protective requirements than those of Portuguese law, BabySisters will adapt its Personal Data processing practices to the extent necessary to comply with the applicable legislation.
2. What Personal Data do we collect?
Personal Data is any information relating to an identified or identifiable natural person, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to that person's physical, physiological, genetic, mental, economic, cultural or social identity. BabySisters adopts the concept of Personal Data set out in the applicable legislation and, whenever the GDPR applies, the concept established in Article 4 of the GDPR.
The Personal Data we collect and process depends on the nature of the services provided or intermediated by BabySisters and is, in each case, limited to what is necessary for the purposes identified in this Notice.
In the context of babysitting, childcare, supervision and children's entertainment services, BabySisters may process Personal Data of Data Subjects and of the minors who receive the services, namely to properly identify the people involved, to organise and provide the services contracted and to give professionals the information they need to carry them out. Where necessary to ensure the safety and well-being of minors, certain information about their health and specific needs may also be processed. This information may be used, in particular, to allow professionals to take the necessary care or follow the necessary procedures while providing the services and, in emergencies, to contact the emergency services or pass relevant information to health professionals.
Accordingly, depending on the nature of the services and the specific purpose of the processing, we may process the following types of Personal Data:
- Identification data: full name, age or date of birth and other details needed to identify Data Subjects;
- Contact data: home address, postal address, telephone number, email address and other details needed to make contact;
- Financial and payment data: data needed for contracting, invoicing, collection, payment processing and compliance with the applicable accounting and tax obligations;
- Data on children's needs: information on dietary needs, allergies, intolerances, specific needs and other information relevant to the appropriate and safe provision of the services;
- Health data: where necessary for the safe provision of the services, including information on health conditions, medication or other information relevant in emergencies, processed in accordance with Article 9 of the GDPR where applicable; and
- Other relevant Personal Data: any other data needed to provide the services or for a specific purpose, with Data Subjects being informed, where applicable, of the purpose and legal basis of the processing.
Personal Data relating to payments and other financial data may be processed, in particular, for entering into and performing contracts, processing payments, invoicing, collection and complying with legal and tax obligations.
In certain circumstances, we may process special categories of Personal Data within the meaning of Article 9 of the GDPR, in particular Personal Data concerning health. These categories of data will only be processed where there is an applicable condition for lawful processing under Article 9 of the GDPR and other applicable legislation, and only to the extent necessary for the purpose for which the data was collected.
Whenever the processing of special categories of data is based on consent, that consent will be requested expressly, specifically and on an informed basis, in accordance with the applicable legislation. In other cases, the processing may take place where it is provided for or permitted by another applicable condition for lawful processing.
Personal Data relating to minors will only be processed to the extent necessary for the purposes for which it is collected and in accordance with the applicable legislation. Where consent is the legal basis for the processing and the legislation imposes specific requirements regarding the Data Subject's age, consent will be obtained from their legal guardian, as required by law.
Personal Data concerning health or other special categories of data made available in the context of the services may, where necessary and in line with the purpose for which it was collected, be disclosed to the professionals who need to know it to ensure the proper provision of the services and, in emergencies, to the emergency services or health professionals, whenever this is necessary and there is a legal basis for that disclosure.
When our clients contact us for other purposes, we may also collect and process the Personal Data needed to respond to their requests or to provide the services or features requested. For example, we may process Personal Data in connection with competitions or campaigns that clients or other participants have entered, to respond to questions, requests or comments they have sent us, or for other purposes related to our business.
BabySisters may also process Personal Data relating to guests, clients or other users of the services of its corporate clients, where this is necessary to provide the services contracted by those corporate clients.
BabySisters will not use special categories of personal data for purposes incompatible with those for which they were collected, unless there is a legal basis that permits or requires such further processing under the GDPR or other applicable legislation.
3. How do we collect Personal Data?
BabySisters only collects and processes Personal Data in accordance with the applicable personal data protection legislation and with the principles and requirements of the GDPR, where it applies.
We generally collect Personal Data directly from the Data Subjects concerned, namely in the context of the contacts and relationships established with our clients, prospective clients and other users of our services, unless the applicable legislation permits or requires the data to be obtained from another source or this is necessary to provide the services.
Personal Data may be collected directly, in particular, when Data Subjects:
- contact us in person, by telephone, letter or email;
- visit or use our website, including through technologies such as cookies, where applicable;
- contact or interact with us through social media;
- request, contract or ask questions about the services offered by BabySisters;
- take part in competitions, campaigns or promotions;
- sign up to receive marketing communications, including newsletters; or
- request leaflets, information or other materials related to our services.
In the context of babysitting, childcare, supervision and children's entertainment services, we may also collect Personal Data relating to the minors who receive the services and to their legal guardians, including information needed to organise and properly provide the services.
In certain situations, in particular when BabySisters is hired by hotels or other corporate clients to provide childcare, supervision or children's entertainment services to their guests, clients or other users of their services, the Personal Data needed to provide those services may be supplied to us by those corporate clients or by other entities legitimately involved by them in organising the service.
Depending on the circumstances and the nature of the instructions received, BabySisters may act as processor for the corporate client concerned, processing the Personal Data on its behalf and in accordance with Article 28 of the GDPR, or as controller for the processing operations for which it determines the purposes and means of the processing.
The corporate client will be responsible for ensuring that there is an appropriate legal basis for collecting the Personal Data and disclosing it to BabySisters, and for giving Data Subjects the information required by the applicable legislation about the processing of their Personal Data. BabySisters will process the Personal Data made available to it only to the extent necessary to perform the services contracted and, when acting as processor, in accordance with the instructions received from the controller concerned.
Where Personal Data is collected by third parties and subsequently made available to BabySisters, those third parties must ensure that they have an appropriate legal basis for collecting it and disclosing it to BabySisters and that Data Subjects receive the information required by the applicable legislation, including, where necessary, information that their Personal Data may be disclosed to BabySisters.
Where Personal Data is not collected directly from the Data Subject concerned, BabySisters will seek to ensure that Data Subjects receive the information required by Article 14 of the GDPR, including, where applicable, information on the source of the Personal Data. Depending on the circumstances, Personal Data may be obtained from corporate clients, legal guardians, professionals who provide services through or for BabySisters, business partners, entities involved in organising the services or events, or other legitimately authorised sources.
BabySisters may also receive Personal Data from professionals who provide services through or for BabySisters, from business partners, from other entities involved in organising events or providing the services, and from other sources legitimately authorised to make that data available.
BabySisters seeks to ensure that the Personal Data it processes is accurate, complete and up to date and, where applicable, takes reasonable steps to correct or delete inaccurate or outdated data. Data Subjects should, whenever possible, inform BabySisters of any relevant change to their Personal Data or of any inaccuracy they become aware of, using the contact details given in this Notice.
Data Subjects are responsible for the accuracy and updating of the Personal Data they provide directly to BabySisters or to third parties for subsequent disclosure to BabySisters, without prejudice to the obligations of BabySisters as controller or processor under the applicable legislation.
4. How do we process Personal Data?
BabySisters will only process Personal Data where there is an appropriate legal basis for the processing under the applicable legislation. Depending on the purpose of the processing, Personal Data may be processed where:
- the Data Subject has given consent to the processing, which may be withdrawn at any time where legally permitted, as set out in this Notice;
- the processing is necessary for entering into or performing a contract with the Data Subject or for taking pre-contractual steps at their request;
- the processing is necessary to comply with a legal obligation to which BabySisters is subject;
- the processing is necessary to protect the vital interests of the Data Subject or of another natural person, in particular in emergencies, where the processing cannot be based on another applicable legal basis;
- the processing is based on the legitimate interests of BabySisters or of third parties, which may include, as the case may be, managing and improving the services, preventing fraud and misuse, the safety of people and of the services, managing the relationship with clients and professionals, and establishing, exercising or defending legal claims; or
- the processing is permitted or required by another applicable legal provision.
When a prospective client contacts BabySisters to find out about its services or to enter into a contract, the purposes for which the Personal Data is collected will be determined by the nature of the contact and of the service requested. Personal Data may, in particular, be processed to respond to requests for information, take pre-contractual steps, prepare proposals, enter into and perform contracts, and organise and provide the services requested.
In the context of babysitting, childcare, supervision and children's entertainment services, BabySisters may process the Personal Data needed to organise and provide the services contracted, including giving professionals the information they need to carry out the services. Where applicable, professionals may be given information about the children's specific needs, including information about their health, to the extent necessary to ensure the appropriate and safe provision of the services.
When BabySisters is hired by a hotel, company or other event organiser to provide services to its guests, clients, participants or other users, it may receive Personal Data from those entities in order to perform the services contracted. In such cases, as set out in Section 3 of this Notice, BabySisters may act as processor and will process the Personal Data in accordance with the instructions of the controller concerned and under the contract entered into with that controller.
The purposes for which BabySisters may process Personal Data also include:
- providing, organising and managing the babysitting, childcare, supervision and children's entertainment services requested by its clients;
- managing the contractual and commercial relationship with its clients, prospective clients, professionals and partners;
- managing registrations, bookings, orders and other requests related to BabySisters' services;
- invoicing, collection, payment processing and accounting and financial management;
- checking and ensuring the accuracy of the Personal Data processed;
- preventing, detecting and investigating fraud, misuse of the services or other unlawful activities;
- complying with legal, regulatory, administrative or tax obligations applicable to BabySisters;
- developing, assessing and improving the services, procedures and tools used by BabySisters;
- assessing client satisfaction and collecting comments, reviews and feedback on the services provided;
- carrying out analyses and studies related to BabySisters' business, including analysing the needs and preferences of its clients, provided that such analyses are carried out in accordance with the applicable legislation;
- managing the training, qualification and professional relationship with the professionals who provide services through or for BabySisters;
- ensuring the safety of children and of everyone else involved in providing the services, including taking the necessary measures in emergencies;
- establishing, exercising or defending BabySisters' rights in judicial, administrative or arbitration proceedings or other dispute resolution procedures; and
- processing Personal Data for other purposes authorised or required by the applicable legislation.
Where legally permitted, BabySisters may use certain Personal Data for marketing purposes relating to its own services and, where applicable, to third-party services, including sending information about new services, campaigns, promotions or other communications that may be relevant to its clients or prospective clients.
Marketing communications by electronic means, including email, SMS, MMS or other forms of electronic communication, will be sent in accordance with the applicable legislation and, where required, with the recipient's prior consent. Data Subjects may subscribe to newsletters or other marketing communications through the mechanisms made available by BabySisters.
Any Data Subject who does not wish to receive marketing communications from BabySisters may, at any time, exercise the right to object or withdraw the consent previously given, as applicable, through the mechanisms provided in each communication or the contact details given in this Notice.
5. What Personal Data is disclosed to third parties?
BabySisters does not sell, rent or trade Personal Data. Personal Data may, however, be disclosed to third parties where this is necessary to provide the services, to carry out BabySisters' business or to comply with legal obligations, and always in accordance with the applicable personal data protection legislation.
For the purposes of this Notice, references to the “disclosure” of Personal Data include its transmission, sharing, making available or access by another entity or person, by physical or electronic means, to the extent necessary for the applicable purpose.
Personal Data may be disclosed to the following categories of recipients:
- Professionals who provide services through or for BabySisters, including babysitting, childcare, supervision and children's entertainment professionals, where this is necessary to organise and perform the services contracted. Access to Personal Data will be limited to what is necessary to provide the services concerned and will be subject to the applicable confidentiality and security obligations;
- Babysitting professionals who provide services independently, where BabySisters acts as intermediary between those professionals and its clients. In these situations, BabySisters may disclose to the professionals the Personal Data needed to enable contact, hiring and the performance of the services, including, where strictly necessary, information about the child's specific needs or health. Professionals acting independently will, in respect of such processing, act as controllers of the Personal Data they receive and process in the course of providing their services, under the applicable contractual relationship and personal data protection legislation;
- BabySisters' clients, where the disclosure is necessary to provide the services contracted or to organise their relationship with the professionals. In the case of corporate clients, including hotels, companies or event organisers, the disclosure may include the Personal Data needed to organise and perform the childcare, supervision and children's entertainment services;
- Service providers and suppliers hired by BabySisters, including providers of information technology, hosting and data storage services, management platforms, communication systems, IT maintenance and support services and other suppliers that need to process or access Personal Data to provide their services to BabySisters;
- Payment service providers, financial institutions and other providers involved in payment processing, where necessary to make or receive payments, process transactions, prevent fraud or comply with legal or regulatory obligations;
- Professional service providers, including lawyers, accountants, auditors, consultants and other providers that need access to Personal Data to provide services to BabySisters;
- Communication, postal and delivery service providers, where necessary to send correspondence, documents or other communications;
- Marketing, advertising or market research service providers, where such processing is permitted by the applicable legislation and, where necessary, with the Data Subject's consent;
- Other entities or persons involved in organising events or providing the services, where the disclosure of Personal Data is necessary to perform the services contracted;
- Persons or entities authorised by the Data Subject, including legal guardians or other persons legitimately acting on their behalf;
- Public authorities, regulators, police and judicial authorities or other competent bodies, where the disclosure is required or permitted by the applicable legislation, in particular to comply with legal obligations, court decisions or legally valid requests;
- Third parties involved in preventing, detecting or investigating fraud, offences or other illegal activities, where such disclosure is necessary and legally permitted; and
- Other third parties, where the disclosure is necessary to establish, exercise or defend BabySisters' rights, to protect the safety or rights of BabySisters, of Data Subjects or of third parties, or where it is otherwise authorised or required by the applicable legislation.
In the context of babysitting, childcare, supervision and children's entertainment services, disclosing certain Personal Data to the professionals who will provide the services may be essential for their appropriate and safe performance. Where necessary, information about the child's specific needs may be disclosed, including information about their health, to the extent necessary to allow the professional to provide the service appropriately and safely and provided there is a legal basis for the processing and disclosure under the applicable legislation, including, where applicable, Article 9 of the GDPR.
Where BabySisters acts as intermediary between a client and an independent babysitting professional, the disclosure of Personal Data between those parties is an integral part of the intermediation service. BabySisters will only disclose the Personal Data needed to enable identification, contact, hiring and performance of the services between the parties. Where health information or other special categories of personal data are needed for the safe provision of the services, their disclosure will be limited to what is strictly necessary and will only take place where there is an applicable condition for lawful processing under Article 9 of the GDPR and other applicable legislation.
Where BabySisters uses service providers that process Personal Data on its behalf, the necessary measures will be taken to ensure that those providers process the Personal Data in accordance with BabySisters' instructions, the agreed purposes and the obligations set out in the applicable legislation, including, where applicable, by entering into contracts under Article 28 of the GDPR.
Where the disclosure of Personal Data to a third party is necessary to perform a contract or to provide a service requested by the Data Subject, that disclosure may take place without additional consent where there is another applicable legal basis. Where consent is required as the legal basis for the disclosure, it will be requested in accordance with the applicable legislation.
BabySisters may also disclose Personal Data where this is necessary to protect a person's life, physical integrity or safety, in particular in emergencies involving a child or another Data Subject, or where this is necessary to comply with a legal obligation or to protect the rights and legitimate interests of BabySisters or of third parties, in accordance with the applicable legislation.
BabySisters will not disclose Personal Data to third parties for purposes incompatible with those for which the data was collected, unless there is a legal basis that permits or requires such further disclosure.
6. International transfers of Personal Data
In the course of its business, BabySisters uses certain service providers and technology tools which may, depending on their location, configuration or the services contracted, process Personal Data outside the European Economic Area (“EEA”).
BabySisters may therefore transfer Personal Data to, or allow it to be accessed by, entities located in third countries, or allow its service providers to carry out processing operations in those countries, where this is necessary for the purposes described in this Notice, in particular to provide, maintain and secure its services and technology systems.
Where Personal Data is transferred to a third country or an international organisation, BabySisters will ensure that the transfer complies with Chapter V of the GDPR and that there is a valid transfer mechanism under the applicable legislation.
Depending on the circumstances, international transfers may be based, in particular, on an adequacy decision adopted by the European Commission for the country or territory of destination, on appropriate safeguards, including Standard Contractual Clauses approved by the European Commission, or on another of the conditions set out in the GDPR.
BabySisters will seek to ensure that the service providers that process Personal Data on its behalf adopt appropriate measures to protect that data and comply with the applicable data protection and information security obligations.
Data Subjects may contact BabySisters using the contact details given in Section 12 of this Notice for further information on international transfers of Personal Data and, where applicable, on the safeguards used for them and how to obtain a copy of those safeguards or find out where they have been made available.
7. Information security
BabySisters is committed to protecting the Personal Data it processes and, to that end, implements and maintains appropriate technical, organisational and, where applicable, human measures to ensure a level of security appropriate to the risks associated with the processing of Personal Data.
These measures are intended, in particular, to protect Personal Data against:
- accidental or unlawful destruction, loss or alteration;
- unauthorised disclosure or making available; and
- unauthorised access to Personal Data transmitted, stored or otherwise processed by BabySisters.
The security measures adopted by BabySisters take into account the nature, scope, context and purposes of the processing carried out, as well as the risks it may pose to the rights and freedoms of Data Subjects. BabySisters seeks to ensure, where applicable, the confidentiality, integrity, availability and resilience of the systems and services used to process Personal Data.
BabySisters periodically monitors and reviews its security measures and procedures and, where necessary, updates or improves them, taking into account changes in risks, available technologies and its processing activities.
Access to Personal Data is limited to the people who need it to perform their duties or to provide the applicable services, in line with their respective responsibilities and authorisations, and is subject to the applicable confidentiality and security obligations.
Retention of Personal Data
BabySisters will only retain Personal Data for as long as necessary for the purposes for which it was collected and processed, or for the periods required or permitted by the applicable legislation.
The retention period may vary according to the nature of the Personal Data, the purpose of the processing and any applicable legal or regulatory obligations. In determining retention periods, BabySisters will take into account, in particular, the duration of the contractual or pre-contractual relationship, the applicable legal time limits, the need to retain information for establishing, exercising or defending legal claims in judicial or out-of-court proceedings and, where applicable, the period during which consent to the processing remains valid.
Once the applicable retention period has ended, Personal Data will be deleted or anonymised, unless its retention is necessary to comply with a legal obligation or to establish, exercise or defend legal claims, or the applicable legislation requires or permits its retention for an additional period.
8. Rights in relation to the Personal Data we collect
Data Subjects have a number of rights in relation to their Personal Data under the GDPR and the applicable legislation. BabySisters seeks to ensure that these rights can be exercised simply and transparently.
The applicable rights may vary depending on the nature of the processing, the legal basis used and the specific circumstances. Some of the rights described below may therefore be subject to limitations or not apply in certain situations.
8.1. Right of access
Under Article 15 of the GDPR, Data Subjects have the right to obtain confirmation as to whether BabySisters processes their Personal Data and, if so, to access that data and certain information about its processing.
This right allows, in particular, Data Subjects to know which Personal Data is processed, for what purposes, for how long it will be retained, which categories of data and recipients are involved and, where applicable, which rights can be exercised in relation to the processing.
Data Subjects may also request a copy of the Personal Data processed by BabySisters.
8.2. Right to rectification
Under Article 16 of the GDPR, Data Subjects have the right to request the correction of inaccurate Personal Data and the completion of incomplete Personal Data.
BabySisters recommends that Data Subjects keep their Personal Data up to date and report any change or inaccuracy they become aware of.
8.3. Right to erasure of Personal Data
Under Article 17 of the GDPR, Data Subjects may, in certain circumstances, request the erasure of their Personal Data, in particular where the data is no longer necessary for the purposes for which it was collected or where the processing is based on consent that has been withdrawn and there is no other legal basis for the processing.
This right is often referred to as the “right to be forgotten”.
The right to erasure is not, however, absolute. BabySisters may need to retain certain Personal Data, in particular to comply with legal obligations, to establish, exercise or defend legal claims or for other reasons set out in Article 17 of the GDPR.
8.4. Right to restriction of processing
Under Article 18 of the GDPR, Data Subjects may, in certain circumstances, ask BabySisters to restrict the processing of their Personal Data.
Restriction means that the data may remain stored, but its processing is restricted to certain purposes or situations provided for by law. This right may be exercised, for example, while the accuracy of Personal Data contested by the Data Subject is being verified.
8.5. Right to data portability
Under Article 20 of the GDPR, where the processing is based on consent or is necessary for the performance of a contract and is carried out by automated means, Data Subjects may, under the conditions set out in that article, request the Personal Data they have provided to BabySisters in a structured, commonly used and machine-readable format.
Where technically feasible and legally applicable, Data Subjects may also request that this data be transmitted directly to another controller.
This right does not apply to all Personal Data or to all processing carried out by BabySisters.
8.6. Right to object
Under Article 21 of the GDPR, Data Subjects may, in certain circumstances, object to the processing of their Personal Data.
Where the processing is based on the legitimate interests of BabySisters or of third parties, the Data Subject may object to the processing on grounds relating to their particular situation. In such cases, BabySisters will stop processing the Personal Data unless it demonstrates compelling legitimate grounds that override the interests, rights and freedoms of the Data Subject, or the processing is necessary to establish, exercise or defend legal claims.
The right to object applies particularly clearly to the processing of Personal Data for direct marketing purposes. Under Article 21(2) of the GDPR, Data Subjects have the right to object at any time to the processing of their Personal Data for that purpose, including profiling related to direct marketing. In that case, BabySisters will stop processing the Personal Data for those purposes.
8.7. Right to withdraw consent
Where the processing of Personal Data is based on the Data Subject's consent, they may withdraw that consent at any time under Article 7(3) of the GDPR.
Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal. In addition, withdrawing consent does not necessarily prevent BabySisters from continuing to process the Personal Data where there is another legal basis that permits or requires such processing.
Where certain Personal Data is necessary to provide a service and there is no other applicable legal basis for its processing, withdrawing consent may prevent or limit BabySisters' ability to provide that service, or may affect the way it is provided.
8.8. Automated decision-making
BabySisters does not make decisions based solely on automated processing, including profiling, that produce legal effects concerning Data Subjects or similarly significantly affect them, within the meaning of Article 22 of the GDPR.
8.9. Right to lodge a complaint
Under Article 77 of the GDPR, Data Subjects have the right to lodge a complaint with the competent supervisory authority if they consider that the processing of their Personal Data infringes the GDPR or other applicable data protection legislation.
In Portugal, the competent supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese Data Protection Authority.
8.10. How to exercise your rights
Requests to exercise the rights described above should be made using the contact details given in Section 12 of this Notice.
BabySisters will respond to requests without undue delay and in any event within one month of receipt of the request, in accordance with Article 12(3) of the GDPR. This period may be extended by a further two months where necessary, taking into account the complexity and number of requests, in which case BabySisters will inform the Data Subject of the extension and the reasons for it within the first month.
BabySisters may request additional information reasonably necessary to confirm the identity of the requester, in particular where there are reasonable doubts about the identity of the person making the request. This is intended to prevent Personal Data from being disclosed to unauthorised persons.
Exercising the rights provided for in the GDPR is, in principle, free of charge. However, under Article 12(5) of the GDPR, BabySisters may charge a reasonable fee taking into account the administrative costs where a request is manifestly unfounded or excessive, in particular because of its repetitive character, or may refuse to act on the request in the cases permitted by the GDPR.
If BabySisters decides not to act on a request, it will inform the Data Subject without delay and at the latest within one month of receipt of the request of the reasons for that decision and of the possibility of lodging a complaint with a supervisory authority or seeking a judicial remedy.
9. IP addresses
When a user accesses the BabySisters website, the servers and systems used to provide the website may record certain information about the device used and the Internet connection, including its IP address.
An IP address is an identifier assigned to a device or Internet connection to enable communication over a network. Depending on the circumstances, an IP address may constitute Personal Data for the purposes of the GDPR.
BabySisters may process IP addresses and other technical information strictly related to the use of the website for the operation, maintenance and security of the website and of the systems used by BabySisters, in particular to detect and prevent unauthorised access, fraudulent activities or other misuse, diagnose technical problems and ensure the proper functioning and security of its digital services.
11. Third-party websites and services
BabySisters' websites and digital services may contain links to third-party websites or other digital services that are not operated or controlled by BabySisters.
BabySisters is not responsible for the privacy practices, content or security measures of those third parties, which may process Personal Data in accordance with their own policies and terms.
We recommend that Data Subjects read the privacy policies and other information provided by third parties before providing Personal Data or using their websites or digital services.
Including a link to a third-party website or service does not in itself imply any recommendation, endorsement or association by BabySisters with that third party or its privacy practices.
12. Contacts and complaints
Any questions, comments or complaints about this Notice or about the processing of Personal Data by BabySisters, as well as any requests to exercise the rights of Data Subjects under the GDPR, should be sent to BabySisters using the following contact details:
Email for data protection matters: joana.durao@babysisters.pt
Address: Rua da Eira, n.º 54, 4.º esq., 1495-233 Algés, Portugal
Data Subjects may use these contact details, in particular, to:
- request information about the processing of their Personal Data;
- exercise the rights set out in Section 8 of this Notice;
- report the need to update or correct their Personal Data;
- raise questions or complaints about the processing of their Personal Data; or
- raise any other questions related to privacy and Personal Data protection.
BabySisters will seek to respond to the questions and complaints received as soon as possible and within the time limits set out in the applicable legislation.
Online Complaints Book (Livro de Reclamações): https://www.livroreclamacoes.pt/Inicio/
13. Changes to this Notice
This Notice may be updated periodically to reflect changes in the Personal Data processing activities carried out by BabySisters, in the applicable legislation, in the services provided or in the data protection measures and procedures adopted by BabySisters.
Whenever this Notice is changed, the updated version will be made available on the BabySisters website, stating the date of the update.
Where a change introduces new processing of Personal Data that requires the Data Subject's consent, BabySisters will request that consent before carrying out the processing, where required by the applicable legislation. Where there is another legal basis that permits the processing, BabySisters may carry out the processing on that basis, without prejudice to the information that must be given to Data Subjects under the GDPR.
Data Subjects are advised to check this Notice periodically to stay informed about how BabySisters processes their Personal Data.
This Privacy Notice was last updated on 19 August 2026.