Privacy and Data Protection Policy (GDPR)

Last updated: 14/01/2026

The **New Way Box**, operated by **New Wave**, values your privacy and fully complies with the General Data Protection Regulation (**GDPR** - Regulation (EU) 2016/679). This Policy describes how we collect, use, store, and protect your personal data.

1. Personal Data Collected

We collect essential data for the provision of the collection and storage service. The data includes:

• **Identification Data:** Full Name, Email, Phone Contact, and NIF (optional, for invoicing).
• **Service Data:** The **Unique Identification Code** (generated by the system), order history (tracking, reception and pickup dates, status), and paid amounts.

2. Purpose and Legal Basis for Processing

Your data is processed for the following purposes and legal bases:

• **Contract Execution (Legal Basis: Art. 6(1)(b) of the GDPR):** To manage your account, correctly identify your orders, and process pickup and payment. This is the primary and mandatory purpose.
• **Legitimate Communications:** To send transactional notifications (order received, order expired, pickup reminder).
• **Legal Obligation:** For issuing invoices and complying with tax requirements.

3. Data Retention Period

Your data will be retained for the period strictly necessary to fulfill the above purposes, plus the period legally required for tax and archival purposes. Generally, your account and associated order data are kept active while you are a customer. After the termination of the commercial relationship, data is kept for a period of **10 years** (mandatory tax period).

4. Data Subject Rights (GDPR Rights)

As the data subject, you have the right to request, at any time and by written request to geral@newave.pt:

• **Access:** Confirm whether your data is being processed and access it.
• **Rectification:** Correct data that is incorrect or incomplete.
• **Erasure (Right to be Forgotten):** Request the deletion of data, provided there are no legal obligations to the contrary.
• **Limitation:** Limit the processing of your data.
• **Portability:** Receive the data in a structured, commonly used, and machine-readable format.
• **Objection:** Object to the processing of data in certain situations.

5. Data Sharing

Your personal data **is not sold or rented** to third parties. Sharing occurs only in the following cases, and strictly limited:

• **Competent Authorities:** In compliance with legal obligations or court orders.
• **Service Providers (Processors):** Entities that provide us with invoicing, accounting, or hosting services, bound by confidentiality and processing contracts.

6. Cookies

The website uses cookies strictly necessary for the functioning and security of the client area (login session, authentication). We do not use tracking or marketing cookies that require explicit prior consent.

• **Necessary Cookies:** Essential for navigation and access to the reserved area. Without these, the platform would not function correctly.