Data Protection Policy

1. Preamble

SOMOIL. SOCIEDADE PETROLIFERA, is an Angolan company dedicated to the provision of services associated with the oil, gas and renewable energy sector, bodily injury (work accidents, car accidents and personal accidents) and risk assessment (life insurance) adapted to the values and organizational culture of Angolan insurers and the market where it operates.

Therefore, it is a service company specifically focusing on the management of health insurance contract claims, relying on its own network of health care providers throughout the Angolan territory.

It is a company that recognizes the importance of protecting the right to privacy and the Protection of personal data, per Article 32 of the Constitution of the Republic of Angola and Law No. 22 / 11, of June 17, a law that establishes the legal rules applicable to the processing of personal data in order to ensure the protection of public freedom and fundamental rights and guarantees of individuals.

The protection of Personal Data is a fundamental right, so your privacy is important to Somoil. sociedade Petrolífera. Therefore, we inform about what Personal Data we collect, for what purposes, the principles that guide this use and what rights the owners of this data have.

This Data Protection and Cookies Policy is the document by which, briefly, Somoil. sociedade Petrolífera, provides the relevant information regarding the way in which it processes personal data and how data owners can exercise their rights.

Thus, by means of this policy, owners of personal data may obtain information on how Somoil. sociedade Petrolifera obtains consent and proceeds to collect, store, process and delete personal data of all those who use our platforms and services, whether received directly from you or from third parties, the purpose for which we process personal data and the legal bases for such processing, regardless of the channel or means they use to interact with us.

In strict compliance with the law, Somoil. sociedade Petrolifera has introduced new security practices and improved its internal procedures to ensure the security of the personal data it collects, encouraging its employees, customers and service providers to adopt measures that enable the handling of data in accordance with the law and with high levels of protection and security.

In order to safeguard data protection, and while handling your data, Somoil. sociedade Petrolifera:

• Ensures that Personal Data is processed within the scope of the purpose(s) for which it was collected or for purposes compatible with the original purpose(s) for which it was collected;
• Undertakes to collect only personal data that are relevant, adequate and not excessive in relation to the purposes that legitimated its collection and processing;
• Keeps personal data only for the period necessary to pursue the purposes for which it was collected or processed, and at the end of this period, if there are no legal grounds to do so, deletes or anonymizes it.

SOMOIL. SOCIEDADE PETROLIFERA is transparent about the collection, processing, use and destruction of personal data to which it has access, so that the owners understand the implications underlying the provision of their personal data, as well as their rights under Law No. 22 / 11, of June 17 ("LPDP").

The collection and processing of data may be carried out directly, when Somoil. sociedade Petrolifera requests the elements for the management of a claim or for the execution of a contract, but, as a general rule, it is carried out indirectly, having access only to the necessary data provided by third parties, such as insurance brokers or health service providers. It is the responsibility of said entities to obtain the respective consent from the owners of the data and ensure compliance with Law No. 22 / 11, of 17 June.

Each of the entities is thus responsible, autonomously and independently, for processing the data it collects and obtaining consent for data processing from the data owner.

SOMOIL. SOCIEDADE PETROLIFERA, works in a globalized market and because it has European customers, it follows the best international practices in terms of security and protection of personal data, and commits to abide by and comply with the rules of privacy and protection of personal data, in accordance with the provisions of Regulation (EU) 2016 / 679 of the European Parliament and of the Council of Europe of 27 April 2016 (General Data Protection Regulation), which entered into force in Europe on 25 May 2018.

Therefore, Somoil. sociedade Petrolifera has developed this Privacy Policy in order to affirm its commitment to protect and comply with the rules of privacy and protection of personal data.

SOMOIL. SOCIEDADE PETROLIFERA makes available to the owners of personal data, on a permanent basis, all the information included in this Data Protection and Cookies Policy for verification and exercise of rights by its owners.

When you visit the Somoil. sociedade Petrolifera (SU), LDA. website, or use any of our services, your personal data will be handled as described in this Data Protection Policy.

Use of our website or enjoyment of our services is subject to the terms of this Data Protection and Cookies Policy.

2. Person responsible for processing your Personal Data

The entity responsible for processing your Personal Data is:

SOMOIL. SOCIEDADE PETROLIFERA, an Angolan company dedicated to the provision of services associated with the oil, gas and renewable energy sector, bodily injury (work accidents, car accidents and personal accidents) and risk assessment (life insurance) adapted to the values and organizational culture of Angolan insurers and the market where it operates, through a specialized platform.

The Somoil. sociedade Petrolifera (SU) LDA. Data Protection system is headed by a Data Protection and Privacy Officer, who continuously evaluates the handling process and the need to add new security measures in the handling of personal data.

Work performed on an ongoing basis includes:

• Monitoring the compliance of data processing with the applicable standards, particularly Law No. 22 / 11, of June 17;
• Serving as a contact point for clarification of questions regarding data processing;
• Cooperating with the Data Protection Agency as the overseeing authority.

Personal data is processed for the specific, explicit and legitimate purposes for which it has been collected and may not be further processed in a manner incompatible with those purposes.

Personal data is processed for the specific, explicit and legitimate purposes for which it has been collected and may not be further processed in a manner incompatible with those purposes.

3. Personal data

Personal data is any information of any nature and in any medium (e.g. sound or image) concerning an identified or identifiable natural person (referred to as "data owner"). A natural person who can be identified, directly or indirectly, by name, identification number, location data, electronic identifier or other specific elements of the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person is considered identifiable.

4. Sensitive Personal Data

Sensitive data are all personal data that are subject to specific processing conditions. This includes:

• Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs;
• Genetic data;
• Biometric data processed for the single purpose of identifying a person;
• Health-related data;
• Data concerning a person's sex life or sexual orientation.

5. Data owners

A data owner is any natural person to whom the personal data relates. In the context of the activities of Somoil. sociedade Petrolifera, the following are owners of personal data, among others: The employees of Somoil. sociedade Petrolifera, customers and service providers, members of the management bodies, citizens who contact or send personal data to obtain information or requests for quotations within the scope of the company’s activities.

6. Grounds for Personal Data Processing

• Compliance with legal obligation, legal provision permitting such processing : when processing is necessary for compliance with a legal / juridical obligation.


• Authorization from the Data Protection Agency, in the following situations:
  
  1. Consent of the data owner : when the data owner, or his / her legal representative, has given his / her consent to the processing of his / her personal data, for one or more specific purposes, through express consent, which indicates a freely given, specific, informed and unequivocal expression of will that the data owner consents to the processing of his / her data.
  
  Consent shall be obtained by any means (including electronic), and Somoil. sociedade Petrolifera shall keep a record of the same, as a way to be able to prove that the owner has given his / her consent to the processing of his / her personal data.
  
  The data owner has the right to withdraw his / her consent at any time, and the withdrawal of consent does not compromise the lawfulness of the processing carried out on the basis of the consent previously given.
  
  1. Need to protect the data owner's vital interests : where processing is necessary in order to protect the data owner's or another natural person's vital interests, for example in the event of a medical emergency.


• Public data : The data in question is manifestly made public by its owner.
  
  1. Public interest : the processing of data is, for reasons of public interest, indispensable to the performance of the legal or statutory duties of the entity processing it.

7. Principles regarding the processing of personal data

In the processing of personal data, Somoil. sociedade Petrolifera abides by the following fundamental principles:

• Principle of fairness, lawfulness and transparency : personal data is processed lawfully, fairly and transparently in relation to the data owner;
• Principle of purpose limitation : personal data is collected for specific, explicit and legitimate purposes and not further processed in a way incompatible with such purposes;
• Principle of data minimization : : personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed;
• Principle of accuracy : personal data shall be accurate and updated whenever necessary, and every reasonable step shall be taken to ensure that, considering the purposes for which it is processed, any inaccurate data is erased or rectified without delay;
• Principle of limited storage : personal data will be kept in a form which allows identification of the data owners for only as long as is necessary for the purposes for which the data is processed;
• Principle of integrity and confidentiality : personal data shall be handled in a manner that ensures its security, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, and appropriate technical or organizational measures shall be taken.

As the entity responsible for handling collected data, Somoil. sociedade Petrolifera undertakes to ensure that the processing of data collected from data owners is carried out in strict compliance with the aforementioned principles, and that it is in a position to be able to prove compliance with said principles.

8. Why we process your personal data

Considering the diversity of its areas of activity, Somoil. sociedade Petrolifera processes personal data for the following purposes:

• Financial data – For paying its employees' salaries and purchasing services; managing payments; receiving and processing proposals submitted in connection with procurement procedures; executing contracts with suppliers.
• Contractual procedures – Development of contracts, implementation of the inherent technical procedures. Receipt and processing of requests for IT support;
Data processing and payments to its partners and clinics included in the network of service providers;
• Human Resources – Human resources management (attendance and time management); salary processing; performance evaluation; safety, hygiene and health awareness at work; social benefits for workers;
• Company activities – For performance of its activity and, depending on the purpose for which it is collected at any given time, ADV needs to process some personal data, excluding professional date, relating to natural persons, namely for:
  • Product commercialization - Management of the contractual relationship between customers and Somoil. sociedade Petrolifera (for example, for the purpose of providing clarifications requested regarding prices, procedures and / or possible upgrades of the contracted products); Management and execution of Service provision and Product commercialization; Invoicing, collection and payment management; Customer support; Quality control.
  • Management of the relationship with data owners - Sending the requested information regarding health plans, products and services; management of their contact requests for the provision of information; and management of the subscription to said plans; information contained in surveys submitted by clients regarding Somoil. sociedade Petrolifera services, with personal data associated with products and services. Management of contacts, information or complaints.
  • DTransaction Data - Information relating to transactions, including purchases of goods and / or services, the data owner is involved in and / or through our website or email) which may include contact details, bank card details and transaction details.
  • Compliance with legal obligations - Answering and reporting to judicial authorities (courts), general tax administration, regulation and supervision authorities.
  • Fraud control - Identification and detection of fraud situations.
  • Marketing - Campaigns, promotions and advertising of Somoil. sociedade Petrolifera, taking into consideration the respective legal provisions.

9. Categories of personal data processed by Somoil. sociedade Petrolifera

Somoil. sociedade Petrolifera processes personal data of various nature and sensitivity, and for different purposes, such as, for example:

Personal identification data : name, date of birth, place of birth, gender, nationality, address, telephone number, professional qualifications, e-mail, civil identification number and / or passport, taxpayer number, driver's license number, and social security number;

Family status : marital status, name of spouse, children or dependents, and / or any other information needed to determine salary supplements;

Professional activity : time, place of work, date of hire, position, professional category and experience, pay grade, type of contract, and professional qualification certificate(s);

Financial information : remuneration, supplementary remuneration, variable or lump sum payments, allowances, vacation, attendance, leave, or other information related to supplementary remuneration, amount or rates of compulsory or optional contributions, payment methods, bank name and bank account number (NIB or IBAN), declaration of job compatibility (where applicable);

Special categories of personal data processed within the scope of the company business : Illness, degree of incapacity, possible temporary incapacity as a result of work accidents or occupational diseases, and sick leave.

10. Health data

Some risk coverages to be transferred from the data owner (namely, associated with health insurance, personal accident insurance or others), which fall within the category of special and sensitive data, the presentation, proposal, conclusion or execution of the insurance contract, with the intervention, legal and / or contractual, involve or may involve the processing of data concerning the health of the data owner, whether within the scope of the pre-contractual relationship, for identification, analysis of the proposed risk and setting of contractual conditions, or within the scope of the management of the contractual relationship, use of the insurance coverage, claims management, as well as in contract renewal and amendment processes.

The processing of the data in question, whether in the "processing entity", "subcontractor" or "joint processing entity" capacity, for the purposes indicated above, will be carried out with the consent of the data owner or his / her representative, without prejudice to cases where processing is based on other lawful grounds (such as for the purpose of compliance with legal obligations and the exercise of specific rights, including those of Somoil. sociedade Petrolifera, insurance companies, third parties or of the data owner, in matters of labor law, social security and social protection to the extent that such processing is permitted by Angolan law, rules of the RGDP, and that provides for adequate guarantees associated with said rights. In these cases, acceptance by the Insurers, with the intervention of ADV Angola, of the insurance contract in question depends on the possibility of processing the data regarding the health of the data owner, without which it is impossible to perform the assessment of the proposed risk, execute the insurance contract, transfer the risk, place and accept the intended coverage or even maintain the contract with the Insurers in force.

11. How we collect personal data

Somoil. sociedade Petrolifera may collect data directly (i.e., directly from the data owner) or indirectly (i.e., through third parties). Collection may be done through the following channels:

• Direct collection : in person, by phone, by email, through the company’s platforms (example: Internet), and as a client:
  1. subscribe to the Health Plan, Products and Services that result from the activity of Somoil. sociedade Petrolifera, namely, for example, services in the area of work accidents, automobile accidents, personal accidents and disabilities associated with life insurance, performing the management of clinical processes and respective evaluation of bodily injury in accordance with the legal and contractual terms;
  2. request information about Health Plans, Products and Services, by any means, including our website, telephone contact or others;
• Access and use of the website, online landing pages or other digital products and services;
• Indirect collection : through partners and network of providers.

12. Owners’ rights

SOMOIL. SOCIEDADE PETROLIFERA ensures data owners exercise their rights under applicable legislation in the field of personal data protection, specifically:

• Right to information : the data owner has the right to information about the identity and address of the processing entity, the purposes of data processing, the identification of data recipients or categories of recipients and the reply.
• Right of access : the data owner has the right to obtain confirmation as to whether or not personal data concerning him or her are being processed and, where appropriate, the right to access his / her personal data.
• Right of rectification, updating and deletion : the data owner has the right to request, at any time, the rectification of his / her personal data, as well as the right to have incomplete personal data completed, including by means of an additional declaration.
• Right to erasure (forgetfulness) : the data owner shall have the right to have his / her data erased when one of the following grounds applies: (i) the data owner's data is no longer necessary for the purpose for which it was collected or processed; (ii) the data owner withdraws the consent on which the data processing is based and there is no other legal ground for such processing; (iii) the data owner objects to the processing under the right to object and there are no overriding legitimate interests justifying the processing; (iv) when the data owner's data is unlawfully processed; (v) when the data owner's data must be erased in order to comply with a legal obligation to which Somoil. sociedade Petrolifera or subcontractor is subject to. Under the applicable legal terms, Somoil. sociedade Petrolifera is not obliged to erase the data of the data owner insofar as the processing is necessary for compliance with a legal obligation to which it is subject or for the purposes of the declaration, exercise or defense of a right in a legal proceeding.
• Right to object : the data owner has the right to object at any time, on grounds relating to his / her particular situation, to processing of personal data concerning him / her which is based on the exercise of legitimate interests pursued or where processing is carried out for purposes other than those for which the personal was collected.
• Right to limit processing : The owners of personal data have the right to request the limitation of data processing when: i) They contest the accuracy of the personal data and during a period that allows ADV Angola to attest its accuracy; ii) The processing is illicit and they oppose the erasure of the data; iii) They oppose the processing during the period in which ADV Angola is evaluating the request; iv) Somoil. sociedade Petrolifera does not need to retain the data, but the data is required for the exercise of a right or defense in legal proceedings.

All employees of Somoil. sociedade Petrolifera are obliged and bound to its Personal Data Protection Policy drawn up under the terms of the legislation in force, whereby all processing of personal data which they have to carry out is done within their professional exclusively for professional purposes, and duly included within the scope of their jobs at Somoil. Sociedade Petrolifera. Customers also have the right to lodge complaints with the Data Protection control authority.

13. Exercise of rights by the owner

Rights may be exercised by the owner by contacting Somoil. sociedade Petrolifera, which will respond in writing (including by electronic means) to the owner's request within a maximum period of one month from receipt of the request, except in cases of particular complexity and high number of requests, where this period may be extended to two months.

Somoil. sociedade Petrolifera can be contacted, on matters involving rights, through the following means:

1. Postal Address: Rua Eduardo mondelaine Nr 5 municipio da ingombota Luanda Angola Edifício Luanda
2.1. Email address: dtis@somoil.co.ao

14. Personal data retention period

Personal data is only kept for the period of time needed to accomplish the purposes for which it is processed.

Somoil. sociedade Petrolífera meets the legally established maximum retention period.

The period during which Somoil. sociedade Petrolifera keeps personal data stored and preserved, exclusively in digital format, stems from the purpose for which such data was collected.

In those cases in which the law requires the processing and preservation of data for a minimum period of time, Somoil. Sociedade Petrolifera undertakes to keep the data, exclusively in digital format, only during that same period, namely:

• 5 years for data required by the Tax Authority, for accounting, tax or bookkeeping purposes;
• 7 years for data on combating money laundering and financing of terrorism;
• 5 years for personal data used for marketing purposes, starting on the date of consent or from the last contact made (whichever is the later);
• For as long as obligations arising from a contractual relationship prevail;
• For as long as it remains an enforceable right under the contractual relationship;
• For the time limits resulting from the respective legal obligations.

Whenever there is no specific legal obligation, personal data will be processed only for the period needed to fulfill the purposes for which they it was collected and stored, always in accordance with the law and the guidelines and decisions of the entity in charge of Personal Data Protection at a national level.

Personal data kept in hardcopy format shall be retained for as long as the Client maintains a contractual relationship with Somoil. sociedade Petrolifera, that is, only for the period needed to ensure the fulfillment of obligations related to its activity.

15. Transfer of data to third parties

Somoil. sociedade Petrolifera may have to use third parties (subcontractors) to process data on behalf of Somoil. sociedade Petrolifera in strict compliance with the provisions of national legislation on the protection of personal data and this Privacy Policy.

Subcontractors may not transmit the owners's data to other entities without Somoil. Sociedade Petrolifera's prior written consent, and they are also forbidden to contract with other entities without Somoil. Sociedade Petrolifera's prior written consent.

Somoil. sociedade Petrolifera undertakes to ensure that these subcontractors will only be entities that provide sufficient guarantees of implementation of appropriate technical and organizational measures to ensure the privacy of the owners' data and the protection of their rights.

Transmission of data to subcontractors and third parties

Subcontractors are bound to Somoil. Sociedade Petrolifera through a written contract that includes the purpose and duration of data processing, the nature and purpose of the processing, the type of personal data, the categories of data owners, the rights and obligations of the parties, including the duty of confidentiality, and the security measures to be implemented.

Given the above, Somoil. sociedade Petrolifera, in the course of its business activities, may have to share your personal data with subcontractors or partners (to fulfill contractual obligations), including:

• Health clinics;
• Support service providers, such as secretarial, administrative and financial services, cleaning, maintenance, and security;
• Technical service providers, such as consultants, professional auditors, accountants and lawyers in active service;
• IT service providers, who provide IT and systems support services and communication services providers.
• Commercial transactions related to the business activities of Somoil. Sociedade Petrolífera performed by suppliers / service providers in the area of payments and / or accounting.
• Somoil. sociedade Petrolifera shall share information with suppliers / service providers in the area of payments and / or accounting only to the extent strictly necessary for, inter alia, processing payments, refunding payments, handling invoices and handling complaints or questions related to such payments and refunds.
• SOMOIL. SOCIEDADE PETROLIFERA may also be required to process your personal data when necessary for the enforcement, exercise or defense of legal claims, whether in court proceedings, administrative or out-of-court procedures.

In all of the above cases, Somoil. sociedade Petrolifera undertakes to ensure that such entities are bound by a specific Privacy Policy that is compatible with the Somoil. sociedade Petrolifera Privacy Policy.

For advertising purposes Somoil. sociedade Petrolifera publishes information on social media such as Linkedin and Facebook, after obtaining consent from the owners whenever this disclosure involves personal data such as the owner’s image.

Personal data collected by Somoil. sociedade Petrolifera may also be shared with regulatory authorities, courts and official public bodies in compliance with the law.

Whenever personal information is shared with one of these entities, Somoil. sociedade Petrolifera shall assess the need to obtain, where necessary, the respective consent and shall take all necessary measures and / or actions to confirm that they will perform their job in accordance with the principles of the GDPR.

16. Somoil. sociedade Petrolífera's legal framework

All partners of Somoil. Sociedade Petrolifera through which it operates, especially with regard to its internal and external communication system, reception, use and archiving of data, work tools for the provision of insurance and technological services, and also its ERP (Integrated Business Management System) are covered by the regulation on Data Protection.

They are also bound by Resolution No. 33 / 19, of July 9, which approves, for ratification, the African Union Convention on Cybersecurity and Data Protection - binding on all citizens of the African Union countries that have ratified it, through their respective Personal Data Protection Policies.

SOMOIL. SOCIEDADE PETROLIFERA has notified the Data Protection Agency (DPA) in order to safeguard the protection of the privacy of the personal data it collects and processes, given the need to transfer such processing to some of its external service providers in the course of its business activities.

See Legal Notices here.