Privacy Policy

This Privacy Policy describes how Multimac Hito Innovation, S.A. processes the personal and business data collected through the online store available at loja.multimac.pt (the "Store"), in the context of submitting operating renting proposals to the financial institution GRENKE.

Multimac Hito Innovation, S.A. is committed to protecting the privacy and data of its clients and users, in compliance with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR"), Portuguese Law no. 58/2019 of 8 August, and other applicable legislation.

1. Data controller

The controller responsible for the processing of personal data is:

• Name: Multimac Hito Innovation, S.A.
• Tax number (NIPC): 500685908
• Registered office: Azinhaga da Cidade 60, 1750-065 Lisbon, Portugal
• Email: geral@multimac.hito.pt
• Telephone: +351 21 81 61 360
• Presence: Lisbon, Porto, the Algarve and the Centro region

Data Protection Officer (DPO)

For any matter relating to the processing of your personal data, you may contact the Data Protection Officer at:

• DPO email: dpo@multimac.hito.pt [to confirm - appointment and contact details of the DPO]

2. Categories of data processed

In the context of the use of the Store and the submission of renting proposals, Multimac processes the following categories of data:

• Company identification data: company name, tax number (NIF/NIPC).
• Contact data: email, telephone, billing address and delivery address.
• Banking data: IBAN, for the purpose of instructing the renting proposal to GRENKE.
• Contact person data: name and, where applicable, role/position of the company representative.
• Browsing data: IP address, device identifiers, cookies and similar technologies (see the Cookie Policy).

The Store is intended exclusively for business clients (B2B). It is not intended to collect data from minors or special categories of personal data.

3. Purposes and legal bases

Data is processed for the following purposes, with the corresponding legal bases:

Purpose	Legal basis (GDPR)
Performance of pre-contractual steps and submission of a renting proposal to GRENKE, at the request of the data subject	Art. 6(1)(b) - pre-contractual steps
Compliance with legal obligations (tax, accounting, anti-money laundering)	Art. 6(1)(c) - legal obligation
Management of the business relationship, platform security, fraud prevention and service improvement	Art. 6(1)(f) - legitimate interest
Use of non-essential cookies and marketing communications	Art. 6(1)(a) - consent

Where processing is based on consent, the data subject may withdraw it at any time, without affecting the lawfulness of processing carried out based on consent previously given.

4. Sharing of data with third parties

To pursue the above purposes, Multimac shares data with the following entities:

• GRENKE (renting institution): the necessary data is transmitted to GRENKE for the purpose of assessing, approving and entering into the operating renting agreement. GRENKE acts as an independent controller in the context of the renting relationship it may establish with the client. [to confirm - full legal name and role (controller/processor) of the contracting GRENKE entity]
• B2F / Difrently (technology platform/gateway - toolweb.it / difrently.com): provider of the platform that facilitates the technical submission of the proposal to GRENKE, acting as a processor on behalf of Multimac. [to confirm - legal name, registered office and existence of a processing agreement under Art. 28 GDPR]
• Hostinger (web hosting and SMTP email service): provider of hosting infrastructure and transactional email delivery, acting as a processor. [to confirm - processing agreement and location of data centres]

Multimac only shares data strictly necessary for each purpose and ensures, through contractual agreements, that processors provide sufficient guarantees of GDPR compliance.

5. International transfers

Some providers may host or process data outside the European Economic Area (EEA). In such cases, Multimac ensures appropriate safeguards are in place, namely standard contractual clauses approved by the European Commission or adequacy decisions.

[to confirm - location of Hostinger, B2F/Difrently and GRENKE servers, and the applicable transfer mechanism where transfers to third countries occur]

6. Retention periods

Data is retained only for the period necessary for the purposes for which it was collected, namely:

• Uncompleted proposals: [to complete, suggestion: 12 months] after the last interaction.
• Data associated with concluded renting agreements: during the term of the agreement and for the subsequent statutory periods.
• Data subject to legal obligations (tax/accounting): 10 years, under applicable tax legislation.
• Browsing data and cookies: as set out in the Cookie Policy.

Once the applicable periods have elapsed, data is securely deleted or anonymised.

7. Data subject rights

Under the GDPR, the data subject has the right to:

• Access their personal data;
• Rectification of inaccurate or incomplete data;
• Erasure ("right to be forgotten"), under applicable legal terms;
• Restriction of processing;
• Portability of data;
• Objection to processing based on legitimate interest;
• Withdrawal of consent, at any time, where processing is based on it.

These rights may be exercised via the email dpo@multimac.hito.pt [to confirm] or geral@multimac.hito.pt.

The data subject also has the right to lodge a complaint with the supervisory authority:

• Comissao Nacional de Protecao de Dados (CNPD) - Portuguese Data Protection Authority
• Address: Av. D. Carlos I, 134 - 1.o, 1200-651 Lisbon
• Telephone: +351 213 928 400
• Email: geral@cnpd.pt
• Website: www.cnpd.pt

8. Data security

Multimac adopts appropriate technical and organisational measures to protect data against unauthorised access, loss, destruction or alteration, including encryption in transit, access controls and internal security policies. Multimac and the HITO Innovation Group hold ISO 9001, ISO 14001 and ISO 27001 certifications, the latter relating to information security management.

9. Changes to this Policy

Multimac reserves the right to update this Privacy Policy whenever necessary. The version in force is always available in the Store, indicating the date of the last update.

• Last updated: 2026-07-16
• Version: 1.0