Privacy policy and consent for the processing of personal data

The services offered through the website of SOFTLANDING are guided by the highest quality standards. We apply the same standards to the processing of personal data. This Data Protection and Privacy Policy applies to SOFTLANDING website (hereinafter “Privacy Policy”) and has been prepared in accordance with current national and European legislation on the protection of individuals, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (“GDPR”), as well as other legal provisions, regulatory and good practices. This Privacy Policy describes our privacy practices with respect to the information collected, processed and used, as well as the rights of the website users and how to exercise them.

This Privacy Policy aims to help users understand what personal information we collect, how and why we use it, to whom we disclose it, and how we protect users’ privacy when using the services or visiting SOFTLANDING website.

1. Data controller

LXTG MANAGEMENT CONSULTING, UNIPESSOAL LDA, with registered seat at Rua Braamcamp, nº 9, SLJ Dto, 1250-048 Lisboa, registered in the Commercial Registry Office under the number 516063430, hereinafter referred to as LXTG, provides consultancy services for the recruitment of human resources, programming and software development. Therefore, it is responsible for the Recruitment of employees to be allocated to its projects or to recruit employees for third parties and, consequently, it is responsible for the processing of the personal data collected under such recruitment processes.

2. Purpose of the processing

Consent of the data subject – means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

Personal Data – means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data or an online identifier;

Processing – means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

Personal Data Breach – means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;

Third Party – means a natural or legal person, public authority, agency or body other than the data subject, and persons who, under the direct authority of LXTG, are authorised to process personal data;

Supervisory Authority – means an independent public authority, which is established by a Member State, concerned with the application of the Regulation, to defend the fundamental rights and freedoms of data subjects, and, where applicable, the free flow of personal data within the Union. In Portugal, the supervisory authority will be the National Data Protection Commission (“CNPD”);

Data Subject – an identified or identifiable natural person to whom the data relates;

International data transfers – transfers of personal data that are or will be processed after a transfer to a third country (not located in the European Union) or to an international corporation.

3. Principles relating to processing of personal data

For the purposes above referred, LXTG may collect and process the following categories of personal data, including the documents in which such data are collected:

• Processed lawfully, fairly and in a transparent manner in relation to the data subject;

• Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes;

• Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;

• Accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;

• Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed;

• Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage.

LXTG collects and processes personal data of its users through its website for the following purposes:

• To contact the user, for administrative or operational reasons, for example, in response to any questions, applications, suggestions or requests for information;

• Storage of the data in the database for future opportunities;

• Internal statistical analysis and internal report.

4. Category of personal data collected

• Email and Phone Number;

• Personal and professional interests.

5. Personal data storage period

The time for which data is stored varies according to the purpose for which the information is used. However, there are legal requirements that require keeping data for a certain period. Thus, and where there is no specific legal requirement, data will be stored and kept only for the minimum period necessary for the purposes that led to their collection or subsequent processing, after which they will be eliminated.

6. Data sharing with third parties

7. Rights of the data subject

The data subjects are entitled to, following the law, the rights of information, access, rectification if the data are outdated, incorrect or incomplete, restriction, objection and erasure on the data collected. Notwithstanding, the right of erasure may be limited, namely, for the public interest, judicial, national security, invoicing, commercial, fiscal, or other reasons provided by law.

a) Access to Personal Data

The data subject has the right to obtain a confirmation issued by LXTG if his/her/them data are being processed and if so, the data subject has the right to have access to such data.

b) Right to rectification

The data subject shall have the right to obtain, without undue delay the rectification of inaccurate personal data concerning him or her. The data subject shall also have the right to have incomplete personal data completed.

In case of rectification of data, LXTG shall notify each addressee to whom the data have been forwarded for rectification.

c) Right to erasure (‘right to be forgotten’)

The data subject shall have the right to obtain from LXTG the erasure of personal data concerning him or her.

The following are recipients of the personal data collected:

• LXTG, or other company belonging to LXTG, employees who work in the human resources or technical department;

• The employees of the recruitment department, nearshore and outsourcing of LXTG and other companies belonging to LXTG.

d) Right to restriction of processing

The data subject also has the right to request to LXTG the limitation of the processing, where one of the following is applicable:

• The accuracy of the data is contested, for a period enabling LXTG to verify the accuracy of the data;

• The data is requested by the data subject for the issuance of a statement or the exercise of a right or to defend a right in a judicial procedure, and LXTG no longer needs to process the personal data;

• If it has exercised the right to objection to the processing until it is verified if the legitimate interests of the data controller prevail over the legitimate interests of the data subject.

e) Right to data portability

The data subject has the right to receive from LXTG, whenever the processing is carried out by automated means, his/her/them personal data in a structured, commonly used and machine-readable format and has the right to transmit those data to another controller.

f) Right to object

If the processing of personal data is based on the legitimate interests of LXTG the data subject is entitled to, at any time, object to such processing of personal data.

For the exercise of any of those rights, the data subjects have to submit a request, in writing, to the e-mail: [email protected]. LXTG shall reply to your request within the period legally established.

8. Consent

The user are also entitled to the withdrawal of their consent. Such withdrawal does not affect the lawfulness of the processing based on consent before its withdrawal nor to further processing of the data, when necessary to comply with legal/contractual obligations.

9. LXTG performance in compliance with the General Data Protection Regulation

a) LXTG hereby declares that the personal data collected are licit and limited to the necessary;

b) LXTG also declares that the data are updated and that the necessary technical and organisational measures are implemented to ensure the safety, update and accuracy of the data collected;

c) LXTG has implemented the adequate technical and organisational measures to ensure the confidentiality and safety of the personal data collected, to avoid its destruction, accidental or illicit, modification, accidental loss, diffusion or non-authorised access, namely when such data are transferred by electronic means, and against any illicit processing, in conformity with the categories of the data processed;

d) It is hereby informed that the processing of personal data is lawful, loyal and transparent.

10. Personal data breach

11. Right to claim before a supervisory authority