Privacy and Personal Data Protection Policy

Effective date: 1 November 2026

This is an English translation provided for convenience. In case of any discrepancy, the Portuguese version prevails.

1. Introduction

Protecting the privacy and personal data of users is a priority for Acede - Empresa de Trabalho Temporário, S.A., with registered office at Edifício Mar Vermelho, 1990-095, Lisboa, hereinafter referred to as the “Controller”.

This Privacy Policy sets out the principles and rules that apply to the processing of personal data carried out through web pages, such as websites, as well as mobile applications, web platforms and other digital services provided by the Controller, hereinafter jointly referred to as the “Platform”.

This Policy applies regardless of the device, operating system or technology used, including iOS, Android, web browsers and other compatible interfaces.

Personal data will be processed in accordance with Regulation (EU) 2016/679 (GDPR), Portuguese Law no. 58/2019 of 8 August, and other applicable legislation.

2. Data controller

The entity responsible for processing personal data, for the purposes and operations it determines, is:

Whenever the Platform involves other entities with their own or joint responsibility for processing, this will be identified and communicated to data subjects as required by law.

3. Personal data processed

Depending on the nature of the services provided, the features actually made available and the options selected by users, the following categories of personal data may be processed:

  1. Identification and contact data: name, email address, telephone number and other information needed to identify or communicate with the user.
  2. Registration and authentication data: account identifiers, protected authentication credentials, access information and other information needed to manage accounts.
  3. Technical and usage data: IP address, device identifiers, operating system, app version, access logs, browsing information and usage events.
  4. Service-related data: information entered by the user or generated while using the features contracted or made available.
  5. Location data: information about the location of the device, where the feature exists and the processing has an appropriate legal basis.
  6. Data related to specific features: images, files, content submitted by the user or other information needed for specific services to work.
  7. Communication data: support requests, complaints, suggestions and other interactions with the Controller.

The list above is general and does not mean that every category is actually collected in every application.

Only data that is adequate, relevant and limited to what is necessary for the previously defined purposes will be processed.

4. Purposes and legal bases for processing

Personal data may be processed for the following purposes, provided they correspond to operations actually carried out:

a) Providing and running the services

Managing access to the Platform, creating and administering accounts, authentication and providing the requested features.

b) Security and prevention of misuse

Protecting systems, detecting unauthorised access, preventing fraud and ensuring the integrity of the Platform.

Legal basis: legitimate interest, under Article 6(1)(f) GDPR, where applicable and after the necessary balancing of interests, or compliance with a legal obligation, where required.

c) Compliance with legal obligations

Processing necessary to comply with legal, regulatory, tax or other obligations that apply to the Controller.

d) Customer service and support

Responding to information requests, technical support, complaints and other communications from users.

Legal basis: performance of a contract, legitimate interest or compliance with a legal obligation, depending on the nature of the communication.

e) Analysing and improving the services

Analysing the Platform’s performance, identifying technical problems and improving the user experience.

Legal basis: legitimate interest or consent, depending on the type of information collected, the technologies used and the applicable legal requirements.

f) Commercial and promotional communications

Sending commercial information, news, campaigns or promotional communications.

Legal basis: consent or another basis expressly permitted by the legislation applicable to electronic communications.

g) Optional features

Processing information needed to use additional features, when enabled by the user.

Legal basis: to be determined according to the specific purpose and nature of the processing.

The purposes and their legal bases must be specified for each application or service before it is made available.

5. Collection of personal data

Personal data may be collected:

  1. Directly from the user, through forms, registrations, requests or interactions with the Platform;
  2. Automatically, while the Platform is used, through technical mechanisms necessary for it to work or through duly identified technologies;
  3. From third parties, where there is an appropriate legal basis and the applicable information duties are met.

Whenever providing certain data is a legal or contractual requirement, the user will be informed of this and of the consequences of not providing it.

6. Device permissions

Certain features may require access to specific device resources, such as location, camera, microphone, storage or notifications.

These permissions will be requested when needed and according to the features actually used.

Technical authorisation granted through the operating system does not, by itself, replace compliance with information obligations or obtaining consent where this is legally required.

Users can manage permissions in their device settings, although features that depend on them may then be unavailable.

7. Cookies and similar technologies

The Platform may use cookies, identifiers, SDKs and other similar technologies to ensure the services work and, where applicable, to carry out usage analysis, personalisation or advertising.

The use of these technologies will comply with applicable law, in particular regarding the provision of information and obtaining prior consent, whenever required.

Whenever technologies that are not strictly necessary are used, appropriate mechanisms will be provided for users to choose and manage their preferences.

The technologies actually used, their purposes, the providers involved and their duration must be identified in supplementary information accessible to users.

8. Disclosure of data to third parties

Personal data may be disclosed to third parties when necessary for legitimate and duly identified purposes, namely to:

  1. Providers of technology, hosting, maintenance and support services;
  2. Providers of authentication, communication or payment processing services, where applicable;
  3. Public bodies and competent authorities, where there is a legal obligation or a legitimate order;
  4. Other recipients necessary to provide the services, duly identified as required by law.

Personal data will not be disclosed for purposes incompatible with those for which it was collected, unless there is an appropriate legal basis.

9. International data transfers

The processing of personal data may involve service providers or infrastructure located outside the European Economic Area.

Where international transfers of personal data take place, the Controller will ensure compliance with the conditions laid down in Chapter V of the GDPR, namely through adequacy decisions, standard contractual clauses or other legally permitted mechanisms.

Data subjects will be informed of such transfers and of the applicable safeguards, and may request further information using the contacts given in this Policy.

10. Retention of personal data

Personal data will be kept only for as long as necessary to fulfil the purposes for which it was collected, without prejudice to legally required retention periods.

Retention periods will be determined according to the nature of the data, the purposes of processing, the applicable legal obligations and any need to establish, exercise or defend legal claims.

Once the applicable retention period ends, the data will be deleted or anonymised, unless there is a legitimate basis for keeping it.

The specific retention periods, or the criteria used to determine them, must be made available to data subjects for each processing operation.

Without prejudice to the established retention periods, data subjects may at any time request the erasure of their personal data, under the terms and conditions set out in Article 17 GDPR, using the contacts provided by the Controller. The request will be assessed taking into account the legal bases for the processing and any legal retention obligations or other applicable legal exceptions.

11. Security of personal data

The Controller will adopt technical and organisational measures appropriate to the risks of processing personal data, designed to preserve its confidentiality, integrity, availability and resilience.

Depending on the nature of the systems and the risks identified, these measures may include:

  1. Access control and management;
  2. Authentication mechanisms and credential protection;
  3. Encryption or other appropriate information protection measures;
  4. Backups and recovery procedures;
  5. System updates and maintenance;
  6. Procedures for preventing, detecting and responding to security incidents.

The measures in place will be reviewed and updated according to the risks identified and legal requirements.

12. Rights of data subjects

Under applicable law, data subjects may exercise the following rights, when the respective conditions are met:

Requests to exercise these rights can be sent by email to geral@acede.pt.

The Controller will respond to requests within the legal time limit, as a rule one month from receipt, subject to permitted and duly communicated extensions.

Exercising these rights is, as a rule, free of charge, subject to the exceptions provided for by law.

13. Complaints to the supervisory authority

Without prejudice to any other administrative or judicial remedy, data subjects have the right to lodge a complaint with the competent supervisory authority.

In Portugal, the supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD, the National Data Protection Commission).

14. Processing of minors’ data

If the Platform is intended for minors or allows them to use it, the legal provisions applicable to the protection of their personal data will be observed.

Where processing is based on consent, the requirements of Article 8 GDPR and applicable national law will be respected, including the conditions relating to age and the involvement of holders of parental responsibility, where required.

The Controller will adopt measures appropriate to the nature of the services and the risks associated with processing minors’ personal data.

15. Automated decisions and profiling

Where profiling or decisions based solely on automated processing are carried out and fall under the specific provisions of the GDPR, data subjects will be informed as required by law.

Where applicable, this information will include the existence of such operations, meaningful information about the logic involved, and the significance and envisaged consequences of the processing for the data subject.

The applicable legal rights and safeguards will be ensured, including, where required, the possibility of human intervention and of contesting the decision.

16. Changes to this Privacy Policy

The Controller may update this Privacy Policy as a result of legislative, regulatory or technological changes, or changes to the processing operations carried out.

The updated version will be made available through the Platform, showing the date of the last revision.

Where changes are significant or require additional information or new consent, the legally required procedures will be followed before the affected processing takes place.

17. Contacts

For any question about this Privacy Policy or the processing of personal data, you can contact: