Who is responsible for your personal data
Empa-T, Lda. is the controller of the personal data collected through this website and through its recruitment activities.
Empa-T, Lda.
Largo do Vale da Eiriça, 2 — 2665-588 Venda do Pinheiro, Portugal
Company number: 517985896
Email: geral_rh@empa-t.pt
Where a candidate is considered for a specific opportunity with an Empa-T client, the entity identified in the job advertisement or recruitment process determines the purposes and means of the processing and acts as controller. Until that point — including when you create a profile, express interest in future opportunities, or provide information without applying for a specific role — Empa-T is the controller.
What data we process
2.1. Website visitors
- Browsing data — IP address, browser type and version, operating system, pages visited, and date and time of access, automatically recorded by the server for security and operational purposes.
- Language preference — stored in a functional cookie so that the site is displayed in your chosen language. See the Cookie Policy.
2.2. Contact form
- Identification and contact details — name, email address, telephone number and, if you provide it, LinkedIn profile.
- Message content — the subject and the text you write.
2.3. Job applications and speculative applications
- Identification and contact details — name, email, telephone and LinkedIn profile.
- CV — the file you attach, in PDF, DOC or DOCX format, and the information it contains: education, professional experience, skills, certifications, languages, and any other details you choose to include.
- Covering message, where provided.
- Information generated during the process — interview notes, assessments, test results, remuneration expectations, availability, and application progress.
2.4. Sourced and referred candidates
- Publicly available professional information — collected from professional platforms, company websites, publications or other lawfully accessible sources, where relevant and proportionate to the opportunity concerned.
- Information provided by third parties — employees, partners or professional contacts who consider your profile suitable for an opportunity.
2.5. Professional references
Where a candidate identifies you as a reference, we process your contact details and the information you provide about that candidate.
2.6. Sensitive data
Empa-T does not request data relating to health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, sexual orientation, or criminal convictions.
We recommend that you do not include such information in your CV or in the messages you send us. If it is nonetheless provided, it will only be processed where a valid legal basis exists and to the extent permitted by law.
Where the data comes from
- Directly from you, in most cases: when you complete a form, send your CV or communicate with us. Providing this data is voluntary, but some of it is necessary to respond to your request or assess your application.
- Automatically, through the website, as regards technical data.
- From publicly accessible sources, in the case of candidates we identify.
- From third parties who refer you, or from people you name as references.
Where data is not obtained directly from you, we will inform you within the period required by law and give you the opportunity to object to the processing.
Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Responding to enquiries | Identification, contact details and message content | Steps taken at your request prior to entering into a contract, or Empa-T’s legitimate interest in responding to those who contact it |
| Assessing applications and managing recruitment processes | Identification, contact details, CV, information generated during the process | Steps taken at your request prior to entering into a contract. Where processing is not strictly necessary for that purpose, legitimate interest in conducting effective and fair recruitment |
| Identifying and assessing professional profiles for current or future opportunities | Contact details, professional background, publicly available information, information from referrers | Empa-T’s legitimate interest in identifying suitable candidates for its recruitment needs |
| Maintaining your profile in our talent pool and informing you of future opportunities | Identification, contact details, CV, information generated during the process | Consent |
| Contacting references you have named | Reference contact details and the information they provide | Legitimate interest in verifying experience and suitability for a role |
| Recording and transcribing interviews | Recordings, transcripts, notes and summaries | Consent, obtained in advance. You will always be informed before any recording |
| Presenting candidates to clients and partners | Candidate profile and information generated during the process | Pre-contractual steps, where it relates to an opportunity you applied for. Otherwise, legitimate interest or consent |
| Ensuring the security and operation of the website | Browsing and access data | Legitimate interest in the security, integrity and operation of the service |
| Complying with legal obligations and defending rights | The data necessary and proportionate to the matter | Compliance with a legal obligation; establishment, exercise or defence of legal claims |
Where processing is based on legitimate interest, we have balanced that interest against your rights and freedoms in advance. You may object at any time, as set out in section 10.
Who may receive the data
- The Empa-T team — recruiters, interviewers, technical assessors and decision-makers involved in the process, on a need-to-know basis.
- Service providers — hosting, email, recruitment platforms, assessment tools and technical support. They act as processors, solely on Empa-T’s documented instructions and under contractual confidentiality and security obligations.
- Clients, prospective clients and partners — where relevant to a specific vacancy, project or opportunity, strictly to the extent necessary and subject to confidentiality.
- Public authorities — administrative, judicial, tax, social security or data protection authorities, where required by law or judicial decision.
- Lawyers, insurers and courts — where necessary to establish, exercise or defend legal claims.
- Third parties involved in corporate transactions — merger, acquisition, reorganisation or transfer of business, with confidentiality safeguards in place.
Data is never sold or shared for third-party marketing purposes.
Transfers outside the European Economic Area
Data is processed, as a rule, within the European Economic Area.
The website uses typefaces served by Google’s infrastructure (Google Fonts). When a page loads, the browser connects to Google servers, which may record the IP address. No cookie or profile is created through this connection.
Where a transfer to a third country takes place, it is based on a European Commission adequacy decision or on standard contractual clauses, with any applicable supplementary safeguards. You may request information about these safeguards using the contact details in section 1.
How long we keep the data
| Situation | Period |
|---|---|
| Contact messages | For as long as necessary to handle the enquiry and no longer than 12 months after the last communication |
| CVs submitted through the website | The file is sent by email and deleted from the server immediately after sending. It is never accessible at a public address |
| Registered candidates and applicants | 24 months from the application or from profile creation. At the end of that period we may ask whether you wish to remain in our talent pool for a further 24 months; if no consent is given, the data is deleted within 100 days |
| Sourced or referred candidates | We inform you of the collection and of your right to request deletion. Where such a request is received, we delete within 30 days. Otherwise the 24-month period above applies |
| Professional references | For the duration of the process in which you took part and, where applicable, the same period as the candidate |
| Data needed to defend legal claims | Until the matter and any applicable limitation periods have ended |
| Server security logs | For the technically necessary period, not exceeding 12 months |
If you are engaged by Empa-T, your data will then be processed in the context of the employment or contractual relationship, and separate information will be provided at that time.
Artificial intelligence and automated decisions
Empa-T may use artificial intelligence technologies to support recruitment activities, including summarising CVs, organising profiles against predefined criteria, identifying candidates in the talent pool, preparing communications and content for human review, transcribing recorded interviews, and flagging content that may present a risk of bias.
These activities may constitute profiling within the meaning of the GDPR.
Empa-T does not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Decisions on rejection, selection for interview, progression or hiring are always subject to meaningful human involvement by an authorised person.
- Matching and ranking criteria are defined or approved by people, must be relevant, proportionate and objectively justified, and may not be based on discriminatory factors.
- AI-generated output may be incomplete or inaccurate and is reviewed before being relied upon.
- Empa-T does not use emotion recognition, facial recognition, biometric categorisation, or the inference of sensitive characteristics.
- Providers of these technologies act as processors and may not use the data for their own purposes, including training their models.
- Some of these functionalities may be classified as high-risk systems under Regulation (EU) 2024/1689 (the AI Act). Empa-T maintains human oversight, access controls and appropriate monitoring procedures.
Security
Empa-T applies technical and organisational measures appropriate to the risk, including an encrypted connection to the website, need-to-know access control, storage of CVs in a folder that is not publicly accessible, and their immediate deletion after sending.
No system is entirely secure. In the event of a personal data breach likely to result in a high risk to your rights, you will be notified as required by law.
Your rights
As a data subject, you have the following rights:
- To be informed — to receive clear information about how and why your data is processed, including where we intend to use it for a purpose other than that for which it was collected.
- Access — to obtain confirmation as to whether we process data about you and to receive a copy of that data, together with information on purposes, categories, recipients and retention periods.
- Rectification — to correct inaccurate or out-of-date data and complete incomplete data.
- Right to be forgotten — to request deletion of your data, in particular where it is no longer necessary, where you withdraw consent and no other basis applies, or where you object and no overriding legitimate grounds exist.
- Restriction — to ask us to suspend processing, in particular while accuracy is verified or an objection is assessed.
- Portability — where processing is based on consent or contract, to receive the data you provided in a structured, commonly used, machine-readable format, and to ask for it to be transmitted to another controller where technically feasible.
- Objection — to object, on grounds relating to your particular situation, to processing based on legitimate interest. You may also object at any time and without giving reasons to job alerts and similar communications.
- Withdrawal of consent — at any time, without affecting the lawfulness of processing carried out beforehand.
- Not to be subject to solely automated decisions, as set out in section 8.
To exercise any of these rights, write to geral_rh@empa-t.pt. We will respond within one month, extendable by two further months in particularly complex cases, of which you will be informed. Exercising these rights is free of charge.
Complaints
If you consider that the processing of your data does not comply with the law, you may lodge a complaint with the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados — CNPD) — Av. D. Carlos I, 134, 1.º, 1200-651 Lisbon — www.cnpd.pt.
You may also complain to the supervisory authority of your country of residence, place of work, or the place where the alleged infringement occurred.
Changes to this policy
This policy may be revised to reflect changes in our activities, in the technologies we use, or in applicable legal obligations. The date of the most recent update appears at the beginning of this document. We recommend that you review it periodically.