Privacy Policy

01Data Controller

The data controller responsible for your personal data is:

Privum Consulting does not currently have a designated Data Protection Officer (DPO) as it is not required under Article 37 of the GDPR given our size and nature of processing. For any data protection inquiries, please contact us at [email protected].

02Personal Data We Collect

Data you provide directly

We collect personal data that you voluntarily provide when you:

• Fill out the contact form or request a free assessment (name, email, company, message)
• Subscribe to our newsletter (email address)
• Apply for a position or join our talent pool (name, email, role, portfolio or LinkedIn URL, notes, and the CV file you upload, if any)
• Write to us in the chat window on our pages (your messages, and any name or email you give us there)

Data collected automatically on every visit

We use Google Analytics 4 on every page of this website. It records the pages you visit, the page you came from, how long you stay, what you click, your device, browser and operating system, and your approximate location (country and city). Google derives the location from your IP address; Google Analytics 4 does not log or store IP addresses. We use these statistics to see which pages people read and to improve the website.

We also use Google Ads tags on every page, to measure which of our ads lead to a contact request or an application, and to let Google build advertising audiences of past visitors (remarketing).

In addition, Cloudflare, which delivers this website, processes your IP address and request data to protect the site and keeps anonymous performance statistics without cookies, and our own servers keep standard access logs (IP address, page requested, time, browser). Section 4 explains which cookies are set and how your cookie choice changes what Google receives.

03Legal Basis and Purposes of Processing

Under Articles 6 and 13 of the GDPR, we process your personal data based on the following legal grounds:

04Cookies and Consent Management

Google Analytics and Google Ads run on every page of this website. They set cookies on your device only if you accept them, as required by the GDPR and the ePrivacy rules (in Portugal, Law 41/2004).

Your choice

On your first visit, a cookie banner lets you accept all, reject all, or choose analytics and marketing cookies separately. Until you choose, and whenever you reject, Google's tags run in consent mode: they set no cookies and send Google only signals without identifiers (the page, the time, the type of device and browser, and whether consent was given), which Google uses to estimate visits and ad results. You can change your choice at any time with the Cookie settings link at the bottom of every page. Withdrawing consent deletes the analytics and advertising cookies already set.

Cookies we use

• NEXT_LOCALE (strictly necessary, no consent required): remembers your language. Deleted when you close the browser.
• cookie-consent (strictly necessary, stored in your browser's local storage): remembers your cookie choice until you change it or clear your browser data.
• privum-locale-suggestion-dismissed (strictly necessary, local storage): set only if you close the language suggestion, so it is not shown again.
• _ga and _ga_<ID> (analytics, only with consent; <ID> is our Google Analytics property code): Google Analytics identifiers that tell visits and visitors apart. Expire after 2 years at most.
• _gcl_au and _gcl_ls (marketing, only with consent; the second in local storage): Google Ads identifiers that link an ad click to a later contact request or application. Expire after 90 days.

The chat window and Cloudflare's performance statistics set no cookies. The map on our contact page is loaded from Google Maps, so Google receives your IP address when you open that page. You can also block or delete cookies in your browser settings.

05Data Sharing and Third Parties

We do not sell, trade, or rent your personal data. We may share your data with the following categories of recipients:

• Microsoft (Microsoft 365): Our email. Form submissions, including uploaded CVs, are delivered to our mailboxes
• Google (Google Analytics, Google Ads, Google Tag Manager, Google Maps): Website statistics, ad measurement and remarketing, loading those tags, and the map on our contact page
• Cloudflare: Delivery, security and performance of this website
• Legal authorities: When required by law, court order, or to protect our legal rights

Microsoft, Google and Cloudflare process this data under their data processing terms in accordance with Article 28 of the GDPR. For its own advertising purposes, Google may act as an independent controller; see how Google uses data from sites that use its services. The chat window runs on NexTalk, our own live chat product, which stores the conversation; we are notified of new messages through our Microsoft 365 email.

06Data Security

We implement appropriate technical and organizational measures to protect your personal data, including: encryption in transit (HTTPS), access controls, input validation and sanitization, rate limiting and bot protection on forms, and security headers (Content-Security-Policy, X-Frame-Options). However, no method of transmission over the Internet is 100% secure.

07Your Rights Under the GDPR

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of access (Art. 15): Request a copy of the personal data we hold about you
• Right to rectification (Art. 16): Request correction of inaccurate or incomplete data
• Right to erasure (Art. 17): Request deletion of your personal data ("right to be forgotten")
• Right to restrict processing (Art. 18): Request limitation of how we process your data
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format
• Right to object (Art. 21): Object to processing based on legitimate interest or direct marketing
• Right to withdraw consent (Art. 7): Withdraw consent at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at [email protected]. We will respond to your request within one month, as required by Article 12(3) of the GDPR. If a request is complex and we need more time (up to two further months), we will tell you why within that first month.

Right to lodge a complaint

If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority. The competent supervisory authority in Portugal is:

08Email Marketing

We may send marketing communications about our services to business email addresses based on legitimate interest (Art. 6(1)(f) GDPR) for B2B communications, or based on consent for newsletter subscriptions.

Every marketing email includes:

• Clear identification of Privum Consulting as the sender
• A working unsubscribe link that is processed immediately
• Our physical address and contact information

You can opt out of marketing emails at any time by clicking the "Unsubscribe" link in any email or by contacting us at [email protected].

09Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Contact form submissions: 2 years from last interaction
• Newsletter subscriptions: Until you unsubscribe
• Job applications and CVs: 1 year from submission date
• Chat conversations: 2 years from last interaction
• Google Analytics data: Up to 14 months
• Google Ads cookie (_gcl_au): 90 days
• Server access logs: Overwritten automatically, within 7 days at most
• Legal/accounting records: As required by Portuguese law

10International Data Transfers

Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA). When this occurs, we ensure appropriate safeguards are in place:

• EU Adequacy decisions: Transfers to countries recognized by the European Commission as providing adequate data protection (Art. 45 GDPR)
• Standard Contractual Clauses (SCCs): For transfers to countries without adequacy decisions, we use EU-approved Standard Contractual Clauses (Art. 46(2)(c) GDPR)
• EU-US Data Privacy Framework: For US-based processors that are certified under the framework (e.g., Google, Microsoft)

Our email and analytics processors operate under the EU-US Data Privacy Framework and/or Standard Contractual Clauses, with EU-based processing options where available.

11Children's Privacy

Our website and services are directed at businesses and professionals. We do not knowingly collect personal data from individuals under the age of 16. If you become aware that a child has provided us with personal data, please contact us at [email protected] and we will promptly delete the data.

12Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Changes will be posted on this page with an updated "Last updated" date. For material changes that affect how we process your data, we will provide prominent notice (such as a website banner or email notification). We encourage you to review this policy periodically.

13Contact Us

For any questions about this Privacy Policy, to exercise your data protection rights, or to raise any concerns about how we handle your personal data: