Privacy Policy

1. Who is the data controller

The data controller for the personal data collected through this website and within the scope of DevAzor's activity is DevAzor.

Whenever we provide services to Clients as a service provider, we may process personal data on behalf of those Clients, acting as processor (subcontractant). In that case, the data controller is the Client and the relationship is governed by the service contract and, where applicable, by a Data Processing Agreement.

For questions related to this Policy, please contact us through the means indicated in the "Contacts" section.

2. Scope

This Policy applies to:

Visitors to the DevAzor website.
People who contact DevAzor through a form, email, phone or WhatsApp.
Clients, prospective clients and participants in meetings, presentations or events organised by DevAzor.
Candidates for professional positions at DevAzor.
Any other person whose personal data is processed by DevAzor in the course of its activity.

We are not responsible for third-party websites to which we may link. The consultation of those websites is governed by their respective privacy policies.

3. Data we collect

Depending on the interaction, we may collect the following categories of personal data:

3.1. Data provided directly by the data subject

Full name and, where applicable, role and company name.
Email address and phone number.
Postal address (where relevant for billing or sending correspondence).
Content of messages sent through forms, email, phone, WhatsApp or other communication tools.
Billing and payment data (holder, VAT number, IBAN or other bank identifier) where applicable.
Curriculum vitae, cover letter and professional information of job candidates.

3.2. Data automatically collected during the visit to the website

IP address, browser type and version, operating system and language.
Pages visited, time spent, referrers and actions performed.
Identifiers from cookies and similar technologies (see section 8).

3.3. Data collected in the context of the provision of services

In the context of the provision of professional services, DevAzor may process, on behalf of the Client, personal data provided by the latter (for example, data of employees, end customers or suppliers of the Client). This processing is governed by a specific Data Processing Agreement and is not the subject of this Policy as a document addressed to website visitors.

4. Purposes and legal bases

We process personal data for the following purposes:

Where processing is based on consent, this may be withdrawn at any time, without affecting the lawfulness of processing carried out on the basis of that consent before its withdrawal.

5. Data retention

We keep personal data only for the period necessary to fulfil the purposes for which it was collected, as well as the respective legal and contractual obligations. As a guideline:

Client and billing data: for the duration of the contractual relationship and, after its termination, for the 10-year period that we are legally required to keep it for accounting and tax purposes.
Prospective client data and quote requests: for 2 years after the last contact, unless there is consent for a longer retention period.
Marketing communications: until consent is withdrawn or the right to object is exercised.
Support and communication records: 2 years after the last contact, unless a longer retention period is required for legal reasons.
Job candidate data: for 12 months after the closure of the recruitment process, unless consent is given for a longer retention period.
Cookie data: as set out in section 8 and the choices made by the user.

6. Data sharing

DevAzor does not sell personal data. It only shares data when strictly necessary and under written contracts that impose confidentiality and security obligations. The main categories of recipients are:

Subcontractors and service providers: hosting (cloud), productivity and collaboration tools, transactional email sending, payment processing, analytics tools, meeting and scheduling management.
Professional advisers: lawyers, accountants, auditors, consultants, within the scope of their respective mandates.
Public and judicial authorities: when required by law or by court order.
Client partners and subcontractors: when necessary for the execution of the services contracted by the Client.
Third parties in the context of restructuring: in the event of a merger, acquisition or sale of assets, the data may be transmitted to the acquirer, ensuring the continuity of the protection guarantees.

7. Recruitment and candidate selection

When you send us a spontaneous application or apply for a specific position, DevAzor processes the personal data provided for the sole purpose of assessing your suitability for the profile sought and, if applicable, contacting you in the context of that process.

7.1. Data collected

We may process, among others, the following data:

Full name, date of birth and contact details.
Curriculum vitae, cover letter and portfolio.
Professional profile on social networks (for example, LinkedIn) when indicated by you.
Professional experience, education, certifications and technical skills.
Information resulting from interviews and any technical tests carried out during the process.
Professional references, when provided by you or by third parties indicated by you.

7.2. Source of the data

Most of the data is provided directly by the candidate. In some cases, we may collect complementary information from public sources (for example, job portals, professional social networks) or from references indicated by the candidate.

7.3. Legal basis

The processing of application data is carried out on the basis of the candidate's free, express and informed consent, given at the time of submission of the application, and, where applicable, on the basis of pre-contractual diligence.

7.4. Retention and destination of the data

The candidate's data is kept during the ongoing recruitment process and, in the case of spontaneous applications or processes that do not end in hiring, for 12 months after the closure of the process, unless express consent is given for a longer retention period (for example, for contact in future opportunities).
The data of candidates who are effectively hired becomes part of the human resources process and is governed by its own privacy information that will be provided to you at that time.
At the candidate's request, the data is deleted in advance, without prejudice to compliance with legal obligations.

7.5. Specific rights of the candidate

In addition to the general rights described in section 11, the candidate may:

Update their CV or contact information during the process.
Request the deletion of their application at any time.
Refuse to provide information that is not essential to the process, without prejudice to the fact that it may be relevant for the assessment.

8. Cookies and similar technologies

Our website uses cookies for different purposes:

Strictly necessary cookies — essential for the website to function (session, security, consent preferences). They do not require consent.
Preference cookies — allow us to remember user options (language, region).
Measurement/analytics cookies — help us understand how the website is used, in an aggregated way, so that we can improve it.
Marketing cookies — used, when present, to display relevant content on other websites.

You can manage your preferences through the cookie banner made available on the website or through your browser settings. Disabling certain cookies may affect the browsing experience.

9. International transfers

Some of our service providers may be located outside the European Economic Area (EEA). In such cases, DevAzor ensures that transfers only take place to countries with an adequacy decision from the European Commission or under appropriate safeguards, such as standard contractual clauses approved by the European Commission or others provided for in Chapter V of the GDPR.

10. Security measures

We adopt appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or improper disclosure, including, among others:

Encryption in transit (TLS) and at rest, where applicable.
Access controls based on the principle of least privilege.
Audit logs and continuous monitoring.
Regular backups and recovery plan.
Periodic training of employees on data protection.
Risk assessment and, when justified, data protection impact assessments.
Contractual agreements with subcontractors that ensure an equivalent level of protection.

Despite all efforts, no system is completely impenetrable. In the event of an incident affecting personal data, DevAzor will notify the competent authorities and the affected data subjects in accordance with the terms provided for by law.

11. Your rights

As a data subject, you have the right to:

Access the data we process about you.
Rectify inaccurate or incomplete data.
Request the erasure of your data, where applicable ("right to be forgotten").
Object to processing, in particular for direct marketing purposes.
Request the restriction of processing in certain circumstances.
Request the portability of data in a structured, commonly used and machine-readable format.
Withdraw consent at any time, where processing is based on it.
Lodge a complaint with the competent supervisory authority.

For Portugal, the supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD), available at www.cnpd.pt.

The exercise of these rights is free of charge, unless the request is manifestly unfounded or excessive. To exercise any of these rights, contact us through the means indicated in the "Contacts" section. We will respond within a maximum of 30 days.

12. Automated decisions and profiling

DevAzor does not make decisions based exclusively on automated processing that produce significant effects on the data subject's sphere, nor does it engage in profiling for that purpose. If, in the future, we do so, we will inform the data subject and ensure the exercise of the rights provided for by law.

13. Minors

Our services and the website are not intended for minors under 16 years of age. If we become aware that we have inadvertently collected data from a person under 16, we will delete it within a reasonable time. If you are the legal representative of a minor and believe that we have collected data about them, please contact us.

14. Data processing as a service provider (processor)

When DevAzor processes personal data on behalf of a Client, it acts as a processor and the processing is governed by a specific Data Processing Agreement, which defines:

Object, duration, nature and purpose of the processing.
Type of personal data and categories of data subjects.
DevAzor's obligations as a processor, in accordance with Article 28 of the GDPR.

Data subject requests relating to data processed in this context should, in the first instance, be addressed to the respective Client.

15. Changes to this Policy

This Policy may be updated to reflect changes in our practices, legal requirements or other factors. In the event of material changes, we will endeavour to notify data subjects by email (when available) and/or through a visible notice on the website. The date of the last update is indicated at the top of the document.

Previous versions may be requested through the contact email.

16. Contacts

General email: [email protected]
Phone: +351 922 036 350
WhatsApp: +351 922 036 350
Website: https://devazor.com

We are committed to responding to all legitimate requests as soon as possible and, in any case, within the time limits provided for by the GDPR and applicable national legislation.