1.Identity of the controller, scope and related documents.

1.1.This Privacy Policy regulates the processing of personal data carried out in the context of the Website netwiz.pt, subdomains, domains, applications, APIs, reserved areas, digital platforms, systems, technical environments and functionalities under the control of Netwiz Systems, including forms, contact functionalities, quote requests, online contracting, checkout, communications, support, SaaS solutions, usage licenses, online services, training, online courses and other services provided by Netwiz Systems, Sociedade Unipessoal, Lda.

1.2.For the purposes of applicable legislation on the protection of personal data, including Regulation (EU) 2016/679, General Data Protection Regulation, GDPR, and Law No. 58/2019, of August 8, the controller, when acting in that capacity, is:

Netwiz Systems, Sociedade Unipessoal, Lda.

Registered at the Leiria Commercial Registry Office

NIPC: 518 927 784

Headquarters: Rua 25 de Abril, no. 313, Zona Industrial do Roligo, 4520-115 Santa Maria da Feira

General contact: info@netwiz.pt

Contact channel for privacy and data protection matters: dpo@netwiz.pt

1.3.This Privacy Policy applies, in particular, to the processing of personal data carried out by Netwiz Systems as controller within the scope of:

1.3.1.navigation, access and use of the Website netwiz.pt, subdomains, domains, applications, APIs, reserved areas, platforms, systems, technical environments and functionalities under the control of Netwiz Systems;

1.3.2.submission of forms, contact requests, quote requests, diagnoses, appointments, communications and interactions through the Website, subdomains, domains, applications, reserved areas, platforms, systems, technical environments or functionalities under the control of Netwiz Systems;

1.3.3.use of reserved areas, accounts, digital functionalities, checkout, online hiring, payments and invoicing;

1.3.4.management of Customers, potential Customers, leads, proposals, contracts, support, commercial communications and pre-contractual or contractual relationships;

1.3.5.provision of own services, courses, training, digital content, subscriptions, usage licenses, Netwiz digital platforms and solutions;

1.3.6.security, auditing, fraud prevention, incident management, technical logs, electronic proof and defense of rights.

1.4.Netwiz Systems may also act as a processor, when processing personal data on behalf of and in accordance with documented instructions from its Customers, within the scope of Netwiz Solutions/Platforms or contracted services, including, in particular, Netwiz SocialHub, Netwiz LeadDesk, Netwiz TalentHub, Netwiz Nexus, Netwiz Intelligence, Netwiz Consent Manager, online course comparison platforms and other platforms, modules, functionalities or solutions that may be developed or integrated into the Netwiz ecosystem.

1.5.When Netwiz Systems acts as a processor, the Netwiz Client acts, as a rule, as the controller of the personal data of its own clients, candidates, workers, users, contacts, leads, followers, recipients of communications, visitors, buyers, trainees or other data subjects associated with its activity. In these cases, the processing carried out by Netwiz Systems will be regulated by contract, proposal, Specific Conditions and, when applicable, by a Data Processing Agreement (“DPA”).

1.6.When personal data is collected, hosted, exported, downloaded, preserved or processed on websites, databases, servers, platforms, systems, tools or environments controlled by the Netwiz Customer, or when the Customer makes backup copies, extractions, exports or autonomous processing operations of such data, the respective Client, as the controller, is responsible for the lawfulness of the processing, information to data subjects, definition of the legal basis and retention periods, security, response to rights requests and compliance with applicable legal obligations.

1.7.This Privacy Policy does not replace the privacy policies of Netwiz Customers, nor does it regulate, on behalf of these Customers, the processing they carry out on their own websites, platforms, databases, systems, campaigns, recruitment processes, commercial communications, online stores or other operations. Whenever Netwiz provides technology, platform, hosting, support, integration, automation or technical processing on behalf of the Customer, it is the Customer's responsibility to ensure that it has its own privacy policy, adequate information for data subjects and a legal basis for the processing.

1.8.In the case of recruitment platforms, application management, candidate analysis, publication of opportunities, management of selection processes or equivalent solutions, Netwiz Systems may process, on behalf of its Clients, personal data related to candidates, company representatives, decision-makers, Authorized Users and other parties involved in the process, including identification data, contact, CV, training, professional experience, skills, professional history, salary data, internal notes, evaluations, classifications, communications, attached documents and other information provided as part of an application or recruitment process. In these cases, except when Netwiz independently determines the purposes and means of the processing, the Customer using the platform will, as a rule, act as controller.

1.9.This Privacy Policy must be read in conjunction with the Legal Notice and Terms and Conditions of Use of the Website, with the Returns, Cancellations, Refunds and Guarantees Policy, with the Cookies and Similar Technologies Policy, with the autonomous information on Complaints, Complaints Book and Alternative Dispute Resolution, as well as with the Specific Conditions applicable to each service, platform, subscription, license, contract, course or functionality. This documentary articulation applies without prejudice to the distinction between data processed by Netwiz as controller and data processed on behalf of Customers as processor.

1.10.The use of cookies, pixels, tags, identifiers, scripts, measurement technologies, preferences, statistics, marketing, personalization or similar technologies will be regulated in an autonomous document, called the Cookies and Similar Technologies Policy, without prejudice to this Privacy Policy explaining the processing of personal data that may result from these technologies when applicable.

1.11.Netwiz Systems may use providers, technical partners, providers of hosting, infrastructure, security, maintenance, payments, communications, email, CRM, support, analytics, artificial intelligence, automation, backups, cloud services, databases or other services necessary for the provision, security, improvement, execution and continuity of its services. For reasons of security, commercial confidentiality and infrastructure protection, Netwiz Systems may identify these third parties by categories, except when nominative identification is legally required or necessary to ensure the rights of data subjects.

1.12.This Privacy Policy applies without prejudice to specific rules provided for in contracts, proposals, Specific Conditions, DPA, platform terms, license terms, Product/Software Documentation, technical documentation, plugin documentation, extensions, add-ons, APIs, modules, comparators, directories, marketplaces, search portals, advertising platforms or documents specific to certain services, digital products or technological solutions. In case of discrepancy between documents, the document specifically applicable to the matter in question prevails, without prejudice to mandatory legal standards regarding the protection of personal data.

2.Essential definitions regarding data protection

2.1.For the purposes of this Privacy Policy, the definitions set out in the General Data Protection Regulation, GDPR, Law No. 58/2019, of August 8, and other applicable legislation on the protection of personal data apply.

2.2.To make this Privacy Policy easier to read, it means:

2.2.1.Personal data: any information relating to an identified or identifiable natural person, including, in particular, name, contact, email, telephone number, address, online identifiers, account data, billing data, professional data, application data, CV data, salary data, image, voice, messages, interactions, technical identifiers or other elements that allow the direct or indirect identification of a natural person.

2.2.2.Data subject: the natural person to whom the personal data relates, including, as applicable, Website Users, Customers, Customer representatives or employees, job candidates, trainees, contacts, leads, communication recipients, Authorized Users of the platforms, End Customers of Netwiz Customers or any other natural person whose data is processed by Netwiz Systems.

2.2.3.Processing: any operation carried out on personal data, by automated or non-automated means, including collection, registration, organization, structuring, storage, adaptation, consultation, use, transmission, provision, comparison, interconnection, limitation, erasure, destruction, export, backup, analysis, classification or any other applicable operation.

2.2.4.Controller: the entity that determines the purposes and means of processing personal data. Netwiz Systems acts as data controller when it decides, on its own behalf, why and how it processes personal data, namely in the context of the Website, contacts, requests for information, commercial management, billing, support, communications, security, legal compliance and defense of rights.

2.2.5.Processor: the entity that processes personal data on behalf of the controller and in accordance with its documented instructions. Netwiz Systems acts as a processor when it processes personal data on behalf of its Customers within the scope of platforms, SaaS services, licenses, integrations, automations, hosting, technical support or other contracted operations.

2.2.6.Customer, as controller: the Netwiz Customer who, using Netwiz Solutions/Platforms or contracted services, determines the purposes and means of processing the data of its own customers, candidates, workers, representatives, contacts, leads, followers, users, trainees or other data subjects. In these cases, the Customer is responsible for informing data subjects, ensuring legal basis, defining retention periods, responding to requests to exercise rights and complying with other applicable legal obligations.

2.2.7.Customer's End Customer: natural person or entity related to the activity of the Netwiz Customer, whose data, interactions, messages, applications, contacts, purchases, requests, communications or information can be introduced, collected, synchronized, processed or managed through the Netwiz Solutions/Platforms or contracted services. When a legal person is concerned, this Policy only applies to the personal data of natural persons who represent, contact, integrate or act on its behalf.

2.2.8.Customer Data: data, files, databases, records, messages, contacts, leads, applications, interactions, images, documents, commercial information, operational information, personal or non-personal data, entered, uploaded, imported, synchronized, transmitted, generated, processed or stored by the Customer, its Authorized Users, its End Customers or third parties under its responsibility, within the scope of the use of Netwiz Solutions/Platforms or contracted services.

2.2.9.Authorized Users: natural persons authorized by the Customer to access or use Account, reserved area, platform, functionality, integration, SaaS service, license or Netwiz digital solution, within the scope of the Customer's organization and for the purposes permitted by the applicable contract, subscription, plan, license or Specific Conditions.

2.2.10.Special categories of personal data: data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data intended to uniquely identify a person, data relating to health or data relating to a person's sex life or sexual orientation. This data can only be processed in legally permitted cases.

2.2.11.Application data: data processed in the context of recruitment, selection, analysis or candidate management processes, including, in particular, name, contacts, address, CV, photograph, training, professional experience, skills, professional history, salary data, availability, professional expectations, internal notes, evaluations, classifications, communications, attached documents and other information provided or generated within the scope of an application.

2.2.12.Technical data and logs: data generated by the use of the Website, subdomains, domains, applications, APIs, reserved areas, platforms, systems, technical environments, integrations or digital services, including IP address, technical identifiers, Netwiz ID, date and time of access, authentication events, actions performed, error logs, browser, device, operating system, security logs, support logs, usage history, consent logs and electronic evidence.

2.2.13.Netwiz ID: unique user identifier, account or authentication profile used to allow access to Netwiz Solutions/Platforms, reserved areas, products, services, subscriptions, licenses or contracted functionalities, which may involve the processing of identification data, authentication, permissions, access logs, usage history and security events.

2.2.14.Recipients: entities to whom personal data may be communicated or made available, including, as applicable, providers of hosting, infrastructure, maintenance, security, payments, communications, email, CRM, support, analytics, artificial intelligence, automation, backups, cloud services, accounting, legal advice, public authorities or other legally or contractually authorized third parties.

2.2.15.Technical processors: providers or suppliers who process personal data on behalf of Netwiz Systems or, in certain situations, on behalf of Netwiz Customers, within the scope of providing technical services, hosting, maintenance, security, payments, support, artificial intelligence, communications, automation, backups or equivalent services.

2.2.16.Consent: expression of free, specific, informed and unequivocal will by which the data subject accepts, through a declaration or clear positive act, that their personal data be processed for one or more specific purposes.

2.2.17.Personal data breach: security breach that causes, accidentally or unlawfully, the destruction, loss, alteration, disclosure or unauthorized access to personal data transmitted, preserved or subject to any other type of processing.

2.3.The definitions contained in this Privacy Policy must be interpreted in conjunction with the definitions set out in the Legal Notice and Terms and Conditions of Use of the Website, namely regarding Website, Customer, Account, Netwiz Solutions/Platforms, Subscription/Plan, Integration/API, License of Use, Specific Conditions, Customer Data, Authorized Users and Customer's End Customer.

2.4.In case of interpretative doubt, the legal definitions contained in the GDPR and applicable Portuguese legislation prevail, especially when the rights of data subjects, obligations of the controller, obligations of the processor or compliance with mandatory legal duties are at stake.

3.Netwiz Systems’ role: controller or processor.

3.1.Netwiz Systems may process personal data in different capacities, depending on the context, the purpose of the processing, the service provided, the platform used, the existing contractual relationship and the entity that determines the purposes and means of the processing.

3.2.Netwiz Systems acts as data controller when it determines, on its own behalf, the purposes and means of processing personal data. This occurs, in particular, in the following situations:

3.2.1.Website management netwiz.pt, subdomains, domains, applications, APIs, reserved areas, platforms, systems, technical environments and functionalities under the control of Netwiz Systems;

3.2.2.reception and response to contact requests, quote requests, diagnoses, appointments, forms and communications received directly by Netwiz Systems;

3.2.3.management of Customers, potential Customers, leads, proposals, contracts, invoicing, collections, payments, Customer support and support;

3.2.4.account management, reserved areas, subscriptions, licenses, courses, training, digital content and services contracted directly from Netwiz Systems;

3.2.5.sending specific operational, contractual, technical, informative or commercial communications, when there is an adequate legal basis;

3.2.6.Website security netwiz.pt, subdomains, domains, applications, APIs, reserved areas, platforms, systems, technical environments, fraud prevention, abuse control, technical logs, auditing, incident management and defense of rights;

3.2.7.compliance with legal, tax, accounting, administrative, regulatory or judicial obligations applicable to Netwiz Systems.

3.3.Netwiz Systems acts as a processor, when it processes personal data on behalf of a Customer and in accordance with its documented instructions, within the scope of services, platforms, SaaS solutions, licenses, integrations, automations, hosting, technical support, maintenance, migration, configuration or other contracted operations.

3.4.In situations where Netwiz Systems acts as a processor, the Netwiz Customer acts, as a rule, as the controller, being responsible for determining the purposes and essential means of the processing, as well as ensuring compliance with applicable legal obligations, including:

3.4.1.provide adequate information to data subjects;

3.4.2.define and document the applicable legal grounds;

3.4.3.obtain consents when legally necessary;

3.4.4.guarantee the lawfulness of the collection, insertion, import, synchronization, retention, communication and use of personal data;

3.4.5.define appropriate retention periods;

3.4.6.respond to requests to exercise rights from data subjects;

3.4.7.ensure the compliance of your own websites, forms, campaigns, platforms, recruitment processes, communications, online stores and databases;

3.4.8.assess the need for data protection impact assessments, where applicable;

3.4.9.give lawful, documented, clear and appropriate instructions to Netwiz Systems.

3.5.Netwiz Systems's performance as a processor may occur, in particular, within the scope of platforms and solutions such as Netwiz SocialHub, Netwiz LeadDesk, Netwiz TalentHub, Netwiz Nexus, Netwiz Intelligence, Netwiz Consent Manager, online course comparison platforms and other platforms, modules, functionalities, integrations, APIs, automations or digital services that may come to be made available by Netwiz Systems, including solutions installed, integrated or used on Customers' websites, domains, databases, systems or technical environments.

3.6.In the context of recruitment platforms, opportunity management, candidate analysis, application collection, selection pipeline, team management, approvals, internal notes, evaluation or classification of candidates, the Customer using the platform will, as a rule, be the controller of the data of candidates and other stakeholders. Netwiz Systems will process this data as a processor when it only provides technology, hosting, support, automation, maintenance, integration or technical processing on behalf of the Customer.

3.7.When personal data is collected, stored, processed, exported, downloaded, copied, hosted or preserved in systems, databases, servers, websites, platforms or environments controlled by the Customer, or when the Customer carries out backup copies, exports, extractions or autonomous processing operations, the responsibility for these processing operations lies with the Customer, except when Netwiz Systems independently determines the purposes and means of a specific processing.

3.8.Netwiz Systems is not responsible for the legality of databases, contact lists, applications, CVs, interactions, messages, content, images, documents, salary data, professional data, customer data, candidate data, worker data or other personal data entered, uploaded, imported, synchronized, transmitted, processed or preserved by the Customer, its Authorized Users or third parties under its responsibility, except when such responsibility results from Netwiz Systems's own act as controller.

3.9.When Netwiz Systems processes personal data on behalf of the Customer, the processing will be carried out in accordance with the contract, proposal, Specific Conditions, documented instructions from the Customer and, when applicable, the Data Processing Agreement (“DPA”). Netwiz Systems may refuse, suspend or not execute instructions that are manifestly illegal, inadequate, unsafe, technically unfeasible or likely to violate applicable data protection legislation.

3.10.When two or more controllers jointly determine the purposes and means of certain processing, there may be a situation of joint controllership, and the entities involved must define, in a transparent manner, their respective responsibilities for complying with data protection obligations, under the legally applicable terms.

3.11.The existence of integrations with third-party services, including payment methods, social networks, communication platforms, analytics systems, AI tools, APIs, cloud services, email services, CRM, hosting, security, backups or automations, does not imply, in itself, that these third parties always act in the same capacity. Depending on the case, they may act as independent controllers, processors of Netwiz Systems, processors of the Customer or joint controllers, under the legally and contractually applicable terms.

3.12.Netwiz Systems may use categories of technical processors to ensure hosting, infrastructure, maintenance, security, communications, payments, support, CRM, automations, artificial intelligence, backups, cloud services, databases, monitoring, fraud prevention, auditing, accounting, legal advice or other services necessary for the execution, security, improvement and continuity of services. Categorization aims to ensure adequate transparency while preserving security, commercial confidentiality and infrastructure protection.

3.13.This section must be interpreted in conjunction with the Terms and Conditions of Use of the Website, in particular with the clauses relating to Customer Data, Netwiz Solutions/Platforms, Integrations/API, export, backups, retention, deletion, Customer responsibility, security, logs and electronic evidence.

4.Categories of personal data processed.

4.1.Netwiz Systems only processes personal data that is adequate, relevant and limited to what is necessary for the applicable purposes, taking into account the nature of the Website, communications, requests submitted, services contracted, Netwiz Solutions/Platforms, legal obligations and the relationship existing with the data subject or the Customer.

4.2.As controller, Netwiz Systems may process, in particular, the following categories of personal data:

4.2.1.Identification data: name, surname, professional name, position, entity represented, tax identification number, signature, user identification or other elements necessary to identify the data subject or representative.

4.2.2.Contact data: email, telephone number, address, location, country, professional contacts, details of authorized interlocutors, contact preferences and communications history.

4.2.3.Billing, payment and contracting data: data necessary for issuing proposals, quotes, invoices, receipts, credit notes, payments, charges, means of payment, payment references, transaction history, payment status, tax data and information necessary to comply with accounting, tax and legal obligations.

4.2.4.Account and reserved area data: credentials, Netwiz ID, account identifiers, user profile, permissions, functions, subscriptions, plans, licenses, access history, settings, preferences, account status, records of acceptance of legal documents and use of features.

4.2.5.Request, form and lead data: information entered by the data subject in forms, contact requests, quote requests, diagnoses, appointments, chats, questionnaires, simulations, briefings, messages, attachments or other means of interaction provided by Netwiz Systems.

4.2.6.Commercial and relationship data: history of contacts, proposals, negotiations, contracts, services requested or contracted, expressed interests, commercial preferences, communications sent, responses, meetings, tickets, support requests, complaints, feedback and monitoring records.

4.2.7.Training and course data: identification of the trainee, registration data, course or training attended, modality, attendance, progress, participation, assessments, certificates, pedagogical communications, access to digital content and other information necessary for training management, when applicable.

4.2.8.Technical, navigation and log data: IP address, technical identifiers, date and time of access, browser, device, operating system, pages visited, authentication events, actions performed, error logs, security logs, support logs, interactions with features, performance data and electronic evidence.

4.2.9.Electronic communications data: emails, messages, requests, responses, tickets, chat interactions, notifications, sending and receiving records, operational communications, commercial communications when applicable, and respective evidence of delivery, opening or interaction, when technically available and legally admissible.

4.2.10.Consent data, preferences and electronic proof: records of consent, opposition, withdrawal of consent, communication preferences, acceptance of Terms and Conditions, acceptance of the Privacy Policy, acceptance of cookies when applicable, version of accepted documents, date, time, IP, technical identifier and other evidence necessary to prove compliance.

4.2.11.Security and fraud prevention data: authentication data, access attempts, suspicious events, blocking, activity logs, abuse detection, anti-spam control, automatic validations, incident logs, IP addresses, technical identifiers and information necessary to protect infrastructure, services, accounts and users.

4.3.When Netwiz Systems acts as a processor on behalf of its Customers, it may process, depending on the Customer's platform, service, integration or documented instructions, personal data relating to customers, candidates, workers, representatives, users, contacts, leads, followers, communications recipients, trainees, buyers or other data subjects associated with the Customer's activity.

4.4.Within the scope of Netwiz Solutions/Platforms and associated services, including recruitment platforms, opportunity management, digital communication, lead management, social media, automations, CRM, reserved areas, messaging systems, application analysis, integrations/API or AI functionalities, the following may be handled, on behalf of the Customer:

4.4.1.identification and contact data of customers, candidates, leads, users, representatives or interlocutors;

4.4.2.professional, curricular, academic and professional experience data;

4.4.3.salary data, salary expectations, availability, professional preferences and application information;

4.4.4.CVs, cover letters, portfolios, certificates, attached documents, internal notes and evaluations;

4.4.5.ratings, pipeline statuses, comments, approvals, decisions, team interactions and process history;

4.4.6.messages, communications, requests, responses, contacts, interactions, comments, likes, photographs, social network identifiers or publicly available information or information made available through integrated platforms;

4.4.7.billing data, purchases, requests, orders, support, forms, registrations or interactions related to the Customer's services;

4.4.8.technical data, logs, identifiers, permissions, access, configurations, integrations/API, automations and usage events;

4.4.9.any other personal data entered, imported, synchronized, transmitted, uploaded, generated or processed by the Customer, its Authorized Users or third parties under its responsibility.

4.5.Netwiz Systems does not, as a rule, request special categories of personal data through the Website, general forms, contact requests, chat, diagnostics, quote requests or commercial communications. The data subject must not submit data relating to health, racial or ethnic origin, political opinions, religious or philosophical convictions, trade union membership, genetic data, biometric data intended for unequivocal identification, sexual life or sexual orientation, except when this is strictly necessary, legally permissible and expressly requested in the context of the specific service.

4.6.Within the scope of platforms used by Customers, particularly in recruitment processes, the processing of special categories of personal data or sensitive data may occur if the candidate, Customer or Authorized User enters, uploads, attaches or transmits them. In these cases, except when Netwiz Systems autonomously determines the purposes and means of the processing, the Customer will be responsible for ensuring the lawfulness of the processing, information to data subjects, the appropriate legal basis and the minimization of the data processed.

4.7.Netwiz Systems may process personal data contained in documents, files, images, videos, audios, messages, databases, CVs, forms, content or attachments submitted by the data subject, the Customer, Authorized Users or third parties under the Customer's responsibility. Netwiz Systems does not assume a general obligation to previously verify the legality, accuracy, necessity or suitability of all data entered, uploaded or transmitted by Customers on contracted platforms or services.

4.8.When the data subject provides personal data of third parties, they declare that they have the appropriate legal basis or authorization to do so, being responsible for ensuring that these third parties were duly informed about the processing of their personal data, except when this obligation falls directly to Netwiz Systems under the applicable legal terms.

4.9.The use of Artificial Intelligence tools, automations, classifications, recommendations, information analysis or equivalent functionalities may involve the processing of personal data introduced, transmitted or made available in the context of the functionality used. Whenever these functionalities are used by Customers for their own purposes, it is the Customer's responsibility to ensure the legality, minimization, adequacy and human validation of the associated data, instructions, inputs, prompts and outputs.

4.10.Netwiz Systems may process anonymized, aggregated or statistical data for the purposes of security, analysis, service improvement, technical development, auditing, performance control, internal statistics, reports, abuse detection or evolution of its platforms, provided that such data does not allow the direct or indirect identification of a natural person. When data is only pseudonymized and can still be associated with a natural person, it will continue to be treated as personal data under the GDPR.

4.11.The specific categories of personal data processed may vary depending on the applicable service, platform, plan, subscription, license, contract, form, integration, module, functionality or Specific Conditions. Additional information may be provided at the time of data collection, during the hiring process, in the reserved area, on a specific form, in the Specific Conditions or in a Data Processing Agreement (“DPA”), when applicable.

5.Purposes and legal bases for processing.

5.1.Netwiz Systems processes personal data only when there is an adequate lawful basis, in accordance with the GDPR, namely execution of a contract or pre-contractual measures, compliance with a legal obligation, legitimate interests, consent, defense of rights or, when applicable, other legally permissible grounds.

5.2.Netwiz Systems may process personal data for the following purposes, with the respective legal grounds:

5.2.1.Website management, navigation and technical operation Purpose: to allow access, navigation, operation, security, maintenance, improvement and technical management of the Website netwiz.pt, subdomains, domains, applications, APIs, reserved areas, platforms, systems, technical environments and functionalities under the control of Netwiz Systems. Lawful basis: legitimate interests of Netwiz Systems in the management, security and improvement of its digital services; execution of a contract or pre-contractual measures when navigation is associated with an Account, subscription, service or contracted functionality; compliance with legal obligations when applicable.

5.2.2.Response to contact requests, quote requests, diagnoses, forms and communications Purpose: to receive, analyze, respond to and manage contact requests, quote requests, diagnoses, appointments, messages, forms, briefings, proposal requests or other communications sent by the data subject. Lawful basis: pre-contractual measures at the request of the data subject or the Customer; execution of a contract when there is a contractual relationship; legitimate interests in managing communications and responding to requests; consent when the specific purpose requires it.

5.2.3.Commercial management, proposals, contracts and relationships with Customers Purpose: manage leads, commercial opportunities, proposals, budgets, negotiations, contracts, orders, accounts, subscriptions, licenses, services, courses, training, support and relationships with Customers or potential Customers. Lawfulness basis: execution of contract or pre-contractual measures; legitimate interests in the commercial and administrative management of Netwiz Systems’s activity; compliance with legal obligations when applicable.

5.2.4.Account creation and management, reserved areas, subscriptions, licenses and platforms Purpose: create, authenticate, manage and maintain Accounts, Netwiz ID, reserved areas, access, permissions, profiles, subscriptions, plans, licenses, features, usage history, configurations and contracted services. Lawfulness basis: execution of contract; pre-contractual due diligence; legitimate interests in security, management and access control; compliance with legal obligations when applicable.

5.2.5.Provision of services, support, maintenance, integration and contractual execution Purpose: to provide professional, technical, digital, consultative, training, web design, digital communication, development, support, maintenance, integration, automation, AI, SaaS platforms, usage licenses and other contracted services. Lawfulness basis: execution of contract; pre-contractual due diligence; legitimate interests in the execution, organization and improvement of services; compliance with legal obligations when applicable.

5.2.6.Training, online courses, digital content and certification Purpose: manage registrations, access, participation, progress, pedagogical communications, attendance, assessments, issuing certificates, provision of digital content, training support and administration of courses or training. Lawfulness basis: execution of contract; pre-contractual due diligence; compliance with legal or administrative obligations when applicable; legitimate interests in pedagogical and operational management; consent when legally required for a specific purpose.

5.2.7.Payments, invoicing, accounting and tax compliance Purpose: process payments, issue invoices, receipts, credit notes, manage collections, refunds, regularizations, accounting, tax documentation and associated legal obligations. Lawfulness basis: execution of contract; compliance with legal, tax, accounting and administrative obligations; legitimate interests in financial management, collection and defense of rights.

5.2.8.Operational, contractual, technical and security communications Purpose: to send communications necessary for the execution of orders, contracts, subscriptions, licenses, services, courses, support, technical changes, security, Account notifications, maintenance, incidents, payments, billing or legal obligations. Lawfulness basis: execution of contract; compliance with legal obligations; legitimate interests in communicating with Customers, Users and data subjects.

5.2.9.Commercial communications, newsletters, campaigns and promotion of services Purpose: to send commercial communications, newsletters, campaigns, promotion of services, platforms, courses, content, events, news or institutional information from Netwiz Systems. Lawful basis: consent of the data subject when legally required; legitimate interests in the context of a prior commercial relationship, when admissible and without prejudice to the right to object; compliance with the rules applicable to electronic communications and direct marketing.

5.2.10.Virtual Assistant, chat, pre-screening and user support Purpose: manage chat interactions, provide navigation support, pre-screen orders, forward contacts, answer simple questions, ensure service continuity, auditing, security and service improvement. Lawfulness basis: pre-contractual due diligence; contract execution when applicable; legitimate interests in service management, user support, security and service improvement; consent when required for specific functionalities.

5.2.11.Artificial Intelligence functionalities, automations and decision support Purpose: to provide AI functionalities, automations, classification, recommendation, content generation, information analysis, pre-screening, operational support, automated or assisted responses, under the terms applicable to the service or platform used. Lawfulness basis: execution of contract; pre-contractual due diligence; legitimate interests in the provision, improvement and innovation of services; consent when required; compliance with legal obligations when applicable.

5.2.12.Recruitment platforms, candidate management and selection processes Purpose: when applicable, allow the publication of opportunities, collection of applications, candidate management, profile analysis, pipeline organization, team management, approvals, internal notes, evaluations, classifications, communications and other operations associated with recruitment processes. Lawful basis: when Netwiz Systems acts as responsible, execution of contract, pre-contractual measures, legitimate interests or consent, as applicable; when Netwiz Systems acts as a processor, the basis of lawfulness must be defined by the Customer as controller.

5.2.13.Security, fraud prevention, abuse control and systems integrity Purpose: protect the Website netwiz.pt, subdomains, domains, applications, APIs, Accounts, reserved areas, Netwiz Solutions/Platforms, platforms, systems, technical environments, integrations/API, data, infrastructure, Users, Customers and third parties against improper access, fraud, spam, abuse, incidents, vulnerabilities, illicit use or attacks. Legal basis: legitimate interests of Netwiz Systems, Customers and users in the security and integrity of systems; compliance with legal obligations; contract execution when applicable.

5.2.14.Logs, audit, electronic proof and defense of rights Purpose: to maintain technical records, logs, evidence of acceptance, versions of accepted documents, communications, submissions, payments, Account actions, security events, tickets, interactions, consent records and other evidence necessary for auditing, proof, dispute management, fraud prevention and defense of rights. Lawful basis: legitimate interests in proof, security, auditing and defense of rights; compliance with legal obligations; contract execution when applicable.

5.2.15.Compliance with legal, regulatory, judicial or administrative obligations Purpose: to comply with legal, tax, accounting, administrative, regulatory, judicial obligations, cooperation with public authorities, fraud prevention, response to notifications, complaints, audits, processes or legally required requests. Lawfulness basis: compliance with legal obligation; exercise or defense of rights in judicial, administrative or extrajudicial proceedings; legitimate interests where applicable.

5.2.16.Management of complaints, requests for rights and formal communications Purpose: to receive, analyze and respond to complaints, requests to exercise rights, requests for clarification, formal communications, notifications, incidents, support requests, requests for correction, erasure, opposition, limitation or portability. Lawfulness basis: compliance with legal obligation; legitimate interests in managing requests, proving and defending rights; contract execution when applicable.

5.2.17.Improvement, development, statistics, analysis and evolution of services Purpose: to analyze the use of services, improve functionalities, performance, security, user experience, quality of support, technical evolution, development of new solutions, internal statistics, reports and incident prevention, preferably with anonymized or aggregated data when possible. Lawful basis: legitimate interests of Netwiz Systems in the improvement, security, development and evolution of its services; consent when required for a certain technology or purpose.

5.3.When processing is necessary for the execution of a contract or pre-contractual measures, failure to provide the necessary personal data may prevent the response to the request, submission of a proposal, conclusion of the contract, creation of an Account, provision of the service, issuing of invoices, provision of access, support, training, subscription, licensing or use of the platform.

5.4.When the basis of lawfulness is consent, the data subject may withdraw consent at any time, without this compromising the lawfulness of the processing carried out based on the consent previously given. Withdrawal of consent may prevent the continuity of the associated purpose, namely sending newsletters, commercial communications, certain optional features or processing dependent on consent.

5.5.When processing is based on legitimate interests, Netwiz Systems will weigh its legitimate interests against the rights, freedoms and interests of data subjects, taking into account the purpose of processing, the relationship with the data subject, reasonable expectations, data minimization and applicable safeguards. The data subject may object to processing based on legitimate interests under the terms set out in this Privacy Policy and applicable legislation.

5.6.When Netwiz Systems acts as a processor, the purposes and lawfulness of the processing will be determined by the Customer as controller, and Netwiz Systems will process personal data only in accordance with the Customer's documented instructions, the contract, the Specific Conditions and, where applicable, the Data Processing Agreement (“DPA”).

5.7.Netwiz Systems will not use personal data processed on behalf of Customers for its own purposes incompatible with the instructions received, except when required by law, necessary for security, auditing, fraud prevention, defense of rights or permitted on an autonomous and duly documented legal basis.

5.8.The use of personal data for training, tuning, validation or development of Artificial Intelligence models will only be carried out when there is an adequate legal basis, sufficient information to the data subjects, appropriate safeguards and, when applicable, documented instructions from the Customer as controller. When Netwiz Systems uses third-party AI providers, the respective technical and contractual conditions may apply, without prejudice to applicable legal obligations in terms of data protection.

5.9.Whenever possible and appropriate, Netwiz Systems may use anonymized, aggregated or statistical data for the purposes of analysis, security, improvement, development, testing, demonstration, internal research, reporting or evolution of its solutions. Anonymized data that does not allow the direct or indirect identification of a natural person is not considered personal data for the purposes of the GDPR.

5.10.Netwiz Systems may retain personal data when necessary to comply with legal obligations, prove contractual compliance, defend rights, manage disputes, audit, security, fraud prevention, respond to authorities, recover incidents or demonstrate compliance, for the period necessary and proportionate to these purposes.

6.Data processing on the Website, platforms, forms, chat and communications.

6.1.Netwiz Systems may process personal data in connection with accessing, browsing and using the Website netwiz.pt, subdomains, domains, applications, APIs, reserved areas, platforms, systems, technical environments, contact pages, forms, diagnostics, quote requests, information requests, chat, checkout, subscriptions, licenses, courses and other digital functionalities under the control of Netwiz Systems.

6.2.In the context of the Website, subdomains, domains, applications, APIs, reserved areas, platforms, systems, technical environments or functionalities under the control of Netwiz Systems, Netwiz Systems may collect and process data provided directly by the User, namely when the User:

6.2.1.submits a contact form, quote request, proposal request, diagnosis or appointment;

6.2.2.interacts with the Virtual Assistant, chat, support systems or other service channels;

6.2.3.creates or uses an Account, reserved area or authenticated functionality;

6.2.4.subscribes to a newsletter, commercial communication or request for information;

6.2.5.contracts services, courses, subscriptions, licenses, digital content or platforms;

6.2.6.makes payments, refund requests, complaints, support requests or formal communications;

6.2.7.sends documents, files, images, messages, content, briefings, technical data or other elements necessary for the analysis or execution of a request.

6.3.The data processed in this context may include, as applicable, name, email, telephone, company, position, NIF, address, billing data, payment data, message sent, intended service, technical information, attached files, Account data, acceptance records, communications history, technical logs, IP address, date and time of submission, technical identifiers and other information necessary for the specific purpose.

6.4.The forms available on the Website, subdomains, domains, applications, APIs, reserved areas, platforms, systems, technical environments or functionalities under the control of Netwiz Systems are intended exclusively for the purposes indicated in each case, including receiving requests, responding to contacts, analyzing needs, sending proposals, providing clarifications, commercial management, support, contracting or compliance with legal obligations. Submission of data through a form does not imply automatic acceptance of contracting, obligation to provide services or contractual relationship, under the terms set out in the Terms and Conditions of Use of the Website.

6.5.The User must ensure that the personal data they provide are true, current, complete, lawful, adequate and limited to what is necessary for the intended purpose. The User must not insert excessive personal data, special categories of personal data, third-party data, confidential data, credentials, commercial secrets or unnecessary information into forms, messages, chats or attachments, except when strictly necessary, legally permissible and expressly requested by Netwiz Systems.

6.6.When the User provides personal data of third parties through the Website, subdomains, domains, applications, APIs, reserved areas, platforms, systems, technical environments or functionalities under the control of Netwiz Systems, he declares that he has the appropriate legal basis or authorization to do so and that he has provided the respective data subjects with the legally required information, except when this obligation lies directly with the Netwiz Systems.

6.7.The Website, subdomains, domains, applications, APIs, reserved areas, platforms, systems, technical environments or functionalities under the control of Netwiz Systems may provide chat functionalities, Virtual Assistant, pre-screening, human support, automatic responses or responses assisted by Artificial Intelligence. Interactions carried out through these means can be recorded and processed for the purposes of request management, routing, continuity of service, security, auditing, service improvement, proof of communications and defense of rights.

6.8.Automatic or Artificial Intelligence-assisted responses are instrumental and supportive in nature and may contain inaccuracies, omissions or incorrect interpretations. The User must request human confirmation whenever the information is relevant to a contractual, technical, legal, tax, financial, professional or operational decision. The use of the Virtual Assistant and AI functionalities is also subject to the Website Terms and Conditions of Use, when applicable.

6.9.Communications made with Netwiz Systems, including emails, forms, chat, tickets, messages, calls, meetings, responses, proposals and other contacts, may be kept for the period necessary for order management, contractual execution, compliance with legal obligations, audit, security, evidence, dispute resolution and defense of rights.

6.10.Netwiz Systems may use its own or third-party tools to manage contacts, forms, chat, CRM, support, security, anti-spam, automatic validation, electronic communications, automations, payments, invoicing, technical records and evidence of acceptance. These third parties may act as technical processors or independent controllers, depending on the nature of the service and the applicable legal framework.

6.11.The Website netwiz.pt, subdomains, domains, applications, APIs, reserved areas, platforms, systems, technical environments and functionalities under the control of Netwiz Systems may collect technical data and logs associated with browsing, access and use, including IP address, technical identifiers, browser, device, operating system, pages visited, date and time of access, security events, authentication attempts, technical errors and interactions with functionalities. This data may be processed to ensure security, technical functioning, fraud prevention, abuse control, auditing, internal statistics, service improvement and defense of rights.

6.12.Netwiz Systems may implement security mechanisms, automatic validation, submission limitation, anti-spam control, anti-bot mechanisms, access blocking, abuse detection and other proportionate technical measures to protect the Website netwiz.pt, subdomains, domains, applications, APIs, reserved areas, platforms, systems, technical environments, data, Users, Customers and infrastructure. The processing of this data is, as a rule, based on the legitimate interests of Netwiz Systems and users in system security, as well as compliance with legal obligations when applicable.

6.13.The sending of operational, contractual, technical, administrative, support, security, billing or legal compliance communications can be carried out through the contacts provided by the User or Customer, as it is necessary to execute orders, contracts, subscriptions, licenses, services or legal obligations.

6.14.The sending of commercial communications, newsletters, campaigns, advertising of services, training, platforms, content or news from Netwiz Systems will only be carried out when there is an adequate legal basis, including consent when required or legitimate interest in a legally permissible context.

6.15.The data subject may withdraw consent or oppose the sending of commercial communications through the mechanisms provided in the communication itself or through the contact indicated in this Privacy Policy. The withdrawal of consent does not compromise the lawfulness of the processing carried out based on the consent previously provided.

6.16.The use of cookies, pixels, tags, identifiers, scripts, measurement technologies, preferences, statistics, marketing or similar technologies will be regulated in the Cookies and Similar Technologies Policy. When these technologies involve the processing of personal data, the relevant provisions of this Privacy Policy also apply.

6.17.Netwiz Systems may retain electronic evidence related to the submission of forms, acceptance of legal documents, consents, preferences, communications, requests, payments, Account actions and use of functionalities, including date, time, IP, technical identifier, version of accepted documents and content of the interaction, when necessary for proof, security, contractual execution, legal compliance or defense of rights.

6.18.The processing of data on the Website, subdomains, domains, applications, APIs, reserved areas, platforms, systems, technical environments, forms, chat and communications will be carried out in a proportional, transparent and limited manner to the applicable purposes, without prejudice to the rights of data subjects provided for in the GDPR.

7.Data processing in Netwiz Solutions/Platforms and SaaS services.

7.1.Netwiz Systems may provide Netwiz Solutions/Platforms, SaaS services, usage licenses, modules, integrations, APIs, applications, systems, technical environments, automations, reserved areas, management tools, recruitment platforms, communication solutions, CRM, messaging systems, Artificial Intelligence functionalities and other proprietary or integrated digital services, including, in particular, Netwiz SocialHub, Netwiz LeadDesk, Netwiz TalentHub, Netwiz Nexus, Netwiz Intelligence, Netwiz Consent Manager, online course comparison platforms and other platforms, modules, functionalities or solutions that may be developed or integrated into the Netwiz ecosystem.

7.2.Within the scope of these Netwiz Solutions/Platforms, Netwiz Systems may process personal data in two distinct capacities:

7.2.1.as controller, when autonomously determining the purposes and means of processing, namely for Account management, billing, security, support, logs, communications, contracting, subscription management, service improvement, fraud prevention, auditing and defense of rights;

7.2.2.as a processor, when processing personal data on behalf of the Customer and in accordance with its documented instructions, namely data from customers, candidates, workers, users, contacts, leads, followers, recipients of communications, trainees or other data subjects associated with the Customer's activity.

7.3.When Netwiz Systems acts as a processor, the Customer is, as a rule, controller of personal data entered, uploaded, imported, synchronized, collected, managed, exported, analyzed or processed through the Netwiz Solutions/Platforms. The Customer is responsible for ensuring the lawfulness of the processing, providing information to data subjects, defining grounds for lawfulness, managing consents when necessary, establishing retention periods, responding to rights requests and complying with applicable legal obligations.

7.4.The processing carried out by Netwiz Systems as a processor will be regulated by the contract, proposal, Specific Conditions, documented instructions from the Customer and, when applicable, by a Data Processing Agreement (“DPA”).

7.5.Netwiz Solutions/Platforms may allow, depending on the service, the collection, insertion, import, synchronization, classification, organization, consultation, communication, export, storage, deletion, anonymization, analysis or management of personal data, including data from customers, leads, candidates, users, representatives, workers, recipients of communications, followers, buyers, trainees or other data subjects related to the Customer's activity.

7.6.In the case of recruitment and application management platforms, including solutions such as Netwiz TalentHub, data relating to job opportunities, candidates, selection processes, recruitment teams, decision-makers, approvals, communications and application history may be processed. Such data may include, in particular, identification, contacts, CV, training, professional experience, skills, salary data, professional expectations, availability, attached documents, internal notes, evaluations, classifications, pipeline statuses and decisions associated with the process.

7.7.The Customer using recruitment platforms is responsible for ensuring that:

7.7.1.informs candidates and other data subjects about the processing of their data;

7.7.2.defines the legal basis applicable to the collection, analysis, retention and eventual communication of data;

7.7.3.collects only adequate, pertinent and necessary data for the process;

7.7.4.defines retention periods compatible with the purpose of recruitment;

7.7.5.ensures response to requests for access, rectification, erasure, opposition, limitation or portability;

7.7.6.guarantees the confidentiality of grades, evaluations, classifications and internal decisions;

7.7.7.complies with labor legislation, data protection, equality, non-discrimination and other applicable rules.

7.8.Netwiz Systems is not responsible for the lawfulness, necessity, proportionality, accuracy or adequacy of the personal data that the Customer, its Authorized Users or third parties under their responsibility introduce, import, upload, synchronize, classify, process, export or store in the Netwiz Solutions/Platforms, except when the non-conformity results from an act of its own attributable to the Netwiz Systems as controller.

7.9.The Customer must ensure that the data entered into the Netwiz Solutions/Platforms does not include special categories of personal data, excessive personal data, sensitive data, credentials, commercial secrets, third party data without a legal basis or information unnecessary for the intended purpose, except when this is legally permissible, necessary and covered by an adequate legal basis.

7.10.Whenever Netwiz Solutions/Platforms allow integrations with websites, databases, social networks, messaging systems, external platforms, payment methods, APIs, AI tools, cloud services or Customer systems, the Customer is responsible for configuring permissions, access, keys, tokens, credentials, synchronization criteria, processed fields, automations, recipients, retentions and usage rules in a lawful, safe and appropriate manner.

7.11.Netwiz Systems may process technical data, logs, metadata, access records, authentication events, Authorized User actions, permissions, configurations, usage history, errors, security alerts, integration records, API calls, evidence of consent, acceptance records and operational events necessary for the provision, security, maintenance, auditing, support, fraud prevention, improvement and defense of rights relating to Netwiz Solutions/Platforms.

7.12.Netwiz Solutions/Platforms may include Artificial Intelligence functionalities, automations, pre-screening, recommendations, analysis, classification, decision support, content generation or automated responses. These functionalities must be used by the Customer in a lawful, proportionate, transparent manner and subject to adequate human validation, especially when candidates, clients, consumers, workers or decisions with a relevant impact on natural persons are involved.

7.13.When the Customer uses Artificial Intelligence functionalities in Netwiz Solutions/Platforms, it is responsible for the data, inputs, prompts, parameters, criteria, documents, content and instructions that it introduces or configures, and must ensure that it has a legal basis for such use, that the data is adequate and necessary, that the data subjects have been informed when applicable and that the outputs are reviewed before any decision, publication, communication or operational use.

7.14.Netwiz Systems may use its own or third-party models, APIs, systems, suppliers or Artificial Intelligence tools, according to the technical, functional and contractual needs of the service. The use of AI systems must comply with the GDPR, applicable data protection legislation and, where applicable, the European regime on Artificial Intelligence.

7.15.Unless otherwise agreed in writing, Netwiz Systems will not use Customer Data processed as a processor to train public models or third-party AI systems in a manner that is incompatible with the Customer's instructions, the applicable DPA or data protection legislation. Any use for development, testing, improvement or analysis will be carried out on an appropriate legal basis and, whenever possible, using anonymised, aggregated or technically protected data.

7.16.When Netwiz Solutions/Platforms are installed, integrated or used on websites, domains, servers, databases, systems, tools or environments controlled by the Customer, the main privacy policy applicable to data subjects must be the Customer's own policy, and it is up to the Customer to ensure its publication, update, adequacy and legal compliance.

7.17.When the Customer exports, downloads, extracts, copies, transfers, archives or makes backup copies of personal data processed in the Netwiz Solutions/Platforms, it will be responsible for the retention, security, legality, access, use, transmission, deletion and other subsequent processing of this data, except when Netwiz Systems acts autonomously as responsible for specific subsequent processing.

7.18.Netwiz Systems may provide export, backup, retention, deletion, anonymization or data retention functionalities depending on the applicable service, plan, subscription, license or Specific Conditions. Unless otherwise agreed in writing, the Customer is responsible for ensuring the timely export of the data it intends to retain and for maintaining adequate backup copies for the continuity of its activity.

7.19.After termination of service, closure of Account, end of subscription, plan, license or continued service, personal data processed in Netwiz Solutions/Platforms may be preserved, blocked, anonymized or eliminated under the terms set out in this Policy, in the Specific Conditions, in the applicable DPA and in current legislation, without prejudice to legal obligations of retention, security, auditing, invoicing, defense of rights or compliance with documented instructions of the Customer.

7.20.Netwiz Systems may refuse, suspend, limit or not execute operations, imports, integrations, automation, exports, instructions or requests from the Customer that are manifestly illegal, unsafe, excessive, incompatible with the contract, technically unfeasible or likely to violate the rights of data subjects, data protection rules, security, intellectual property, confidentiality, third party policies or applicable legislation.

7.21.Access to Netwiz Solutions/Platforms, including when carried out through Netwiz ID, must be limited to Users Authorized by the Customer, with permissions appropriate to their respective functions. The Customer is responsible for creating, managing, reviewing and revoking access, ensuring the confidentiality of credentials, managing the use of Netwiz ID within its organization, activating reinforced authentication mechanisms when available and immediately reporting any suspicion of improper access, data breach or unauthorized use.

7.22.Netwiz Systems may apply technical and organizational measures proportional to the nature, scope, context and purpose of the processing, including access control, authentication, permissions management, activity records, encryption when applicable, technical copies, monitoring, access limitation, logical segregation, backups, retention policies, infrastructure security and measures to prevent fraud, abuse or improper access.

7.23.Netwiz Systems may use categories of technical processors to ensure hosting, infrastructure, maintenance, security, support, backups, communications, payments, AI, automations, cloud services, databases, monitoring, auditing or other services necessary for the availability and continuity of Netwiz Solutions/Platforms. Identification by categories allows you to maintain adequate transparency without exposing sensitive information about infrastructure, suppliers or technical architecture.

7.24.The rules set out in this section apply without prejudice to the Specific Conditions, terms of each platform, concluded contracts, applicable DPA, documented instructions from the Customer and other legal documents of Netwiz Systems. This Policy must be interpreted in conjunction with the Terms and Conditions of Use of the Website, particularly regarding Customer Data, export, backups, retention, deletion, AI, integrations/API, termination and Customer responsibility.

8.Data processed in the context of Artificial Intelligence, automations and outputs.

8.1.Netwiz Systems may provide, integrate or use Artificial Intelligence functionalities, automations, algorithmic models, classification systems, data analysis, content generation, pre-screening, recommendation, decision support, virtual assistants, chatbots, productivity tools, third-party APIs or equivalent solutions, within the scope of the Website, Netwiz Solutions/Platforms, services SaaS, professional services, training, online courses, support, digital communication, recruitment, lead management and other contracted services.

8.2.The use of Artificial Intelligence or automation functionalities may involve the processing of personal data, particularly when data is introduced, uploaded, imported, synchronized, analyzed or generated relating to Users, Customers, Customer representatives, candidates, workers, trainees, leads, contacts, followers, communications recipients, Customers' End Customers or other data subjects.

8.3.Personal data processed in this context may include, depending on the functionality used, identification data, contact, professional data, CV data, salary data, messages, interactions, documents, images, content, prompts, instructions, classifications, notes, evaluations, usage history, technical data, logs, application data, support data, commercial data or other data entered by the data subject, the Customer, Authorized Users or third parties under the Customer's responsibility.

8.4.When Netwiz Systems uses Artificial Intelligence functionalities for its own purposes, as controller, the processing will be carried out on an appropriate legal basis, including, as applicable, execution of a contract, pre-contractual due diligence, legitimate interests, consent, compliance with legal obligations, security, auditing, service improvement or defense of rights.

8.5.When Netwiz Systems processes personal data through Artificial Intelligence functionalities on behalf of a Customer, within the scope of Netwiz Solutions/Platforms or contracted services, it will, as a rule, act as a processor, with the Customer being responsible for defining the purposes, legal grounds, processed data, usage criteria, retention periods, information to data subjects, need for consent, impact assessment and other applicable obligations.

8.6.The Customer is responsible for the data, prompts, instructions, parameters, criteria, documents, files, content, integrations, databases, fields, automation rules and configurations that it introduces, uploads, synchronizes or defines in the Artificial Intelligence or automation functionalities, and must ensure that it has an adequate legal basis for the respective processing.

8.7.The Customer must not introduce into Artificial Intelligence or automation tools special categories of personal data, sensitive personal data, excessive data, third party data without legal basis, credentials, commercial secrets, confidential information or data unnecessary for the intended purpose, except when this is legally permissible, technically adequate, contractually foreseen and subject to the necessary safeguards.

8.8.Artificial Intelligence functionalities can produce outputs, responses, classifications, recommendations, analyses, suggestions, summaries, contents, descriptions, preliminary decisions, rankings, screenings or other automated or assisted results. These outputs are auxiliary and instrumental in nature, not replacing human validation, professional decision-making, legal, tax, medical, financial, technical, labor, commercial or strategic analysis.

8.9.The Customer, User or data subject who uses Artificial Intelligence outputs is responsible for their review, validation, correction, approval and decision on use, especially before any publication, communication to third parties, sending to candidates, clients or consumers, use in recruitment processes, commercial decision, advertising campaign, contractual documentation, performance analysis, classification, recommendation or decision with a relevant impact on natural persons.

8.10.Whenever exclusively automated decisions are at stake, including profiling, which produce legal effects on the data subject or which significantly affect him or her in a similar way, the restrictions and guarantees provided for in the GDPR and applicable legislation must be observed, including the data subject's right not to be subject to certain exclusively automated decisions, under legally applicable terms.

8.11.In particular, on platforms or functionalities related to recruitment, selection, evaluation, classification or analysis of candidates, the use of AI or automations must be configured and used in a transparent, proportionate, non-discriminatory manner, subject to adequate human supervision and compatible with applicable legislation on data protection, labor, equality, non-discrimination, fundamental rights and, where applicable, Artificial Intelligence.

8.12.Netwiz Systems may use its own or third-party tools, models, APIs, infrastructure, systems or Artificial Intelligence suppliers, according to the technical, functional, operational or contractual needs of the service. The use of these suppliers may involve the transmission or technical processing of data, prompts, content or metadata strictly necessary for the execution of the functionality, in accordance with this Policy, the Specific Conditions, the applicable DPA and the adopted security rules.

8.13.For reasons of security, commercial confidentiality, infrastructure protection and abuse prevention, Netwiz Systems may identify Artificial Intelligence and automation providers by categories, such as providers of AI models, AI APIs, cloud services, technical processing, automated classification, language analysis, content generation, translation, transcription, automation, monitoring or security, except when nominative identification is legally required or necessary to ensure the rights of the data subjects.

8.14.Unless otherwise agreed in writing, documented instruction from the Customer or specific legal basis, Netwiz Systems will not use personal data processed on behalf of Customers to train public Artificial Intelligence models or third-party systems in a manner incompatible with the DPA, the Specific Conditions, the Customer's instructions or applicable legislation.

8.15.Netwiz Systems may use anonymized, aggregated or statistical data to improve, test, develop, audit, monitor or protect its solutions, provided that such data does not allow the direct or indirect identification of a natural person. When data is only pseudonymized, it continues to be considered personal data and subject to the GDPR.

8.16.Netwiz Systems may implement minimization measures, pseudonymization, anonymization, access limitation, logical segregation, encryption when applicable, log recording, permissions control, security filters, human supervision, blocking of inappropriate inputs, limitation of outputs and other technical or organizational measures appropriate to the risk, purpose and context of the use of Artificial Intelligence.

8.17.Netwiz Systems does not guarantee that Artificial Intelligence outputs are always correct, complete, updated, legally compliant, original, exclusive, free from errors, free from bias, suitable for the specific purpose or free from similarity with content, responses, recommendations or outputs generated for third parties. The use of outputs is subject to the Website's Terms and Conditions of Use, including rules relating to human validation, Customer responsibility, intellectual property and limitation of liability.

8.18.Netwiz Systems may suspend, limit, block or refuse the use of Artificial Intelligence functionalities when it detects, or has reason to suspect, illicit, abusive, discriminatory, unsafe, fraudulent use, contrary to third party policies, violating the rights of data subjects, violating intellectual property rights, violating confidentiality, incompatible with data protection or likely to compromise the security, reputation or integrity of Netwiz Systems, Customers, data subjects or third parties.

8.19.Whenever the use of Artificial Intelligence or automation by the Customer implies high risks to the rights and freedoms of data subjects, it will be up to the Customer, as controller, to assess the need to carry out an impact assessment on data protection, define mitigation measures, provide adequate information to data subjects and ensure the existence of human intervention, contestation and review mechanisms, when legally applicable.

8.20.When applicable, Netwiz Systems may reasonably cooperate with the Customer, within the scope and limits of the contract, Specific Conditions or DPA, providing technical information available and necessary to support compliance with data protection obligations related to Artificial Intelligence or automation functionalities.

8.21.The use of Artificial Intelligence, automations or outputs within the scope of Netwiz Solutions/Platforms must be interpreted in conjunction with the Terms and Conditions of Use of the Website, namely the rules relating to AI functionalities, outputs, Customer Data, Customer responsibility, human validation, third-party APIs, intellectual property, limitation of liability and third-party services.

9.Recipients, categories of processors and technical suppliers.

9.1.Netwiz Systems may communicate, make available or allow access to personal data only when necessary, appropriate and proportionate to the purposes described in this Privacy Policy, the fulfillment of legal obligations, the execution of contracts, the provision of services, security, technical maintenance, the defense of rights or the use of Netwiz Solutions/Platforms.

9.2.For the purposes of this Privacy Policy, personal data may be communicated or made available to the following categories of recipients, depending on the applicable purpose:

9.2.1.employees, managers, representatives, consultants, providers or internal teams of Netwiz Systems who need access to data to perform their respective functions;

9.2.2.providers of hosting, infrastructure, servers, cloud, databases, maintenance, monitoring, security, backups and service continuity;

9.2.3.development providers, technical support, systems administration, platform management, integrations/API, automations and application maintenance;

9.2.4.providers of email, electronic communications, notifications, support systems, tickets, CRM, lead management and customer relationships;

9.2.5.payment providers, gateways, financial entities, banks, digital wallets, billing, anti-fraud, refunds and transaction processing services;

9.2.6.providers of accounting, invoicing, tax management, auditing, legal advice, consultancy and legal compliance;

9.2.7.providers of Artificial Intelligence, automation, analysis, classification, decision support, content generation, language processing, transcription, translation, chatbot or equivalent functionalities;

9.2.8.providers of analytics, statistics, performance measurement, security, abuse prevention, anti-spam, anti-bot and technical control;

9.2.9.social media platforms, external systems, APIs, websites, online stores, messaging systems or integrated tools, when this results from the configuration or use made by the Customer or the data subject;

9.2.10.public, administrative, fiscal, judicial, police, regulatory authorities or legally competent entities, when there is a legal obligation, legitimate order, need for cooperation or defense of rights;

9.2.11.successor entities, acquirers, companies in the same group, partners or third parties in the context of corporate reorganization, merger, spin-off, transfer of establishment, transfer of assets, assignment of contractual position or equivalent operation, under legally permissible terms.

9.3.The communication or provision of personal data to recipients or processors will be limited to what is strictly necessary for the applicable purpose, and these recipients must process the data in accordance with applicable legal, contractual and security terms.

9.4.When third parties process personal data on behalf of Netwiz Systems, they will act as processors and will be subject to appropriate contractual obligations in terms of confidentiality, security, documented processing, purpose limitation, support for the exercise of rights, incident management and deletion or return of data, in accordance with the GDPR.

9.5.When third parties autonomously determine the purposes and means of processing, they may act as independent data controllers, being responsible for their own privacy policies, terms, security measures and legal compliance. This may occur, in particular, with certain payment providers, banks, external platforms, social networks, third-party services, public authorities or tools contracted directly by the Customer.

9.6.When Netwiz Systems acts as a processor on behalf of a Customer, it may use subsequent processors to ensure hosting, infrastructure, security, support, maintenance, backups, communications, AI, automation, monitoring, cloud services, technical processing or other services necessary for the execution of Netwiz Solutions/Platforms. The use of subsequent processors will be governed by the contract, Specific Conditions or applicable DPA.

9.7.Under the GDPR, when Netwiz Systems acts as a processor, it will only use another processor when there is specific or general authorization from the controller, under the terms of the applicable contract or DPA. In the case of general authorization, mechanisms may be provided for providing information on relevant changes and the possibility of opposition, under contractually defined terms.

9.8.Netwiz Systems may identify suppliers, recipients and processors by categories, instead of disclosing specific commercial names, when this is sufficient to ensure adequate transparency and when name disclosure could compromise security, commercial confidentiality, infrastructure protection, abuse prevention, risk management or systems protection.

9.9.The identification by name of suppliers, processors or recipients will only be carried out when legally required, necessary to ensure the rights of data subjects, provided for in the contract, DPA or Specific Conditions, or when Netwiz Systems deems it appropriate depending on the nature of the processing.

9.10.The data subject is informed that certain technical operations may depend on third parties, namely hosting, infrastructure, communications, payments, AI, cloud systems, security, backups, support, analytics, CRM, email, automations and integrations/API. The use of these categories of providers may be necessary for the availability, security, continuity, improvement and execution of Netwiz Systems services.

9.11.When the Customer configures or requests integrations with external services, including social networks, advertising platforms, job portals, messaging systems, websites, databases, payment gateways, APIs, AI tools, CRM, third-party systems or external applications, the Customer is responsible for verifying the legality of such integration, the permissions granted, the data transmitted, the applicable terms of these third parties and the information to be provided to data subjects.

9.12.Netwiz Systems is not responsible for the privacy policies, terms, practices, security measures, decisions, limitations, unavailability, suspensions, changes, costs or autonomous processing operations carried out by third parties acting as independent responsible parties, except when the responsibility results from Netwiz Systems's own act under the legally applicable terms.

9.13.Access to personal data by employees, providers or processors of Netwiz Systems will be limited to those who need to access the data to carry out the applicable purposes, with proportional measures of confidentiality, access control, authentication, permissions management, activity recording and security being adopted.

9.14.Netwiz Systems may communicate personal data to public authorities, courts, administrative, tax, police, regulatory entities or other legally competent entities when necessary to comply with a legal obligation, legitimate order, cooperation with competent authority, prevention of illicit acts, investigation, response to proceedings, collection, audit, defense of rights or protection of system security.

9.15.In corporate operations, reorganizations, mergers, divisions, transfers of establishment, transfers of assets, changes in infrastructure providers, assignments of contractual position or equivalent operations, personal data may be transmitted or made available to successor entities, acquirers, companies in the same group, consultants, auditors or third parties involved, to the extent necessary and legally permissible, with appropriate confidentiality and data protection safeguards.

9.16.When the processing concerns personal data processed on behalf of Customers, the communication of data to recipients indicated, configured, authorized or requested by the Customer will be the responsibility of the Customer as controller, except when Netwiz Systems autonomously determines the purpose and means of communication.

9.17.Netwiz Systems may maintain an internal list of categories of processors, technical suppliers and relevant recipients, for the purposes of governance, security, contractual management, auditing, compliance and response to legally required requests, without prejudice to the protection of confidential, commercial or sensitive infrastructure information.

9.18.The rules in this section apply without prejudice to the Cookies and Similar Technologies Policy, the Specific Conditions, the applicable DPA, the terms of third party suppliers, the Terms and Conditions of Use of the Website and applicable legislation. This Policy must be interpreted in conjunction with the Terms and Conditions of Use of the Website regarding the use of technical suppliers, cloud services, payment methods, APIs, AI services, security systems and other third parties necessary for the provision, security and continuity of services.

10.International data transfers.

10.1.Netwiz Systems may process personal data in the European Economic Area (“EEA”), and, when necessary for execution, security, support, maintenance, hosting, communication, payment, Artificial Intelligence, automation, backups, cloud services, integrations/API or other contracted functionalities, it may use providers, infrastructures or technologies that involve processing or access to data outside the EEA.

10.2.Whenever there is an international transfer of personal data to a third country or international organization, Netwiz Systems will ensure that this transfer is carried out in accordance with the GDPR, namely based on an adequacy decision from the European Commission, appropriate guarantees, standard contractual clauses, binding rules applicable to companies, certification mechanisms, codes of conduct or other legally permissible basis.

10.3.When there is no applicable adequacy decision, Netwiz Systems may resort to standard contractual clauses or Standard Contractual Clauses (“SCC”), approved by the European Commission, or to another legally permissible mechanism, to ensure adequate guarantees for the transfer.

10.4.International transfers may occur, in particular, when hosting providers or infrastructures are used, cloud, security, backups, communications, email, CRM, support, analytics, payments, Artificial Intelligence, automation, APIs, monitoring, development, maintenance, technical services or other suppliers necessary for the provision, security and continuity of Netwiz Systems's services.

10.5.For reasons of security, commercial confidentiality, infrastructure protection and abuse prevention, Netwiz Systems may identify international providers by categories, except when nominative identification is legally required, contractually provided for or necessary to ensure the exercise of data subjects' rights.

10.6.When Netwiz Systems acts as controller, it will evaluate, in a manner appropriate to the risk and nature of the processing, the mechanisms applicable to international transfers that it carries out or that are carried out by providers that it uses for its own purposes.

10.7.When Netwiz Systems acts as a processor on behalf of a Customer, international transfers carried out within the scope of Netwiz Solutions/Platforms, SaaS services, integrations/API, AI, cloud, support, maintenance or other contracted services will be governed by the contract, the Specific Conditions, the Customer's documented instructions and, where applicable, the Data Processing Agreement (“DPA”).

10.8.When the Customer configures, authorizes, requests or uses integrations with platforms, social networks, payment services, cloud services, Artificial Intelligence tools, APIs, communication systems, job portals, CRM, websites, databases or other external services that involve international transfers, it will be up to the Customer, as controller, to assess the legality of these transfers, inform data subjects and ensure the appropriate transfer mechanism, except when the transfer is determined autonomously by Netwiz Systems.

10.9.Certain Artificial Intelligence, cloud, infrastructure, automation, communications, analytics, support or payments providers may operate from third countries or allow remote access by teams located outside the EEA. In such cases, Netwiz Systems will ensure, under legally applicable terms, the existence of appropriate contractual, technical and organizational safeguards, including, where applicable, standard contractual clauses, supplementary measures, access limitation, minimization, pseudonymization, encryption or other measures appropriate to the risk.

10.10.Netwiz Systems may, in exceptional situations and under legally permitted terms, carry out international transfers based on specific derogations provided for in the GDPR, namely when the transfer is necessary for the execution of a contract, pre-contractual procedures, declaration, exercise or defense of rights, protection of vital interests or explicit consent of the data subject, when applicable.

10.11.Netwiz Systems may review, replace, suspend or limit the use of a particular provider, integration, tool, country, region, technical mechanism or functionality when it considers that the international transfer does not offer adequate guarantees, presents excessive risk, fails to comply with legal requirements, undergoes a relevant change or compromises the security, compliance or continuity of services.

10.12.International transfers will be limited to what is necessary for the applicable purposes and subject, where appropriate, to minimization measures, access control, confidentiality, security, limited retention, logical segregation, encryption, pseudonymization, anonymization or other proportionate safeguards.

10.13.Information on international transfers may be supplemented in the Specific Conditions, in the applicable DPA, under the terms of a given platform, form, service, subscription, license or contracting process, especially when processing on behalf of the Customer or use of specific technical suppliers is involved.

10.14.Netwiz Systems does not assume responsibility for international transfers carried out directly by the Customer, its Authorized Users or third parties configured, contracted, integrated or authorized by it, including exports, downloads, backups, external integrations, sharing, communications, synchronizations, APIs or use of the Customer's own tools.

11.Personal data retention periods and criteria.

11.1.Netwiz Systems will retain personal data only for the period necessary to fulfill the purposes for which they were collected or subsequently processed, without prejudice to legally required retention periods, the need for retention for evidence, auditing, security, fraud prevention, contractual compliance, legal compliance, exercise or defense of rights and dispute resolution.

11.2.Retention periods are defined taking into account, in particular:

11.2.1.the purpose of the processing;

11.2.2.the nature of the personal data processed;

11.2.3.the capacity in which Netwiz Systems acts, as controller or processor;

11.2.4.the existence of a contract, proposal, subscription, license, Account, active service or commercial relationship;

11.2.5.legal, tax, accounting, labor, regulatory or administrative obligations;

11.2.6.limitation periods, expiry, complaint, audit, inspection or defense of rights;

11.2.7.documented instructions from the Customer, when Netwiz Systems acts as a processor;

11.2.8.security needs, fraud prevention, incident investigation and electronic evidence.

11.3.When personal data is processed by Netwiz Systems as controller, the following retention criteria apply, as a rule:

11.3.1.Contact requests, quote requests, diagnoses, forms and pre-contractual communications: for the period necessary to analyze and respond to the request and, when there is a subsequent commercial relationship, for the period necessary to manage the contractual relationship, proof, audit and defense of rights.

11.3.2.Customer Data, contracts, proposals, subscriptions, licenses, services, courses and support: during the term of the contractual relationship and, after its end, for the period necessary to comply with legal obligations, proof, audit, collection, defense of rights or dispute resolution.

11.3.3.Billing, accounting, payment data and fiscally relevant documents: for the applicable legal period, including, when required, the 10-year retention period for books, records and respective supporting documents, without prejudice to a different special period or a longer legally applicable period.

11.3.4.Account data, reserved areas, access, permissions and operational history: during the term of the Account, subscription, license or service and, after termination, for the period necessary for security, evidence, auditing, legal compliance, dispute management or defense of rights.

11.3.5.Support data, tickets, complaints, formal communications and incidents: during the period necessary to manage the request or incident and, after closure, for the period necessary for evidence, auditing, legal compliance, litigation prevention and defense of rights.

11.3.6.Consent data, preferences, acceptance of legal documents and electronic proof: for the period necessary to demonstrate the lawfulness of the processing, the acceptance of terms, the provision of consent, the withdrawal of consent, the opposition or the communication made, without prejudice to the applicable legal deadlines.

11.3.7.Marketing data, newsletters and commercial communications: until withdrawal of consent, valid opposition, elimination of contact or cessation of the purpose that justified the processing, without prejudice to the minimum retention necessary to prove the origin of the contact, consent, opposition or legal compliance.

11.3.8.Technical data, logs, security, fraud prevention and audit: for the period necessary for security, abuse detection, incident investigation, audit, evidence, defense of rights and compliance with legal obligations, with deadlines varying depending on the risk, criticality, nature of the service and technical requirements.

11.3.9.Training data, courses and certificates: during the period necessary to manage registration, participation, access, evaluation, issuance of certificates, support, contractual compliance, legal obligations, proof of attendance and defense of rights.

11.3.10.Data processed to exercise the rights of data subjects: during the period necessary to analyze and respond to the request and, subsequently, for the period necessary to demonstrate compliance with the legal obligations of Netwiz Systems.

11.4.When Netwiz Systems acts as a processor on behalf of a Customer, the retention periods for personal data processed in the Netwiz Solutions/Platforms will be defined, as a rule, by the Customer as controller, without prejudice to the technical, operational, legal or contractual deadlines set out in the contract, Specific Conditions or Data Processing Agreement (“DPA”).

11.5.On platforms used by Customers, including recruitment platforms, application management, CRM, leads, digital communication, social networks, messages, automations, AI or other Netwiz Solutions/Platforms, the Customer is responsible for defining the appropriate retention periods for its own processing, including data from candidates, customers, workers, contacts, leads, followers, trainees or other data subjects associated with its activity.

11.6.In the case of candidate data processed on recruitment platforms on behalf of Clients, it will be up to the Client to define the retention period compatible with the purpose of the recruitment process, with the applicable legislation, with the information duties provided to candidates and with possible retention for future processes, when there is an adequate legal basis.

11.7.When personal data is stored in databases, websites, servers, systems, platforms or environments controlled by the Customer, or when the Customer carries out exports, downloads, extractions, backup copies or autonomous processing, the Customer will be responsible for the retention, deletion, security and management of this data, except when Netwiz Systems autonomously determines its own purposes and means of processing.

11.8.Whenever Netwiz Solutions/Platforms allow export, download, backup, copying, extraction or migration of data, the Customer is responsible for timely carrying out the exports and copies that it intends to keep, as well as for ensuring the legality, security, access, use, transmission, retention and disposal of these copies.

11.9.After termination of service, closure of Account, end of subscription, plan, license or continued service, personal data may be retained, blocked, anonymized or deleted in accordance with this Policy, the Specific Conditions, the applicable DPA, the Customer's documented instructions and current legislation.

11.10.Unless there is a legal, contractual or technical obligation to the contrary, Netwiz Systems may delete or anonymize personal data when they are no longer necessary for the applicable purposes, when the retention period expires, when the data subject validly exercises the right to erasure, when the Customer legitimately instructs the deletion or when retention no longer has a legal basis.

11.11.Netwiz Systems may retain certain personal data even after a request for erasure, opposition, termination of the contract or closure of the Account, when this is necessary to comply with a legal obligation, exercise or defend rights, proof of contractual compliance, invoicing, accounting, fraud prevention, security, auditing, dispute resolution or compliance with orders from a competent authority.

11.12.When the data is no longer necessary for active processing, but must be kept due to legal obligation, defense of rights, audit or evidence, Netwiz Systems may block, archive, restrict access or limit processing, keeping the data only for the purposes that justify its retention.

11.13.Netwiz Systems may retain anonymized, aggregated or statistical data for a longer period, as long as they do not allow the direct or indirect identification of a natural person. When the data is only pseudonymized and can still be associated with a natural person, it will continue to be considered personal data and subject to the applicable deadlines and guarantees.

11.14.Personal data will not be kept indefinitely without adequate grounds, and must be kept only for the period necessary for the applicable purposes, without prejudice to legal obligations of retention, security, auditing, proof or defense of rights.

11.15.When Netwiz Systems acts as a processor, it may, after the end of providing services related to processing, delete or return personal data to the Customer, in accordance with the DPA, contract, Specific Conditions or applicable documented instructions, except when legislation requires the retention of personal data.

11.16.Netwiz Systems may internally define, review and update retention tables, archiving procedures, deletion criteria, anonymization rules, backup policies, access rules and procedures for responding to deletion or retention requests, taking into account applicable legislation, the evolution of services, risk, contractual obligations and guidance from competent authorities.

12.Rights of data subjects.

12.1.Pursuant to the GDPR and applicable legislation, the data subject may exercise, where applicable and within legal limits, the following rights:

12.1.1.right to information;

12.1.2.right of access;

12.1.3.right to rectification;

12.1.4.right to erasure of data;

12.1.5.right to limitation of processing;

12.1.6.right to data portability;

12.1.7.right to object;

12.1.8.right to withdraw consent, when processing is based on consent;

12.1.9.right not to be subject to certain exclusively automated decisions, including profiling;

12.1.10.right to lodge a complaint with the competent supervisory authority.

12.2.The data subject has the right to obtain confirmation as to whether or not their personal data is being processed by Netwiz Systems and, if this is the case, access to their personal data and legally provided information, including purposes, categories of data, recipients, retention periods and applicable rights.

12.3.The data subject has the right to request the rectification of inaccurate or incomplete personal data concerning him or her, and must, whenever possible, clearly indicate the data to be corrected and provide updated and appropriate information.

12.4.The data subject may request the erasure of their personal data when there is a legal basis for this purpose, namely when the data is no longer necessary for the purpose that motivated the collection or processing, when they withdraw consent and there is no other legal basis, when there is a valid opposition, when the data has been processed unlawfully or when there is a legal obligation to erase.

12.5.The right to erasure is not absolute. Netwiz Systems may retain personal data when necessary to comply with a legal obligation, contractual execution, billing, accounting, auditing, security, fraud prevention, declaration, exercise or defense of rights, legally required archive, response to authorities or other applicable legal basis.

12.6.The data subject may request the limitation of processing when he contests the accuracy of the data, when the processing is unlawful and opposes erasure, when Netwiz Systems no longer needs the data but they are necessary to the data subject for the purposes of declaring, exercising or defending rights, or when he has objected to the processing and the verification of the prevalence of legitimate grounds is pending.

12.7.The data subject may request the portability of personal data provided to Netwiz Systems, when the processing is based on consent or the execution of a contract and is carried out by automated means, under legally applicable terms.

12.8.The data subject may object to the processing of their personal data when the processing is based on the legitimate interests of Netwiz Systems or third parties, for reasons related to their particular situation, unless there are compelling legitimate reasons that prevail over their interests, rights and freedoms, or when the processing is necessary for the declaration, exercise or defense of rights.

12.9.The data subject may object at any time to the processing of their personal data for direct marketing purposes. In this case, Netwiz Systems will cease processing the data for this purpose, without prejudice to the minimum retention necessary to ensure the management of opposition, evidence and legal compliance.

12.10.When processing is based on consent, the data subject may withdraw consent at any time. The withdrawal of consent does not compromise the lawfulness of the processing carried out based on the consent previously provided.

12.11.The data subject has the right not to be subject to a decision based exclusively on automated processing, including profiling, that produces legal effects or that significantly affects him or her in a similar way, except in legally permitted cases and with the appropriate guarantees provided for in the GDPR.

12.12.Whenever Artificial Intelligence functionalities, automations, classifications, recommendations, application analysis, pre-screening or decision support used by Customers in Netwiz Solutions/Platforms are at stake, the exercise of rights related to data processed on behalf of the Customer must, as a rule, be directed to the Customer himself, as the controller for the processing. Netwiz Systems will provide reasonable assistance to the Customer, as processor, in accordance with the contract, Specific Conditions or applicable DPA.

12.13.When Netwiz Systems processes personal data as controller, the data subjects' rights can be exercised through the contacts indicated in Section 20 of this Privacy Policy. The request must identify the data subject and the right they intend to exercise, and Netwiz Systems may request additional elements strictly necessary to confirm the identity of the applicant when there are reasonable doubts.

12.14.When the request concerns personal data processed on behalf of a Customer of Netwiz Systems, namely data entered, managed, exported, analyzed or stored by the Customer in the Netwiz Solutions/Platforms, Netwiz Systems may forward the request to the Customer as controller or inform the data subject that they must direct the request to that Customer, except when Netwiz Systems acts as an independent controller for the processing in question.

12.15.Netwiz Systems will respond to requests to exercise rights without undue delay and, as a rule, within one month of receiving the request. This period may be extended by up to two additional months when necessary, taking into account the complexity of the request or the number of requests, and the data subject must be informed of the extension and the respective reasons within the applicable legal deadline.

12.16.The exercise of rights is, as a rule, free of charge. When requests are manifestly unfounded, excessive or repetitive, Netwiz Systems may, under legally permitted terms, charge a reasonable fee taking into account administrative costs or refuse to follow up on the request, justifying its decision.

12.17.Netwiz Systems may refuse or limit the exercise of rights when this results from legal obligation, duty of secrecy, protection of rights and freedoms of third parties, impossibility of identifying the data subject, mandatory retention, defense of rights, fraud prevention, security, incident investigation, compliance with an order from a competent authority or other applicable legal basis.

12.18.The data subject also has the right to lodge a complaint with the competent supervisory authority, under the terms indicated in Section 20 of this Privacy Policy, without prejudice to being able to contact Netwiz Systems in advance to attempt a direct resolution of the situation.

12.19.The submission of a request to exercise rights does not affect the validity of the processing operations carried out prior to receipt of the request, nor does it affect processing operations that must continue due to legal obligation, contractual execution, defense of rights, security, billing, accounting, auditing or other applicable legal basis.

12.20.When personal data is related to Accounts, platforms, subscriptions, licenses, reserved areas, SaaS services, recruitment processes, candidate data, Customer End Customer data, logs, backups, exports or data stored in environments controlled by the Customer, the response to the request may depend on the collaboration of the Customer, as controller, the location of the data, the nature of the service and applicable technical limitations.

12.21.Netwiz Systems may keep a record of requests for the exercise of rights, their analysis, response, identity of the applicant, dates, decisions taken and communications made, for the period necessary to demonstrate compliance, legal compliance, audit, fraud prevention and defense of rights.

13.Security of personal data and technical and organizational measures.

13.1.Netwiz Systems adopts appropriate and proportionate technical and organizational measures to protect personal data against destruction, loss, alteration, disclosure, unauthorized access, misuse, illicit processing, abuse, fraud, technical failures, security incidents and other occurrences that may affect the confidentiality, integrity, availability or resilience of systems and services.

13.2.Security measures are defined taking into account the state of the art, implementation costs, the nature, scope, context and purposes of the processing, as well as the risks, of varying probability and severity, to the rights and freedoms of natural persons.

13.3.The measures adopted by Netwiz Systems may include, depending on the service, system, platform, risk and applicable context:

13.3.1.access control and permissions management;

13.3.2.user authentication and, where available or appropriate, enhanced authentication;

13.3.3.logical segregation of environments, accounts, databases or permissions;

13.3.4.activity recording mechanisms, technical logs and auditing;

13.3.5.protection against unauthorized access, abuse, spam, bots, malware and intrusion attempts;

13.3.6.technical backups, redundancy or recovery mechanisms, when applicable;

13.3.7.technical monitoring, anomaly detection and incident response;

13.3.8.limiting access to employees, providers and processors who need the data to perform their respective functions;

13.3.9.confidentiality duties applicable to employees, providers or processors;

13.3.10.minimization, pseudonymization, anonymization or encryption measures, when appropriate to the risk and technically applicable;

13.3.11.internal security, support, maintenance, vulnerability management and operational continuity procedures.

13.4.Security measures constitute an obligation of means and not an absolute guarantee of invulnerability, absence of incidents, absence of attacks, uninterrupted operation, full data recovery or impossibility of unauthorized access by third parties. This limitation applies without prejudice to mandatory legal obligations regarding the protection of personal data and information security.

13.5.Access to personal data will be limited to people or entities that need to access the data to fulfill the applicable purposes, including Website management, contractual execution, provision of services, support, maintenance, security, billing, auditing, fraud prevention, legal compliance or defense of rights.

13.6.Netwiz Systems may use technical providers, processors, cloud services, hosting, security, backups, communications, payments, support, CRM, automation, AI, monitoring, maintenance or other services necessary to provide and protect the services, and these providers must be subject to appropriate confidentiality, security and data protection obligations when acting as processors.

13.7.The Customer is responsible for the security of personal data that it processes, exports, downloads, copies, stores, shares or uses outside of systems controlled by Netwiz Systems, as well as for the security of its own websites, databases, servers, devices, networks, credentials, accounts, permissions, backups, integrations, APIs, external tools and internal systems.

13.8.The Customer must ensure that its Authorized Users comply with appropriate security rules, including confidentiality of credentials, use of strong passwords, not sharing access, revoking permissions when they are no longer necessary, control of devices, periodic review of users and immediate reporting of suspected improper access.

13.9.Whenever Netwiz Solutions/Platforms allow the assignment of profiles, roles, permissions, access levels or reinforced authentication, the Customer must configure such mechanisms in a manner appropriate to its organization, the sensitivity of the data processed and the principle of need for access.

13.10.Netwiz Systems is not responsible for incidents, losses, improper access, disclosures, alterations, deletions or illicit processing operations that result from acts, omissions, configurations, accesses, credentials, exports, integrations, devices, networks, systems or instructions attributable to the Customer, its Authorized Users or third parties under its responsibility, except where Netwiz Systems is itself responsible, under the legally applicable terms.

13.11.When the Customer configures integrations with social networks, job portals, messaging systems, payment methods, websites, databases, APIs, AI tools, cloud services or other external services, it must ensure that such integrations are lawful, safe, appropriate and compatible with the rights of data subjects, as well as the terms and policies of the third parties involved.

13.12.Netwiz Systems may suspend, limit, block or refuse access, integrations, requests, functionalities, exports, imports, automations or operations when it detects, or has justified reason to suspect, a security risk, abusive use, improper access, fraud, data breach, legal breach, contractual violation, anomalous activity or risk to data subjects, Customers, systems, platforms, infrastructure or third parties.

13.13.In the event of a security incident or breach of personal data, Netwiz Systems will assess the nature of the incident, the data affected, the data subjects involved, the likely consequences, the risk to the rights and freedoms of natural persons and the appropriate mitigation, documentation, communication and recurrence prevention measures.

13.14.When Netwiz Systems acts as controller and a breach of personal data occurs that could result in a risk to the rights and freedoms of natural persons, it will notify the competent supervisory authority without undue delay and, whenever possible, up to 72 hours after becoming aware of the breach, except when the breach is not likely to result in a risk. When the breach is likely to pose a high risk to the rights and freedoms of data subjects, Netwiz Systems will communicate the breach to the affected data subjects, under legally applicable terms.

13.15.When Netwiz Systems acts as a processor and becomes aware of a personal data breach related to data processed on behalf of a Customer, it will notify the Customer as controller without undue delay, in accordance with the GDPR, the DPA, contract or applicable Specific Conditions.

13.16.Netwiz Systems may document incidents, vulnerabilities, personal data breaches, measures adopted, decisions taken, communications made, technical evidence, logs, reports and corrective measures, for the period necessary for legal compliance, auditing, security, fraud prevention, defense of rights and demonstration of compliance.

13.17.The reporting of vulnerabilities, failures or incidents by Users, Customers or third parties does not grant authorization to carry out intrusion tests, load tests, technical exploitation, reverse engineering, security bypass, data extraction, unauthorized access, public disclosure or any unauthorized technical intervention. Any technical test depends on prior, written and express authorization from Netwiz Systems.

13.18.The data subject, User or Customer must report to Netwiz Systems, as soon as possible, any suspicion of improper access, unauthorized use of an Account, loss of credentials, accidental data exposure, security breach, vulnerability, configuration error or incident that may affect personal data processed within the scope of the Website, Netwiz Solutions/Platforms or contracted services.

13.19.Netwiz Systems may review, update or reinforce its security measures based on technological developments, legal changes, identified risks, audits, incidents, changes in suppliers, infrastructure changes, new functionalities, new platforms or personal data protection needs.

13.20.The security measures applicable to each service, platform, plan, subscription, license, integration, functionality or contract may vary depending on the nature of the service, the risk, the configuration chosen by the Customer, the Specific Conditions and the applicable DPA.

14.Cookies, similar technologies and privacy preferences.

14.1.The Website netwiz.pt, subdomains, domains, applications, APIs, reserved areas, Netwiz Solutions/Platforms, systems, technical environments and functionalities under the control of Netwiz Systems may use cookies and similar technologies, including identifiers, pixels, tags, scripts, measurement technologies, preferences, statistics, security, communication, authentication, personalization or marketing, when applicable.

14.2.Detailed information about cookie categories, purposes, suppliers, duration, preference management, consent mechanisms and forms of deactivation is set out in a separate document called Cookies and Similar Technologies Policy.

14.3.Whenever the use of cookies or similar technologies involves the processing of personal data, this Privacy Policy also applies, without prejudice to the prevalence of the Cookies and Similar Technologies Policy regarding the specific matter of cookies, identifiers and equivalent technologies.

14.4.The User can manage their preferences through the mechanism available on the Website, platform, application, reserved area or applicable functionality, including, when applicable, through the Netwiz Consent Manager or other cookie management mechanism, similar technologies and consents made available by Netwiz Systems, without prejudice to the settings existing in the respective browser, device or application.

14.5.Disabling certain cookies or similar technologies may affect the functioning, security, authentication, preferences, performance or availability of some features of the Website, subdomains, applications, reserved areas, Netwiz Solutions/Platforms, systems or technical environments.

14.6.This section must be interpreted in conjunction with the Cookies and Similar Technologies Policy, with this autonomous document being responsible for regulating the technical and operational matters relating to cookies, identifiers and equivalent technologies.

15.Commercial communications, marketing and opposition.

15.1.Netwiz Systems may process personal data to send commercial communications, newsletters, campaigns, publicity of services, platforms, courses, content, events, news, invitations, institutional information or other communications related to its activity, only when there is an adequate legal basis.

15.2.Commercial communications may be sent, in particular, by email, telephone, SMS, forms, digital channels, reserved areas, notifications or other legally permissible electronic means, depending on the data provided by the data subject and the applicable purpose.

15.3.The sending of unsolicited electronic communications for direct marketing purposes to natural persons is subject, as a rule, to prior and express consent, except in legally permitted situations, namely when there is a prior commercial relationship and the applicable legal conditions are met.

15.4.When commercial communication is based on consent, it must be free, specific, informed, unambiguous and express, provided through a clear positive act, such as selecting a specific field, form, subscription, electronic confirmation or other means capable of proof.

15.5.When legally permissible, Netwiz Systems may send communications about its own products or services similar to those previously contracted or requested by the Customer, based on legitimate interest or prior commercial relationship, provided that the data subject has been given the possibility to refuse, in an easy and free way, the use of their data for this purpose.

15.6.In all commercial communications sent by Netwiz Systems, whenever legally required or technically applicable, an appropriate mechanism for opposition, unsubscription or refusal of future direct marketing communications will be made available.

15.7.The data subject may, at any time, withdraw consent or oppose the processing of their data for direct marketing purposes, through the mechanism indicated in the communication itself or through the data protection contact indicated in this Privacy Policy.

15.8.The withdrawal of consent or opposition to direct marketing does not affect the lawfulness of the processing operations carried out before the withdrawal or opposition, nor does it prevent the sending of operational, contractual, technical, administrative, security, billing, support or legal compliance communications that are necessary for the execution of a contract, service provision, Account management, subscription, license, course, platform or legal obligation.

15.9.Netwiz Systems may keep a record of subscription, consent, opposition, unsubscription, origin of contact, date, time, IP address, form, version of information provided, channel used and other evidence necessary to demonstrate the lawfulness of sending commercial communications and compliance with opposition requests.

15.10.Netwiz Systems may segment commercial communications based on professional data, contracted services, expressed interests, previous interactions, type of Customer, area of activity, commercial history or indicated preferences, provided that such processing is adequate, proportional, transparent and based on applicable legal basis.

15.11.Netwiz Systems will not use special categories of personal data for marketing segmentation, unless this is legally permissible, expressly consented and justified by a specific purpose, which does not correspond to Netwiz Systems's normal practice.

15.12.When Netwiz Systems carries out campaigns on behalf of Clients, including email campaigns, social networks, advertisements, automations, CRM, lead capture or commercial communications on behalf of the Client, the Client will, as a rule, be the controller of the data used in the campaign, being responsible for ensuring the legality of the database, consents, information duties, opposition lists, segmentation, communication content and compliance with the rules applicable to direct marketing.

15.13.Netwiz Systems, when acting as a processor in Customer campaigns or communications, will process data in accordance with the Customer's documented instructions, contract, Specific Conditions and applicable DPA, and may refuse or suspend instructions that are manifestly illicit, abusive, unsafe or likely to violate data protection rules, electronic communications, advertising, consumers or third party rights.

15.14.When the Customer imports, uploads, synchronizes or uses lists of contacts, leads, customers, candidates, followers, recipients or databases in Netwiz Solutions/Platforms for communication, marketing, advertising, automation or campaign purposes, it will be responsible for ensuring that it has an adequate legal basis for such use and that it respects the applicable rights of opposition, deletion, limitation or withdrawal of consent.

15.15.Netwiz Systems may use technical email, CRM, automation, analytics, hosting, support, security, AI or communications providers to send, manage, measure and control commercial communications, identified by categories under the terms of this Privacy Policy.

15.16.Marketing processing will be carried out in conjunction with the Cookies and Similar Technologies Policy when it involves cookies, pixels, tags, identifiers, audiences, remarketing, measurement or equivalent technologies.

16.Candidate data and recruitment processes on Netwiz platforms.

16.1.Netwiz Systems may provide platforms, modules or functionalities intended for publishing opportunities, collecting applications, managing candidates, analyzing profiles, organizing recruitment processes, communicating with candidates, team management, internal approvals, notes, evaluations, classifications, selection pipeline and other operations associated with recruitment processes.

16.2.This section applies, in particular, to Netwiz TalentHub and any other Netwiz Solutions/Platforms that may process personal data in the context of recruitment, selection, applications, professional opportunities, candidate management or equivalent processes.

16.3.As a rule, the Customer who uses the platform to publish opportunities, receive applications, analyze candidates, manage selection processes or make recruitment decisions acts as the controller for processing the candidates' personal data. Netwiz Systems acts, in this context, as a processor, when it only provides technology, hosting, maintenance, support, automation, integration or technical processing on behalf of the Customer.

16.4.It is the responsibility of the Customer, as controller, to ensure, before collecting or processing candidate data, that they receive clear, complete and adequate information about the processing of their personal data, including the identity of the controller, purposes, legal grounds, data categories, recipients, retention periods, data subjects' rights, possible use of AI or automated decisions and other elements required by the GDPR.

16.5.The data processed in the context of recruitment may include, depending on the platform configuration and the Client's instructions, name, contacts, address, photograph, CV, training, professional experience, skills, professional history, certificates, portfolio, attached documents, availability, salary expectations, salary data, professional preferences, communications, answers to questions, internal notes, evaluations, classifications, application statuses, decisions and process history.

16.6.The Customer is responsible for ensuring that only adequate, relevant data is collected and processed, limited to what is necessary for the recruitment or selection process in question, avoiding excessive, unnecessary or disproportionate collection of personal data.

16.7.The Client must avoid requesting or processing special categories of personal data from candidates, including health data, racial or ethnic origin, political opinions, religious or philosophical convictions, trade union membership, genetic data, biometric data intended for unequivocal identification, sexual life or sexual orientation, except when this is strictly necessary, legally permissible and duly substantiated.

16.8.If the candidate voluntarily introduces special categories of personal data, sensitive data or excessive information in free fields, CVs, attachments, messages or documents submitted through the platform, it will be up to the Customer, as controller to assess the need, lawfulness, minimization, retention or deletion of such data, without prejudice to Netwiz Systems's obligations as a processor under the terms of the applicable contract or DPA.

16.9.Netwiz Systems is not responsible for the content of published opportunities, selection criteria, questions asked to candidates, fields configured by the Client, internal notes, evaluations, classifications, recruitment decisions, communications sent by the Client or legal grounds invoked by the Client, except when this results from Netwiz Systems's own act as controller.

16.10.When the platform includes analysis, classification, filtering, ordering, recommendation, pre-screening or support for the evaluation of candidates, these functionalities must be understood as auxiliary instruments, not replacing adequate human analysis, validation by the Client and final recruitment decision.

16.11.The Client must ensure that no decision that produces legal effects on the candidate or that significantly affects him or her in a similar way is taken exclusively based on automated processing, including profiling, except in legally permitted cases and with the appropriate guarantees provided for in the GDPR.

16.12.Whenever Artificial Intelligence, automation, classification, scoring, ranking, filtering or recommendation functionalities are used in recruitment processes, the Client must ensure transparency towards candidates, adequate human supervision, proportional criteria, non-discrimination, possibility of review when applicable and compliance with legal obligations in terms of data protection, work, equality and non-discrimination.

16.13.Netwiz Systems may provide technical functionalities that allow the Customer to manage applications, process statuses, notes, approvals, communications, attachments, evaluations and classifications. The use of these functionalities, including the definition of criteria, field content, evaluation rules, decisions and retention periods, is the responsibility of the Customer as controller.

16.14.The Client is responsible for defining the retention periods for candidate data, taking into account the purpose of recruitment, possible need for retention for future processes, consents or applicable legal grounds, information duties provided to candidates, deadlines for defending rights and principles for limiting retention.

16.15.Unless there is a documented instruction from the Customer, legal obligation, need for security, proof, audit or defense of rights, Netwiz Systems will not independently define the retention period for candidate data processed on behalf of the Customer on recruitment platforms.

16.16.The Customer is responsible for responding to candidates' requests to exercise their rights, including access, rectification, erasure, limitation, opposition, portability and rights relating to automated decisions. When Netwiz Systems acts as a processor, it will provide reasonable assistance to the Customer in accordance with the terms of the contract, Specific Conditions or applicable DPA.

16.17.The Customer must ensure that Authorized Users with access to candidate data respect duties of confidentiality, need for access, security, non-discrimination, proportional use and purpose limitation, and must revoke access when it is no longer necessary.

16.18.When the Customer exports, downloads, copies, shares, archives or integrates candidate data with other systems, it will be responsible for subsequent processing, including security, retention, information to data subjects, lawfulness of communication, access control and deletion when applicable.

16.19.Netwiz Systems may retain technical logs, access records, usage events, Authorized User actions, security evidence, support records and data necessary for auditing, fraud prevention, security, demonstration of compliance and defense of rights, in accordance with this Policy, the Terms and Conditions, the Specific Conditions and the applicable DPA.

16.20.Netwiz Systems may refuse, suspend or limit functionalities, fields, integrations, automations, imports, exports or instructions related to candidate data when it considers that they are manifestly illicit, excessive, insecure, discriminatory, incompatible with the contract, contrary to data protection or likely to compromise candidates' rights, platform security, reputation of the Netwiz Systems or third party rights.

16.21.This section does not replace the Customer's privacy policy, recruitment notice, candidate information or legal documentation. Each Customer using Netwiz platforms for recruitment must provide candidates with their own privacy information, appropriate to the application process and the purposes determined by them.

17.Data processing on behalf of Customers and Data Processing Agreement / DPA.

17.1.When Netwiz Systems processes personal data on behalf of a Customer and in accordance with its documented instructions, it acts as a processor, with the Customer, as a rule, acting as controller.

17.2.The processing of personal data on behalf of the Customer will be governed by the contract, proposal, Specific Conditions, documented instructions of the Customer and, when applicable, by a Data Processing Agreement (“DPA”).

17.3.The DPA must define, where applicable, the object, duration, nature and purpose of the processing, the types of personal data processed, the categories of data subjects, the Customer's obligations as data controller and Netwiz Systems's obligations as processor.

17.4.The Customer is responsible for ensuring that the instructions transmitted to Netwiz Systems are lawful, adequate, documented, proportionate and compatible with data protection legislation, the rights of data subjects, the contract, the Specific Conditions and this Privacy Policy.

17.5.Netwiz Systems will process personal data on behalf of the Customer only in accordance with the documented instructions received, except where it is obliged to process the data under European Union law or applicable national law. In these cases, it will inform the Customer of this legal requirement before processing, unless the law prohibits such information for reasons of public interest.

17.6.Netwiz Systems will inform the Customer when, in its opinion, an instruction violates the GDPR, Law no. 58/2019 or other applicable data protection standard.

17.7.Netwiz Systems may refuse, suspend or not execute instructions that are manifestly illicit, unsafe, excessive, technically unfeasible, incompatible with the contract, likely to violate the rights of data subjects or likely to compromise the security, integrity, availability or compliance of systems, platforms, data or services.

17.8.Netwiz Systems will ensure that persons authorized to process personal data on behalf of the Customer are subject to appropriate duties of confidentiality or equivalent legal obligations, to the extent applicable to their respective functions.

17.9.Netwiz Systems will adopt technical and organizational measures appropriate to the risk, in accordance with this Policy, the contract, the Specific Conditions and the applicable DPA, taking into account the nature, scope, context and purposes of the processing carried out on behalf of the Customer.

17.10.Netwiz Systems may use subsequent processors to ensure hosting, infrastructure, security, support, backups, communications, AI, automation, cloud services, maintenance, monitoring, databases, technical processing or other services necessary for the availability and continuity of the contracted services.

17.11.The use of subsequent processors will be carried out in accordance with the applicable DPA, contract or Specific Conditions. When there is general authorization from the Customer, Netwiz Systems may change, replace or add categories of subsequent processors, ensuring information or opposition mechanisms when this is contractually provided for and legally required.

17.12.For reasons of security, commercial confidentiality and infrastructure protection, Netwiz Systems may identify subsequent processors by categories, except when nominative identification is legally required, contractually provided for or necessary to ensure the rights of data subjects.

17.13.Netwiz Systems will provide reasonable assistance to the Customer, taking into account the nature of the processing and the information at its disposal, so that it can respond to requests to exercise the rights of data subjects, under the contractually applicable terms.

17.14.Netwiz Systems will provide reasonable assistance to the Customer, in accordance with the applicable contract or DPA, in fulfilling obligations relating to security of processing, notification of personal data breaches, impact assessments on data protection and prior consultation with the supervisory authority, when such obligations are applicable and are related to processing carried out by Netwiz Systems on behalf of the Customer.

17.15.When Netwiz Systems becomes aware of a personal data breach related to data processed on behalf of the Customer, it will notify the Customer without undue delay, in accordance with the GDPR, the contract, the Specific Conditions or the applicable DPA.

17.16.Upon completion of processing activities on behalf of the Customer, Netwiz Systems may delete, return, anonymize, block or retain personal data in accordance with the terms of the contract, Specific Conditions, DPA, documented Customer instructions and applicable legislation.

17.17.Netwiz Systems may retain certain data or records when necessary to comply with a legal obligation, security, audit, proof, invoicing, accounting, fraud prevention, defense of rights, dispute management, compliance with an order from a competent authority or demonstration of compliance.

17.18.The Customer is responsible for ensuring that it has its own privacy policy, information for data subjects, legal basis, consents when necessary, retention rules, procedures for exercising rights, security measures and adequate documentation regarding the data that it collects, introduces, imports, synchronizes, processes or preserves through the Netwiz Solutions/Platforms.

17.19.The Customer is responsible for the legality of the data, files, databases, CVs, contacts, messages, images, evaluations, ratings, salary data, professional data, customer data, candidate data, employee data or other personal data that it enters, uploads, imports, synchronizes or processes through Netwiz Systems services.

17.20.The Customer is also responsible for the processing carried out after export, download, backup, extraction, migration, integration, communication or autonomous retention of personal data outside the systems controlled by Netwiz Systems.

17.21.Netwiz Systems may provide information necessary to demonstrate compliance with the obligations applicable to it as a processor and may allow or contribute to audits under the terms of the DPA, contract or applicable Specific Conditions, provided that such audits are proportionate, previously agreed, respect confidentiality, do not compromise the security of the infrastructure, do not expose data from other Customers and do not unduly affect the continuity of services.

17.22.Without prejudice to mandatory legal provisions, any audits, inspections, requests for technical information, compliance questionnaires, documentary checks or extraordinary requests from the Customer may be subject to operational conditions, scheduling, confidentiality, scope limitation and, when they exceed the normal contracted support, budget or additional remuneration.

17.23.This section should be interpreted in conjunction with the Terms and Conditions, especially the rules regarding Netwiz Solutions/Platforms, Customer Data, Integrations/API, backups, export, retention, termination, AI, security, subcontracting and Customer liability.

18.Minors and incapacitated.

18.1.The Website, Netwiz Solutions/Platforms, SaaS services, usage licenses, subscriptions, professional services, courses, training and other digital services of Netwiz Systems are not intended, as a rule, for independent use by minors or by people who do not have sufficient legal capacity for the acts in question.

18.2.Whenever the use, registration, contracting, payment, creation of an Account, access to a reserved area, ongoing participation, submission of data or use of a platform involves a minor or person without sufficient legal capacity, the act must be carried out by the respective legal representative or with their valid authorization, when legally applicable.

18.3.When the processing of minors' personal data is based on consent in the context of the direct offer of information society services, the specific rules set out in the GDPR and Law No. 58/2019, of August 8, apply, including the need for intervention by legal representatives whenever legally required.

18.4.Netwiz Systems does not, as a rule, request personal data from minors through the Website's general forms, contact requests, quote requests, diagnoses, chat or commercial communications, except when this is necessary for a specific service, legally permissible and accompanied by appropriate guarantees.

18.5.In the context of courses, training, digital content, registrations, educational platforms or services aimed, directly or indirectly, at minors, personal data necessary for registration, pedagogical management, participation, communication, support, evaluation, certification, invoicing or legal compliance may be processed, and the intervention of the legal representative must be ensured whenever legally required.

18.6.When Netwiz Systems acts as a processor on behalf of a Client, and the latter uses the Netwiz Solutions/Platforms to process minors' data, it will be the responsibility of the Client acting as controller to ensure the lawfulness of the processing, information to data subjects and legal representatives, the appropriate basis of lawfulness, minimization of data, retention periods, response to the exercise of rights and compliance with applicable legal obligations.

18.7.The Customer must not introduce, import, synchronize, upload or process personal data of minors in the Netwiz Solutions/Platforms when it does not have an adequate legal basis, necessary authorization, prior information to data subjects or legal representatives, or when the data is excessive, unnecessary or incompatible with the intended purpose.

18.8.If Netwiz Systems is aware that personal data of minors has been collected or processed in an unlawful, inappropriate, excessive or without necessary authorization manner, it may adopt proportionate measures, including request for clarification, limitation of processing, deletion, blocking, suspension of functionalities, communication to the Customer as controller or other legally appropriate measures.

18.9.Legal representatives may exercise, under the applicable legal terms, the rights relating to the personal data of minors they represent, through the contact details indicated in this Privacy Policy, when Netwiz Systems acts as controller, or with the Customer, as controller, when Netwiz Systems acts as processor.

18.10.The use of Netwiz Solutions/Platforms by institutions, companies, training entities, schools, organizations or Customers that process minors' data must be accompanied by their own privacy policy, adequate information for data subjects and legal representatives, access rules, security measures, limitation of permissions and procedures for exercising rights.

19.Third-party personal data provided by Users or Customers.

19.1.Whenever the User or Customer provides Netwiz Systems with personal data of third parties, including customers, candidates, employees, representatives, contacts, leads, followers, trainees, recipients of communications, buyers or other data subjects, they represent and guarantee that they have an adequate legal basis to do so.

19.2.The User or Customer is responsible for ensuring that the third parties whose data they provide, enter, upload, import, synchronize, transmit or make available to Netwiz Systems have been duly informed about the processing of their personal data, except when this obligation falls directly to Netwiz Systems under the applicable legal terms.

19.3.When third-party personal data is processed within the scope of Netwiz Solutions/Platforms on behalf of the Customer, including recruitment platforms, CRM, lead management, social networks, messaging systems, automations, AI, websites, online stores or other digital solutions, the Customer acts, as a rule, as controller.

19.4.The Customer is responsible for the lawfulness, accuracy, timeliness, minimization, necessity, proportionality and adequacy of the personal data of third parties that it processes through the Netwiz Solutions/Platforms or contracted services.

19.5.Netwiz Systems assumes no general obligation to previously verify the origin, lawfulness, accuracy, necessity or suitability of all third party personal data provided, imported, uploaded or synchronized by the Customer, its Authorized Users or third parties under its responsibility.

19.6.The Customer must refrain from entering or transmitting to Netwiz Systems personal data of third parties when there is no adequate legal basis, when the data is excessive or unnecessary, when the purpose is unlawful or when the processing may violate the rights of data subjects.

19.7.If Netwiz Systems detects, or has reasonable grounds to suspect, that third party personal data has been provided, imported or processed in an illicit, excessive, insecure or incompatible manner with applicable legislation, it may request clarification, limit processing, suspend functionalities, block access, delete data or adopt other proportionate and legally appropriate measures.

19.8.When a third party contacts Netwiz Systems to exercise rights in relation to data processed on behalf of a Customer, Netwiz Systems may forward the request to the Customer as controller or inform the data subject that they should direct the request to that Customer, except when Netwiz Systems acts as an independent controller for the processing in question.

19.9.When the Customer independently exports, downloads, copies, communicates, shares or stores personal data of third parties outside the systems controlled by Netwiz Systems, it will be responsible for subsequent processing, including security, retention, deletion, access, communication and response to requests from data subjects.

19.10.The provisions of this section apply without prejudice to the specific obligations set out in contracts, Specific Conditions, DPA, Terms and Conditions of Use of the Website and other applicable documentation. The Customer's responsibility for the data, content, files, databases, messages, applications, interactions and other elements that it introduces or processes through the Netwiz Solutions/Platforms is governed by this Policy, the Terms and Conditions of Use of the Website, the Specific Conditions and the applicable DPA.

20.Complaints, data protection contacts and supervisory authority.

20.1.For questions related to the protection of personal data, exercise of rights, requests for information, clarifications, incidents, complaints or communications relating to this Privacy Policy, the data subject can contact Netwiz Systems at the following address: dpo@netwiz.pt.

20.2.The contact indicated in the previous number is intended exclusively for matters related to the protection of personal data, without prejudice to the use of the general contact of Netwiz Systems for other commercial, contractual, operational, administrative or support matters. Unless expressly indicated otherwise, the provision of this contact does not, in itself, imply the formal designation of a Data Protection Officer (DPO), under the legally applicable terms.

20.3.The request or communication must, whenever possible, identify the data subject, the matter in question, the right you intend to exercise, the processing to which it refers and the elements necessary to analyze the request. When there are reasonable doubts about the identity of the applicant, Netwiz Systems may request additional information strictly necessary to confirm the identity.

20.4.When Netwiz Systems acts as controller, it will analyze and respond to the request within the legally applicable terms and deadlines.

20.5.When the communication concerns personal data processed by Netwiz Systems on behalf of a Customer, namely data entered, managed, imported, synchronized or processed in Netwiz Solutions/Platforms, Netwiz Systems may forward the request to the Customer as controller or inform the data subject that they should direct the request to that Customer, without prejudice to the reasonable assistance that Netwiz Systems must provide as processor.

20.6.The data subject may lodge a complaint with the competent supervisory authority if he considers that the processing of his personal data violates applicable legislation. In Portugal, the competent control authority is the National Data Protection Commission, CNPD.

20.7.The updated contact details of the National Data Protection Commission, CNPD, can be consulted on the respective institutional website: www.cnpd.pt.

20.8.Submitting a complaint to the CNPD does not prevent the data subject from resorting to other legally available administrative or judicial means.

20.9.Netwiz Systems recommends that the data subject contact the company in advance through the data protection contact indicated in this Policy, to allow analysis and an attempt to directly resolve the situation, without prejudice to the right to complain to the competent authority.

20.10.Netwiz Systems may keep records of communications, complaints, requests for information, requests to exercise rights, responses, internal decisions and associated elements, for the period necessary to demonstrate compliance, legal compliance, audit, security, proof and defense of rights.

20.11.Complaints relating to consumer matters, the Complaints Book or Alternative Dispute Resolution are described in a separate document and are not replaced by this section, which only deals with matters related to the protection of personal data.

21.Changes to the Privacy Policy, version and validity.

21.1.This Privacy Policy comes into force on the date indicated at the end of the document and remains applicable as long as it is published on the Website, without prejudice to subsequent updates, revisions or replacements.

21.2.Netwiz Systems may update this Privacy Policy whenever necessary, including legal, regulatory, technical, operational, contractual, organisational or corporate changes, and changes to services, platforms, suppliers, functionalities, processing grounds, data categories, purposes, security measures or internal practices.

21.3.The applicable version will, as a rule, be the version published on the Website at the date of consultation or use of the service, without prejudice to additional information provided in forms, contracts, Specific Conditions, reserved areas, contracting processes, DPA or specific communications.

21.4.When the change is materially relevant to data subjects, Customers, Users, subscriptions, platforms or ongoing services, Netwiz Systems may adopt appropriate means of communication, including notice on the Website, electronic communication, notification in a reserved area or other means proportional to the nature of the change.

21.5.The change to this Privacy Policy does not, in itself, imply a change to the Legal Notice and Terms and Conditions of Use of the Website, the Returns, Cancellations, Refunds and Guarantees Policy, the Cookies and Similar Technologies Policy, the information on Complaints, the Complaints Book and Alternative Dispute Resolution, nor the applicable Specific Conditions, unless there is an express reference to the contrary. This articulation remains consistent with the documentary structure defined in the approved Terms and Conditions.

21.6.Netwiz Systems may maintain an internal history of previous versions of this Privacy Policy, as well as records of acceptance, communication or provision of versions, when necessary for proof, audit, legal compliance, security, defense of rights or demonstration of compliance.

21.7.The continued use of the Website, Account, reserved areas, Netwiz Solutions/Platforms, services, subscriptions, licenses or functionalities after the publication of a new version of the Privacy Policy does not prejudice the legal rights of data subjects, including the right to information, access, opposition, withdrawal of consent, limitation, erasure or other applicable rights.

The versions and dates of the Privacy Policy, the Legal Notice and Terms and Conditions of Use of the Website, the Returns, Cancellations, Refunds and Guarantees Policy, the Cookies and Similar Technologies Policy and other complementary documentation are published on the Website for consultation by Users and Customers.

Version V.0.1

Published on May 25, 2026.