This Privacy and Data Protection Policy reflects the commitment of Effisus, Unipessoal Lda. to the protection of the personal data of all individuals who interact with the organization, covering both the processing carried out within the context of its institutional operations and those resulting from the use of its official website.
Headquartered at Travessa José Oliveira Mendes, Nos. 87 and 103, 4760-912 Vila Nova de Famalicão, Braga, Portugal, with a share capital of €800.00, and registered with the Commercial Registry Office of Vila Nova de Famalicão under the unique registration number and Tax Identification Number 507227115 (hereinafter “Effisus”), the company conducts the processing of personal data in strict compliance with the General Data Protection Regulation (GDPR) – Regulation (EU) No. 679/2016, Law No. 58/2019 of August 8th, and other applicable legislation and guidelines.
Effisus adopts high standards of transparency, lawfulness, and accountability, ensuring that data is processed lawfully, fairly, and transparently, and that the rights of data subjects are fully respected.
This policy includes a section dedicated to the activities of collecting and processing personal data through Effisus’ website, explaining in an accessible manner how browsing data, forms, contact requests, subscriptions, and other digital interactions are managed.
For a broader understanding of the organization’s approach to data protection, it is recommended to consult the General Privacy and Data Protection Policy of Effisus.
Effisus assumes the role of data controller for the processing of personal data.
Effisus collects personal data within the scope of its activities, always ensuring that individuals are informed about the purpose and manner of processing such data.
The main situations of data collection include:
Additionally, the website collects technical browsing data to improve user experience, ensure platform security, and enable effective communication.
At Effisus, personal data is processed based on clear, legitimate, and transparent purposes, in compliance with the GDPR. Each processing activity is carried out only when necessary, in a proportionate manner, and with full respect for data subjects’ rights. Data is never used for other purposes without consent or an appropriate legal basis.
The purposes of processing are regularly reviewed and updated to reflect any changes in internal practices, legal requirements, or best practice guidelines, ensuring high standards of information protection and security.
The purposes that justify the collection and processing of personal data by Effisus are as follows:
Data subjects are informed about the processing of their personal data and the rights they can exercise with Effisus. In accordance with the law, and within the legally established limits and exceptions, they may exercise the following rights:
The processing of ordinary data is carried out based on the following lawful conditions:
When entering into contracts involving the processing of personal data, Effisus ensures that these are carried out securely and in compliance with applicable legislation, including clauses on responsibilities, security measures, and incident notification.
In cases of subcontracting, Effisus guarantees that subcontractors are rigorously assessed regarding security and compliance, and that they sign contracts containing clauses ensuring processing in accordance with Effisus’ instructions, security measures, and incident notification, as well as a prohibition on further subcontracting without authorization. Effisus conducts periodic audits and continuous assessments to ensure compliance with data protection requirements.
In the course of its activities, Effisus may transfer personal data to countries outside the European Economic Area (EEA). In such cases, it adopts appropriate contractual measures to ensure the protection of data during the transfer. These include written agreements that ensure that the recipient entities located in a third country outside the EEA implement security measures equivalent to those required by the GDPR.
The contract must also ensure that the processing of personal data in the destination country complies with the GDPR and other equivalent standards.
When applicable, Effisus uses standard contractual clauses approved by the European Commission, ensuring that the data receives the same level of protection outside the EEA as it would within it.
Personal data is retained for the legally required period or, in the absence of such period, for the time strictly necessary for the purpose for which it was collected, in accordance with the following criteria: lawful basis for processing, operational necessity, data minimization, and data deletion.
When processed for purposes of public interest archiving, scientific or historical research, or statistical purposes, data may be retained for longer periods, provided that appropriate measures such as data minimization and pseudonymization are ensured, as established by applicable legislation.
General Measures Adopted to Ensure the Security of Personal Data
Effisus adopts strict and internationally recognized rules to ensure the protection of personal data, applicable to all those who legally process such data.
Technical and organizational measures are implemented to guarantee the confidentiality, integrity, and authenticity of the data. Whenever possible, data is encrypted, anonymized, and subject to access control, in accordance with the principle of least privilege.
Without prejudice to submitting a direct notification to Effisus through the contacts available at https://effisus.com/en/contacts-2/, you may also file a complaint directly with the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados) at www.cnpd.pt, using the contact details provided by this entity for that purpose.
This Privacy Policy may be updated periodically. Regular consultation is recommended. Changes take effect from the date of their publication on the website, with the date of the latest update indicated.
Date of last update: 2025/10/31
