1. Who we are

Exalta Global, Lda., a company incorporated under Portuguese law, registration and tax number 516684477, with registered office at Rua de Fundões, 151, SANJOTEC — Centro Empresarial e Tecnológico de S. João da Madeira, 3700-121 São João da Madeira, Portugal ("Exalta", "we", "us"), is the controller responsible for the processing of personal data collected through the website exaltaglobal.com (the "Website").

For any matter relating to the processing of your personal data, you can contact us:

• Email: info@exaltaglobal.com
• Postal address: Exalta Global, Lda., Rua de Fundões, 151, SANJOTEC, 3700-121 São João da Madeira, Portugal

Exalta has not appointed a Data Protection Officer because the conditions in Article 37 of Regulation (EU) 2016/679 (the "GDPR") that require an appointment do not apply. Questions and requests concerning this Notice or personal data for which Exalta acts as controller may be sent to: info@exaltaglobal.com.

This Notice applies to visitors to the Website, subscribers to our newsletter, people who contact us through the forms on the Website, and candidates who send us their CV or professional details through the Website. Processing carried out in recruitment processes managed outside the Website (for instance, through direct contact or client referrals) is addressed in separate privacy information provided in that context.

2. What data we collect

We collect your personal data at the following points:

Scroll horizontally if the full table is not visible.

Data is collected directly from you. We do not collect special categories of personal data (Article 9 GDPR) through the Website; please do not include information about your health, political or religious beliefs, or other sensitive data in your CV or messages.

3. Why we process your data and on what legal basis

Scroll horizontally if the full table is not visible.

Where processing is based on your consent, you may withdraw it at any time, with effect for the future, through the contact details in Section 1 or, for the newsletter, through the unsubscribe link included in every email. Withdrawal does not affect the lawfulness of processing carried out before it.

Data marked as required in our forms is necessary for us to handle your request or application; without it, we will not be able to respond to you or consider your application.

4. Who receives your data

Your personal data may be disclosed to the following categories of recipients, strictly to the extent necessary for each purpose:

Scroll horizontally if the full table is not visible.

If you are a candidate, your data is only shared with specific clients in the context of job opportunities compatible with your profile and with the wishes you have expressed during the recruitment process.

5. International transfers

Some of our processors are established or host data in the United States of America. These transfers take place under the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Article 45 GDPR), where the recipient is certified, or otherwise under Standard Contractual Clauses approved by the European Commission (Article 46(2)(c) GDPR), supplemented by additional measures where necessary.

If presenting your application to a client involves a transfer to a third country not covered by an adequacy decision, we will inform you in advance and put in place the appropriate safeguards required by Chapter V of the GDPR. You may request information about the applicable safeguards, or a copy of them, through the contact details in Section 1.

6. How long we keep your data

We keep your personal data only for as long as necessary for the purpose for which it was collected, in accordance with the periods set out in the table in Section 3. Once those periods have elapsed, the data is deleted or irreversibly anonymised, unless its retention is required by law or necessary for the establishment, exercise or defence of legal claims, in which case retention is limited to what is strictly necessary.

7. Your rights

Under Articles 15 to 22 GDPR, you have the right to:

• Access your personal data and obtain a copy of it;
• Rectify inaccurate or incomplete data;
• Erase your data, under the conditions set out in Article 17 GDPR;
• Restrict processing, under the conditions set out in Article 18 GDPR;
• Data portability: receive the data you provided to us in a structured, commonly used and machine-readable format, where processing is based on consent or a contract and carried out by automated means;
• Withdraw consent at any time, where processing is based on it, without affecting the lawfulness of prior processing.

To exercise your rights, contact us at info@exaltaglobal.com or by post at the address in Section 1. We will respond within 1 (one) month, extendable by 2 (two) months in particularly complex cases; we may ask you for the information reasonably necessary to confirm your identity. Exercising your rights is free of charge, except for manifestly unfounded or excessive requests.

You also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD) — Av. D. Carlos I, 134, 1.º, 1200-651 Lisbon, Portugal — www.cnpd.pt — without prejudice to any other administrative or judicial remedy.

8. Right to object

9. Cookies and similar technologies

The Website uses cookies — small text files stored on your device — and similar technologies (pixels). Strictly necessary cookies are used on the basis of our legitimate interest in the operation of the Website; all other cookies are used only with your consent, which you can give, refuse or withdraw at any time through the Website's consent manager. You can also configure your browser to block or delete cookies.

Scroll horizontally if the full table is not visible.

The Meta Pixel is only activated after you give your consent. Information collected by the Meta Pixel is processed by Meta Platforms Ireland Ltd. and may be transferred to the USA under the EU-U.S. Data Privacy Framework. For more information on Meta's processing, see Meta's privacy policy at www.facebook.com/privacy/policy.

The Website also contains links to our social media pages (Facebook, Instagram, LinkedIn). These are plain links: no data is transmitted to these platforms by simply visiting the Website — only when you click the link and access the platform, at which point that platform's privacy policy applies.

10. Automated decision-making

We do not make decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). Applications are always assessed by members of our team.

11. Children

The Website and our services are not directed at anyone under 16 (sixteen) years of age, and we do not knowingly collect personal data from minors. If you become aware that a minor has provided us with personal data, please contact us at info@exaltaglobal.com so that we can delete it.

12. Security

We apply appropriate technical and organisational measures to protect your personal data against unauthorised destruction, loss, alteration, disclosure or access, including encryption of communications with the Website (HTTPS), access controls on a need-to-know basis, and the selection of providers offering sufficient guarantees of appropriate measures, in accordance with Article 28 GDPR.

13. Changes to this Notice

We may update this Notice at any time, in particular to reflect changes in the law or in our processing activities. The version in force is the one published on the Website, showing the date of the last update. In the event of substantial changes, we will give the new version appropriate prominence on the Website and, where required, inform you directly or ask for renewed consent.