Privacy Policy

In compliance with the provisions of articles 13 and 14, of the General Data Protection Regulation (EU) 2016/679  ("GDPR") and Law No. 58/2019, of 8 August, known as the new Law on Personal Data Protection (“LPDP”), this Privacy Policy aims to define the personal data processing practices applicable within the scope of recruitment processes for the  “Controlauto – Controlo Técnico Automóvel, S.A.” (“Company”), informing data owners of the type of data collected, how it is collected, processed and used, how long it is stored for, as well as to provide contact details should you wish to exercise your rights as candidates for professional opportunities.

 

Who is the Controller for the processing of personal data

Brisa Autoestradas de Portugal, SA (“BAE”), headquartered at Quinta da Torre da Aguilha - Edifício Brisa, 2785-599 São Domingos de Rana, registered at the Commercial Registry Office of Cascais under registration and taxpayer number 500 048 177, with a share capital of €6,000,000.00 (six million Euros) and Controlauto – Controlo Técnico Automóvel, S.A, headquartered at Rua Alfredo Lopes Vilaverde, n.º 15, B-7, 2770-101 Paço de Arcos, registered at the Commercial Registry Office of Cascais under the registration and taxpayer no. 503 123 226, with a share capital of €5.000.000,00  (five million euros). Herein referred to as the "Companies", they are jointly responsible for the processing of the personal data collected during the website recruitment and selection processes of candidates for jobs at the Company, under the terms and as described, in this Policy.

 

How is established the responsibility of each Controller?

In order to comply with the GDPR, the Companies are joint controllers  to the extent that both determine the purpose and the means of processing  personal data collected on the website, regarding  Users in general and Users who apply - Candidates.

The Companies are also joint controllers for the processing of personal data collected during face-to-face or telephone interviews, which may be carried out by external entities.

BAE may request consent to process the Candidate's personal data collected via the website, with to the purpose of recruiting and selecting for other job openings, current or future,  at companies in which it holds a participation and for which it is authorized to identify potential candidates. In this case, the Candidate’s data processing will be under the sole control of BAE until it finds a good match for the job opportunities offered by the companies. If a good match is found and the recruitment process continues, BAE and the respective hiring company shall be jointly responsible for the subsequent treatment of the data.

The Company shall be the sole Controller of the Candidate's data immediately after he/she has been hired, complying, from then on, with all the GDPR obligations and the data protection legislation in force, namely the duty to provide Candidates with information on their policy.

 

How do we collect candidates' personal data?

This Privacy Policy applies to the processing of personal data provided directly by the candidates themselves, when registering on the website to submit a Spontaneous Application and/or Specific Application which results in interviews conducted by telephone or in person.

The Companies may subsequently process candidates’ personal data collected indirectly (provided by recruitment and selection companies), information provided by third parties in references or recommendations in the context of background checks and skills assessment, and from other publicly available recruitment sources.

 

What are the categories and types of personal data processed?

During the recruitment process, the following personal data is collected:

               i) Via Website

                               a) Provided by the Candidate
Personal Data Category
Types of Personal Data
Identification Data
Full name, date of birth, nationality and address.
Contact Data
Email and telephone no.
Demographic Data
Demographic Data Country/area of residence, nationality.
Professional Data
Area of interest, Curriculum Vitae (including all the information that the candidate has included therein such as references, professional and academic experience).

                               b) Website Users

The Companies may collect or store a limited amount of data on Website Users, namely in the form of cookies, used to enhance website experience and to help manage the recruitment services. The Website cookies collect and store the information required, configured upon request by the User, to log in or fill out forms. The User may choose to refuse to allow some types of cookies, however, deactivating or blocking these cookies may affect the services provided and the website experience. For more information on the data collected when visiting the website and how to change the settings, click here.

 

               ii) Via face-to-face or telephone interviews

In addition to the information shared by Candidates during the registration and Spontaneous and/or Specific Application process, they may share other personal data during meetings or in other means of communication carried out by the Companies' Human Resources team, or by external entities hired for this purpose.

The personal data discussed above is merely an example as the data or information requested depends on the role and business area for which it is intended.

If the Candidate declines to provide any of the data requested, the Companies may not be able to fulfill their obligations or continue the relationship with the Candidate. This will depend on the type of personal data and the lawful grounds that allow the Companies to process it.

The Companies may also process third party data, such as references, in which case it will be requested  identification and contact details (name and telephone contact and/or email address).

The Candidate is responsible for the statements and personal information that he/she provides and guarantees that the disclosure of this information, and that related to third parties has been authorized and that prior consent has been obtained to proceed with the processing of such personal data, as described in this data processing policy.

 

What is the purpose and the lawfulness for the processing of personal data?

The Companies commit to process  all the personal information provided by candidates confidentially and to use it solely for the purposes of recruiting and selecting according to business needs. This data includes, a detailed analysis of the information compiled on the Candidate’s technical and behavioral aptitude for a specific role(s), the pre-contractual steps as well as details for the performance of contracts.

Any processing for statistical purposes, used to monitor equal opportunities at the end of the selection and recruitment process, will be based on anonymized data.

During the recruitment process no decisions are made by automated means, that is, without human intervention.

Personal data processing, for the purposes indicated above, is based on:

            a) The Pursuit of the Company's legitimate interest in hiring and the candidate's legitimate interest in being hired;

            b) The Candidate's consent to be eligible for job openings in other companies;

            c) Compliance with pre-contractual procedures;

            d) Compliance with the Company's legal obligations.

The Candidate's personal data will not be used for any purposes other than those described in this policy, without his/her prior notification and consent.

 

Do the Companies collect sensitive personal data?

The Companies are not interested in, nor do they intend to receive or process, any sensitive personal data, namely data related to racial or ethnic origin, political opinions, trade-union membership, religious or philosophical beliefs, health, life or sexual orientation. If the candidate submits data of this nature, the candidate shall allow it to be stored for the period defined in this policy and it will not be subject to any other operation of processing.

Additionally, the Companies may request information for the purpose of monitoring diversity, which will be used anonymously, except with regard to the treatment of inclusive recruitment data (people with a recognized degree of disability or incapacity equal to or greater than 60%, in accordance with Law No. 4/2019, of10 January).

 

Can the Companies share my personal data?

The Companies may transfer and share the candidate’s personal data with entities subcontracted exclusively for the purposes mentioned above. The Companies only resort to subcontractors who guarantee the implementation of appropriate technical and organizational measures to protect the data, ensuring the defense of Candidate’s rights in light of the applicable legislation in force.

The Candidate's personal data shall only be shared with the Companies’ employees who require it to carry out recruitment duties, namely, with the Human Resources Department.

 

How long do the Companies keep personal data for?

Companies will retain personal data only for as long as it is necessary for the purposes for which it is collected and processed. The period of time for which the Companies hold or store the candidate's personal information depends on the scope of the application and/or the recurrence and frequency of the role being recruited for, which may be an ongoing process and therefore, imply a longer retention and conservation period.

Without prejudice to the storage for a longer period, candidates’ personal data will not be kept by the Companies for a period exceeding ten years, from the date of the end of the recruitment process or the date of submission of the application, depending respectively on whether the application is for a specific position or a spontaneous application.

 

What rights can Candidates exercise over the processing of their personal data?

The data subject has the following data protection rights: right to access, rectification, deletion, restriction of the processing, data portability, object to processing and to withdraw consent which shall not affect the lawfulness of processing based on consent before its withdrawal.

Under the terms of the applicable legislation, candidates may, at any time, exercise their rights, upon written request to Brisa Auto-Estradas de Portugal, SA - Human Resources Endowment Department, and/or to the Company, both at the following address: Quinta da Torre da Aguilha, Edifício Brisa, 2785-599 São Domingos de Rana.

For clarification on any doubts, the candidate may contact the Data Protection Officer at EPD_BAE@brisa.pt or at Quinta Torre da Aguilha, Edifício Brisa, 2785-599 São Domingos de Rana.

The exercise of these rights may be subject to the applicable legal provisions for each case and this Privacy Policy.

The Companies will carefully analyze each request, assessing its legitimacy, pertinence and provide a response, as established in the applicable legislation.

 

How can the Candidate file a complaint?

If Candidates consider that the treatment of their personal data by the Companies violates the legal regime in force, Candidates are entitled to file a complaint with the National Data Protection Commission (“CNPD”), located at Rua de São Bento, 148- 3.º, 1200-821 Lisboa (https://www.cnpd.pt/), or any other competent supervisory authority under the terms of the law, without prejudice to any other means of administrative or judicial appeal.

 

Changes to the Privacy Policy

The Companies reserve the right to change this Policy on the processing of personal data at any time in accordance with any update of their business practices or to comply with legal requirements.