Privacy and data retention

Applications and CVs: normally no longer than 12 months from submission. Business enquiries that do not lead to a contractual relationship: 6 months from submission. We keep only necessary data, with documented exceptions for legal obligations or the protection of rights.

1. Controller and contact details

The controller is ANTARES WORK - EMPRESA DE TRABALHO TEMPORÁRIO, LDA, Avenida Fontes Pereira de Melo, 16, 1050 121 Lisboa, Portugal, NIF/NIPC 519137043; IEFP · ALVARÁ N° 1038/26.

For applications and related data rights: candidature@antareswork.com. For business enquiries: richieste@antareswork.com. You may also use these contacts for privacy questions, quoting your submission reference where available. Do not send identity documents unless requested for a necessary and proportionate identity check.

2. Data we collect

The forms collect first and last name and contact details. Candidates also provide their location, country, preferred role, availability, message and CV. Business contacts provide their company name, sector, required roles and number of staff, workplace, timing and requirements. We also retain the date, submission reference, language, version of the privacy notice acknowledged and handling status.

Fields marked * are necessary to handle the request; the form cannot be submitted without them. Other fields are optional. Provide only relevant information: we do not request health information, political opinions, religion, trade union membership, criminal records or identity documents in CVs or free-text fields. Any further data required for employment will be requested separately.

The infrastructure also processes connection data, such as IP addresses and browser information, to deliver and protect the service. The form uses an identifier derived from the IP address and hour to limit abusive submissions, with a two-hour expiry and cleanup on the next submission request.

3. Purposes and legal bases

Applications: we assess the profile and take pre-contractual steps requested by the candidate under GDPR Article 6(1)(b). An application to a vacancy concerns that selection process; an open application concerns opportunities matching the profile and request. An additional purpose requires an appropriate legal basis and specific information before it begins.

Business enquiries: we respond to the contact and assess the requested service on the basis of our legitimate interest in managing professional relationships, Article 6(1)(f). Where the requester is personally a party to the prospective contract, pre-contractual steps under Article 6(1)(b) may also apply. You may object to processing based on legitimate interests as provided by the GDPR.

Abuse prevention and security rely on our legitimate interest in protecting the service. Statutory duties rely on Article 6(1)(c); necessary retention for establishing, exercising or defending legal claims may rely on Article 6(1)(f). The checkbox records acknowledgement of this notice, not consent to marketing. We do not automatically subscribe people to newsletters, sell their data or make solely automated recruitment decisions or perform automated profiling.

4. Who may receive the data

Authorised staff may access data as required for their duties, as may the relevant technical providers. The site uses OpenAI Sites and Cloudflare infrastructure for hosting, storage and security; Resend for email alerts; and Register.it business email for the recipient mailboxes. Administrative access uses ChatGPT authentication, separately from the public forms, which do not require an account.

New email alerts contain the submission type and reference and a link to the restricted area, without the applicant’s CV, name or contact details. Alerts sent before this update may contain contact details. CVs remain in restricted storage. Direct email replies also involve the relevant email providers.

Relevant data may be shared with businesses involved in recruitment after discussing the search and recipients with the candidate; the website does not automatically forward CVs to employers. Advisers and authorities may also receive data where necessary for legal obligations or the protection of rights.

5. Processing outside the EEA

Providers may operate outside the European Economic Area. Resend states that it stores data in the United States and applies EU Standard Contractual Clauses; choosing a European sending region does not mean EU-only storage.

For hosting, infrastructure and email, locations, roles and safeguards depend on the service and applicable terms. Transfers subject to the GDPR require an adequacy decision or appropriate safeguards, including Standard Contractual Clauses where applicable. Contact us above for information about the providers involved and a copy or indication of the relevant safeguards.

6. Retention periods

Applications and CVs: up to 12 months from submission, with earlier deletion when the purpose ends and no other basis for retention applies. Business enquiries that do not lead to a relationship: up to 6 months from submission. Merely reading or archiving a submission does not restart these periods.

The restricted area calculates deadlines from the submission date. Expired submissions are flagged for deletion and CVs are unavailable for normal reuse. Authorised staff carry out the review and deletion; this is not an automatic scheduled purge. The procedure also covers emails, downloaded attachments and other working copies.

If an employment or business relationship begins, necessary data is handled in the relevant file under the information and retention rules applicable to that relationship. Documents necessary for legal obligations or disputes may be kept longer, with restricted access and use, a documented reason and a review date. Article 32 of Portugal’s Labour Code requires recruitment process records to be kept for five years: the required elements must be identified and preserved before deletion, without indiscriminately extending retention of all CVs.

Deletion from the portal removes the record and CV from active storage; it does not by itself remove copies in mailboxes, devices or providers’ backups. External copies must be handled in the same procedure; any backup copies remain subject to provider cycles and restrictions and must not be restored to normal use. Published technical provider rules are linked below.

7. Your rights

Where provided by the GDPR, you may request access, rectification, erasure, restriction and portability, and object to processing based on legitimate interests. If additional processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. Erasure may be limited by legal obligations or the need to protect a legal claim; we will explain any such reason.

Write to the relevant contact above. We normally respond within one month; complex requests may be extended within GDPR limits, with notice during the first month. You may complain to Portugal’s Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt, or the competent authority where you habitually live, work or where the alleged infringement occurred.

8. Security and updates

The site uses HTTPS. Viewing, downloading and deleting submissions require administrative authorisation; CVs have no public download link. These measures reduce risk without making any system immune to incidents. Material changes to purposes or conditions are communicated before new processing where required. Publication of this version does not constitute a new acknowledgement by people who submitted data earlier.

9. Optional statistics with Google Analytics

With your consent (GDPR Article 6(1)(a)), we use Google Analytics 4 to understand which pages are visited and how many candidate applications and business enquiries are completed. The Google tag loads only after you choose “Accept statistics” or enable this category and save your preferences. Refusing does not restrict forms or other services.

Statistical data includes pseudonymous cookie identifiers, public page addresses without query parameters or fragments, language, timestamps, basic browser/device information and the type of completed submission. We do not send Google names, email addresses, phone numbers, CVs, form contents, application references or personal user identifiers. The connection also communicates your IP address to Google; Google states that Analytics does not log or store it. Google Signals, user-provided data collection, granular location/device data collection, Enhanced Measurement and advertising personalization remain disabled.

The service is provided by Google Ireland Limited, which processes data on our behalf under the Google Ads Data Processing Terms accepted for Analytics. Optional account data sharing is disabled. Processing may involve Google LLC and infrastructure outside the EEA, including the United States; Google identifies the Data Privacy Framework for covered transfers and standard contractual clauses where provided by its terms. Google sources and safeguards are linked below; you may also contact us for further information.

Analytics user-level and event-level data retention is set to 2 months, without resetting the period on new activity; Google carries out deletion periodically. This limit does not apply to standard aggregated reports. Analytics cookies are configured for 180 days without automatic expiry renewal. Your cookie choice is remembered for 180 days; see the cookie notice for details.

You can withdraw consent through “Cookie preferences” in the footer by choosing “Necessary only” or switching Statistics off and saving. The site stops collection, removes its accessible Analytics cookies and reloads the page. Withdrawal does not affect earlier lawful processing or automatically erase data already sent to Google; use the contacts above to exercise your rights. Google Tag Manager is prepared for possible future campaigns, but its container is not loaded on the site. Advertising and remarketing tags are inactive.

Provider information and documentation

These links describe providers’ services; the applicability of their terms depends on the service and agreement in use.

Cookies and technologies ↗