Privacy Policy

This policy applies to everyone who interacts with Jupiter Wisdom and aims to clarify what personal data we collect, how it is collected, what purposes it is processed for, which principles guide its use, and what rights the data subject has.

The European Union's (EU) General Data Protection Regulation (GDPR) sets out detailed requirements for the collection, storage and management of personal data, applying both to European companies and organisations that process personal data in the EU and to companies and organisations established outside the EU that process personal data of people who live in the EU. The GDPR applies when an organisation processes personal data and is established in the EU, regardless of where the data processing takes place, or when the organisation is established outside the EU but processes personal data in connection with offering goods or services to people in the EU or monitors the behaviour of people in the EU.

Personal data is defined by the European Union's (EU) General Data Protection Regulation (GDPR), Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016, and by Law 58/2019 of 8 August, as “any information relating to an identified or identifiable natural person, referred to as the data subject. An identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier. In simpler terms, personal data refers to any information about you that allows you to be identified, and may cover obvious information such as name, address, IP address and contact details, as well as less obvious information, such as location data and online identifiers or factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. The GDPR protects personal data regardless of the technology used to process and store it, usually in digital or paper format.

Jupiter Wisdom, Lda, a legal entity with company number 516350820 and registered office at Avenida da Liberdade, n.º 245, 4.º A, 1250-143 Lisboa, as the data controller for your personal data, collects, processes and stores your personal data lawfully, fairly and transparently, in absolute confidentiality. We process your data in accordance with the following principles set out in the GDPR:

• Any processing of personal data is lawful, fair and transparent.
• Purpose limitation: we collect and process personal data only for specified, explicit, legitimate and initially established purposes. Personal data is not processed for later purposes or others that are incompatible with the initial purposes.
• Data minimisation: we collect, process, use and retain only the personal data strictly necessary and proportionate to the intended purpose.
• Accuracy: we ensure that personal data is precise, accurate and up to date. Inaccurate personal data will be rectified or erased.
• Storage limitation: the storage of natural persons' personal data is limited in time, taking into account the purpose for which the data was collected and processed. Accordingly, personal data is erased or anonymised as soon as it is no longer needed.
• Security and protection of data: we have appropriate technical and organisational security controls and measures to protect data against unauthorised access, modification, disclosure, loss or destruction.
• Transfers of data outside the EU: we only transfer personal data outside the EU when necessary or when the data subject has given consent, and when the protection afforded in the third country is considered adequate by the EU.

Rights of the data subject: Jupiter Wisdom respects all rights of data subjects.

Jupiter Wisdom processes the personal data you provide to us, for example, in the course of our professional activity, in carrying out pre-contractual or contractual steps, to comply with legal obligations, to respond to your requests, to provide information about our activity, to register you for business events and to handle your cases. In addition, to publicise and promote our activities, we may also process your personal data through photographs and/or videos available on the site, app, newsletter and/or social media. To ensure your safety and protection, we may also use the video surveillance system and the whistleblowing channel. We process your personal data only when we are duly entitled to do so under the data protection legislation in force. We may also be required to collect and process your data for the purposes of investigating, reporting and detecting crime, and also to comply with the laws that apply to us. In some circumstances, where permitted or required by law, we may process your personal data without your knowledge or consent.

In certain situations, personal data may be of a more sensitive nature, considered by the GDPR to be a special category of data. This category includes data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data on criminal convictions, and data concerning health or sexual orientation. Processing of this category of data is always based on the need to process it in order to comply with a legal obligation to which we are subject, on the data subject's explicit consent, or on the need to process it in the course of our professional activity.

The personal data of minors, where its collection and processing does not stem from a legal basis, will only be collected and processed when necessary and with the consent of the holders of parental responsibility or guardians.

We collect personal data in the course of our activities and initiatives, through applications and services available on our website, by way of requests, forms, declarations, communications, complaints or other related activities. Data may be received directly from a data subject (for example, in person, by post, email, telephone, messages or from other sources) or via partners, subcontractors, joint controllers, service providers, among others. We also collect information when you send us, for example, your curriculum vitae. Providing your personal data is not a legal obligation, but it may be necessary for entering into a service, internship or any other type of contract, in which case providing the personal data will be mandatory. In these cases, failure to provide it results, for example, in the impossibility of entering into a contract or of carrying out a requested service.

The personal data we process depends on the context of the interactions between Jupiter Wisdom and the data subject, and, in the cases provided for by law, on the competent authorities. Accordingly, we may process the following personal data:

• Identification data: Name; age/date of birth; civil identification number; social security number; image; passport; nationality.
• Contact data: Email address; telephone and/or mobile number; address.
• Billing data: Tax identification number (NIF); IBAN; amount charged and other data related to billing.
• Location data: Geographical location.
• Data on professional life: CV; employment status; education; training; qualification certificates.
• Family life data: Family situation; household data; marital status.
• Financial and asset information: Bank identification number; income; pensions; investments; policies; social benefits; allowances; scholarships; tax data; Tax Authority (AT) declarations.
• Internet browsing data: for more information see the section Cookies and similar technologies.
• Video data: If you visit our premises, your image may be captured by our video surveillance cameras.
• Voice data: Your call may be recorded when you contact us by telephone, if you give your consent.
• Video, image and sound data: Data collected during events and actions organised by, or in collaboration with, Jupiter Wisdom.
• Special category data, where there is a legal basis: Relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data on sex life, diet and health, including (certificates of partial or total permanent incapacity, chronic illnesses, disabling illnesses, medical prescriptions and health expenses). Other sensitive or special data may be collected spontaneously or inadvertently, for example, when you are invited to lunch and tell us you are allergic to a food, or when you tell us data about your spouse, boyfriend/girlfriend or partner.
• Other personal data not identified here may be requested, where there is a specific legal framework for it.
• In addition, we also collect information you provide through the content of the messages you send us, such as comments on social media or through suggestion, criticism and/or complaint forms.

Under EU data protection rules, Jupiter Wisdom processes data lawfully and fairly, for specific and legitimate purposes and only to the extent necessary for those purposes. We process personal data only in one of the following circumstances:

• With the consent of the persons concerned.
• Where there is a contractual obligation (a contract between your organisation and a natural person).
• To comply with a legal obligation under EU or national law.
• If processing is necessary for the performance of a task carried out in the public interest under EU or national law.
• To protect the vital interests of an individual.
• For the legitimate interests of your organisation (unless the interests or fundamental rights of individuals override them).

In addition, the GDPR lays down further conditions for the processing of sensitive data. The GDPR requires data subjects to be provided with information about the processing in order to ensure fair and transparent processing. Whenever we collect personal data, we explain appropriately why we need the information and how we will process it.

The data collected by Jupiter Wisdom is mainly for internal processing or for subcontracted entities. We may disclose your personal data, in order to comply with legal obligations, to police, judicial, tax and regulatory authorities, among others.

Where subcontractors have access to personal data in order to carry out data processing on behalf of Jupiter Wisdom, we have adopted measures to ensure compliance with the requirements imposed by the General Data Protection Regulation (GDPR), namely contractual measures. Any subcontracted entity will process personal data in the name and on behalf of Jupiter Wisdom. As a processor, Jupiter Wisdom carries out the processing of personal data on behalf of the controller. The controller determines the purposes and means of processing personal data, and the relationship, responsibilities and compliance with the GDPR are governed by a contract between the controller and Jupiter Wisdom.

In today's globalised world, Jupiter Wisdom may store personal data on servers located in several different countries, within and outside the EU. The protection granted by the General Data Protection Regulation (GDPR) travels with the data, which means that the rules protecting personal data continue to apply regardless of where the data is located. This also applies when data is transferred to a country that is not a member of the EU. Jupiter Wisdom is aligned with the GDPR, which provides different instruments to frame transfers of data from an EU country to a third country. In certain cases, a third country may be declared to offer an adequate level of protection by a decision of the European Commission (adequacy decision), which means that data can be transferred to a company located in the third country without the data exporter having to provide additional safeguards and without being subject to additional conditions. In other words, transfers to an “adequate” third country will be similar to a transmission of data within the EU. In the absence of an adequacy decision, the transfer may be carried out by providing appropriate safeguards and on condition that individuals enjoy enforceable rights and effective legal remedies. These appropriate safeguards include, in particular, the following:

• In the case of a group of undertakings, or groups of undertakings engaged in a joint economic activity, the companies may transfer personal data on the basis of so-called binding corporate rules.
• Contractual provisions with the recipient of the personal data, using, for example, the standard data protection clauses adopted by the Commission
• Adherence to a code of conduct or a certification mechanism, together with binding and enforceable commitments by the recipients to apply the appropriate safeguards to protect the transferred data.
• Finally, if a transfer of personal data is envisaged to a third country that is not subject to an adequacy decision and in the absence of appropriate safeguards, the transfer may be carried out on the basis of a set of derogations applicable in specific situations, for example if a person has explicitly consented to the proposed transfer after having been provided with all the necessary information about the risks associated with it.

Jupiter Wisdom has implemented a set of security technologies and procedures considered appropriate to protect your personal data against any unauthorised access, modification, disclosure, loss or destruction. We invest continuously in information security with the aim of protecting your personal data against existing threats as well as emerging and unknown ones.

The General Data Protection Regulation (GDPR) conferred rights on individuals by imposing greater transparency in communications between public or private entities, responsible for data processing, and data subjects, and by defining specific rules for the exercise of those rights. Jupiter Wisdom considers it essential to inform people about what their rights are and how they can exercise them properly. Special situations and restrictions on rights are regulated by Law 59/2019 of 8 August.

Right to be informed

The right to be informed allows people to understand what will be done with their data and, consequently, to make informed decisions and have more control over their personal data. When requested, Jupiter Wisdom will make the information available in a clear, transparent, easily understandable way and free of charge. You have the right to obtain a reply within one month of the date on which your request is received. This period may be extended by a further two months where necessary. If so, Jupiter Wisdom must give reasons for the delay within the initial period. Please note that the exercise of your rights must not adversely affect the rights and freedoms of others.

Right of access

Jupiter Wisdom must provide data subjects with clear information about who is processing their personal data and why, including, at a minimum, the following:

• Purposes of the processing;
• Categories of personal data processed;
• If the data was not collected from you, the source of the data, if available;
• Entities acting in the name and on behalf of the controller;
• Third parties to whom the data is disclosed;
• Data retention period or the criteria used to set the period;
• Whether your data is subject to automated decisions and whether profiling takes place – if so, the underlying logic, as well as the significance and the consequences that the processing of data may have for you;
• Whether your personal data is transferred to countries or international organisations outside the European Economic Area.

Right to rectification

If the data subject considers that their personal data is incorrect, incomplete or inaccurate, they have the right to have it rectified or completed without undue delay. If this happens, Jupiter Wisdom must inform all recipients with whom it shares the data in question that it has been changed or erased. If personal data you have shared is incorrect, Jupiter Wisdom may also have to inform anyone who has accessed it of this (unless this is considered a disproportionate effort).

Right to object

The data subject may object at any time to the processing of their personal data on grounds relating to their particular situation, whenever it involves:

• Processing necessary for the performance of tasks in the public interest or in the exercise of official authority.
• The pursuit of the legitimate interests of the controller or of;
• Reuse of the data for a purpose different from the one for which it was initially collected, including profiling.

In these cases, Jupiter Wisdom will cease the processing unless it demonstrates compelling legitimate grounds that override the interests, rights and freedoms of the data subject, or for the purpose of exercising a right in legal proceedings. You have the right to object, at any time and without giving a reason, to the processing of your data for direct marketing purposes, including the associated profiling.

Right to erasure

In certain circumstances, the data subject may ask the controller, Jupiter Wisdom, to erase their personal data if it is no longer necessary to fulfil the purpose of the processing. However, Jupiter Wisdom is not obliged to erase the data if:

• Its processing is necessary to respect freedom of expression and information.
• It has to retain the personal data to comply with an obligation.
• There are other reasons of public interest for retaining the personal data, such as reasons relating to public health or scientific and historical research.
• Retention of the personal data is necessary in the context of proceedings.

Automated decision-making and profiling

Data subjects have the right not to be subject to any decision based solely on automated processing. However, there are some exceptions to this rule, such as where data subjects give their explicit consent to automated decisions. Unless the automated decision is authorised by law, Jupiter Wisdom must:

• Inform the data subject about the decisions.
• Give them the right to request a review of the decision.
• Give them the right to contest the decision.

Right to data portability

Whenever the processing is based on consent or a contract, the data subject may request that the personal data be transmitted to another company. The data must be provided in a commonly used, machine-readable format.

Right to restriction

In certain circumstances, data subjects may request a restriction on the processing of their data. As a result, Jupiter Wisdom may still retain the personal data but must cease all other processing activities. The data subject has the right to obtain restriction of processing when:

• The data subject contests the accuracy of the personal data.
• The processing is unlawful: instead of erasure of the data, the data subject may instead request restriction of the use of the personal data.
• Jupiter Wisdom no longer needs the personal data, but the data is still required by the data subject to bring legal proceedings.
• The data subject has exercised the right to object.

The restriction applies for the time needed to verify whether the legitimate grounds pursued by the organisation override those of the data subject. If the data subject successfully exercises their right to restriction of processing, Jupiter Wisdom may only use the data in certain specific circumstances, for example with the data subject's consent or for the defence of legal claims. Before lifting the restriction, Jupiter Wisdom will inform the data subject of its intention to do so.

Right to withdraw consent

The data subject has the right to withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent previously given. Before giving their consent, the data subject is informed of this. Consent must be as easy to withdraw as to give. Where processing is carried out on the basis of consent, Jupiter Wisdom must be able to demonstrate that the data subject has consented to the processing of their personal data.

Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with the competent authority if you fear that your data protection rights have been infringed. In Portugal the national supervisory authority is the National Data Protection Commission (Comissão Nacional de Proteção de Dados, CNPD):

The National Data Protection Commission (Comissão Nacional de Proteção de Dados)

• Avenida D. Carlos I, n.º 134 – 1.º 1200-651 Lisboa, Portugal
• Website: www.cnpd.pt
• E-mail: geral@cnpd.pt
• Privacy Line telephone: (+351) 21 393 00 39
• Telephone: (+351) 213 928 400
• Fax: (+351) 21 397 68 32
• Online information requests: www.cnpd.pt/cidadaos/pedidos-de-informacao
• Online complaint submissions: www.cnpd.pt/cidadaos/participacoes

The period for which personal data is stored and retained varies according to the purpose for which the information is processed. Where there is no specific legal requirement, data will be stored and retained only for the minimum period necessary to pursue the purposes that motivated its collection or further processing, as defined by law. In the absence of a legal or regulatory provision, we rely on the decisions of the data protection supervisory authorities (at European level) to determine the retention period.

Jupiter Wisdom uses cookies on the site for the purpose of improving the user experience and the quality of the features made available on our web page. For more details, see our Cookie Policy.

We use social media to get closer to the general public and to publicise our activities, in pursuit of our mission and respective responsibilities. Accordingly, our site contains hyperlinks to social media, and Jupiter Wisdom has no management control over them, nor are they covered by this privacy policy. In this regard, when you choose to follow us on social media, your personal data is also processed by external entities, in accordance with their privacy policies, which we recommend you read.

• Facebook: https://facebook.com/privacy/policy/
• X (formerly Twitter): https://help.twitter.com/pt/rules-and-policies/x-rules
• YouTube: https://youtube.com/intl/ALL_pt/howyoutubeworks/user-settings/privacy/
• Instagram: https://about.instagram.com/pt-br/blog/announcements/instagram-community-data-policy
• Pinterest: https://policy.pinterest.com/pt-pt/privacy-policy
• LinkedIn: https://pt.linkedin.com/legal/privacy-policy

For clarifications and more information on the GDPR you can consult the regulation or get in touch: Jupiter Wisdom, Lda. Avenida da Liberdade, n.º 245, 4.º A, 1250-143 Lisboa, Portugal. Email: jupiter@jupiterwisdom.com

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).

Law no. 58/2019 of 8 August, which ensures the implementation of the GDPR in the national legal order. In order to protect your personal data we seek alignment with other regulations and directives:

• The legal framework for cyberspace security: Law no. 46/2018 of 13 August, Decree-Law no. 65/2021 of 30 June, Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016, on the security of networks and information across the European Union.
• NIS 2 (SRI 2): Decree-Law no. 125/2025, published on 4 December 2025 and in force since 3 April 2026 (Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022) on measures to ensure a high common level of cybersecurity in the EU.

In the event of a personal data breach, Jupiter Wisdom notifies the National Data Protection Commission (CNPD), where possible within 72 hours of becoming aware of it. Any Jupiter Wisdom processor must notify the controller without undue delay after becoming aware of a personal data breach. In addition to consulting the website of the National Data Protection Commission (CNPD), we also recommend regularly consulting the website of the National Cybersecurity Centre (Centro Nacional de Cibersegurança, CNCS) in Portugal, which promotes the use of cyberspace in a free, reliable and secure way, through the continuous improvement of national cybersecurity. https://www.cncs.gov.pt

This document (and its content) is governed by and construed in accordance with Portuguese law. The courts of the district of Lisbon have jurisdiction, to the exclusion of any other, to settle any disputes arising from the interpretation and application of this document (and its content).

We may make changes to this privacy policy in order to comply with legislative or regulatory requirements, or to adapt it to instructions issued by the National Data Protection Commission, so users are advised to consult it periodically. Any changes will apply immediately to you and your data. If such changes affect the way your data is processed, we will take all reasonable steps to keep you informed.