Grantia Portugal, Lda.
Privacy Policy
English · Last updated: 15 September 2026
This Policy explains how Grantia Portugal, Lda. processes personal data in connection with its website, professional contacts, relationships with clients and suppliers, and recruitment processes.
1. Data controller
The data controller is Grantia Portugal, Lda., company number 518 765 245, with registered office at Praça Nuno Rodrigues dos Santos, 7, 1600-171 Lisbon, Portugal.
Privacy enquiries and requests to exercise data protection rights may be sent to geral@grantia.pt.
2. Personal data processed
Depending on the context, Grantia may process:
- identification and contact details, such as name, organisation, position, email address and telephone number;
- information included in contact requests, proposals, contracts, communications and project documents;
- data required for invoicing, payments and compliance with legal obligations;
- professional and curriculum vitae information submitted in applications;
- technical data associated with use of the website, such as IP address, access date and time, browser, device and, where applicable, cookie preferences.
Grantia does not request special categories of personal data through the website. Users should not include unnecessary sensitive information in communications sent to Grantia.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Responding to enquiries and requests for proposals | Pre-contractual steps and legitimate interest in responding to professional enquiries |
| Managing proposals, contracts, projects, invoicing and relationships with clients and suppliers | Performance of a contract, pre-contractual steps, legal obligations and legitimate interests in management and the defence of rights |
| Sending occasional corporate communications to professional contacts | Legitimate interest, without prejudice to the right to object; consent where legally required |
| Reviewing applications and contacting candidates | Pre-contractual steps at the candidate's request and legitimate interest in managing recruitment |
| Ensuring the operation, security and improvement of the website | Legitimate interest for strictly necessary functions; consent for non-essential cookies |
| Complying with legal obligations and responding to authorities | Compliance with a legal obligation |
Where processing is based on consent, consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal.
4. Sources of data
Data is normally provided by the data subject, by the organisation they represent, by a client or partner in the context of a project, or obtained from public professional sources such as corporate websites. Where data is not collected directly, Grantia provides the information required by the GDPR in the applicable cases.
5. Recipients and service providers
Data is accessed only by persons who need it for the purposes described above. To the extent necessary, it may be disclosed to information technology, website hosting and maintenance, Microsoft 365, accounting or legal support providers, or other providers subject to confidentiality obligations, as well as to public authorities where required by law.
Grantia does not sell personal data.
6. International transfers
Some technology providers may process data outside the European Economic Area. Where applicable, Grantia uses providers that rely on a lawful transfer mechanism, including a European Commission adequacy decision or Standard Contractual Clauses, together with any supplementary safeguards appropriate to the service.
7. Retention
Data is retained only for as long as necessary for the applicable purpose and to comply with legal obligations or defend legal rights. In particular:
- enquiries and contacts that do not result in a contractual relationship: generally up to two years after the last relevant interaction;
- client, supplier, contract, project and invoicing data: during the relationship and subsequently for the applicable statutory periods, which may be up to ten years;
- unsuccessful unsolicited applications: up to twelve months after receipt or completion of the process, unless the candidate authorises a longer retention period;
- corporate communications: until the recipient objects or while a relevant professional relationship exists;
- technical data and cookies: for the periods stated in the Cookie Policy or defined by the provider for service security and operation.
8. Data subject rights
Under applicable law, data subjects may request access to, rectification or erasure of their data, restriction of processing, data portability where applicable, and may object to processing based on legitimate interests. They may also withdraw consent where consent is the legal basis for processing.
Requests should be sent to geral@grantia.pt. Grantia may request the information required to verify the requester's identity. Data subjects may also lodge a complaint with the Portuguese Data Protection Authority, the Comissão Nacional de Proteção de Dados, at www.cnpd.pt.
9. Automated decision-making
Grantia does not make decisions based solely on automated processing that produce legal or similarly significant effects on data subjects.
10. Security and user responsibility
Grantia implements technical and organisational measures proportionate to the risks of processing. No system is completely immune to incidents; users should therefore avoid sending unnecessary or particularly sensitive data by email or through the website.
11. Changes
Grantia may update this Policy to reflect legal, technological or business changes. The version in force is the version published on the website, which states the date of its latest update.