This Privacy Policy governs the processing of personal data by J. LIVIO, sole proprietor, trading as pH7x Systems®, in connection with your use of https://ph7x.com (the "Service"), in accordance with:

• General Data Protection Regulation (GDPR) – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016;
• Lei n.º 58/2019 of 8 August – Portuguese GDPR implementation law;
• Lei n.º 41/2004 of 18 August – Protection of personal data in electronic communications.

By using this Service, you acknowledge the processing of personal data described herein. Where required by law, we request your consent (for example, for analytics cookies).

1. Data Controller

Given the nature and scale of data processing activities, a designated Data Protection Officer (DPO) is not legally required under Article 37 of the GDPR. All data protection matters are handled directly by the Data Controller at the email address above.

2. Categories of Personal Data

We may collect and process the following categories of personal data:

• Identification and contact data: Full name, email address, telephone number, company/role (when provided);
• Account and authentication data: Username, hashed password, roles, login metadata;
• Candidate data: CVs, education, experience, skills, and profile information you provide;
• Application and recruitment data: Job applications, status updates, and related communications;
• Quote/proposal data: Service requests, requirements, estimates, and related correspondence;
• Technical and security data: IP address, browser type and version, device information, operating system, timestamps;
• Usage data: Pages visited, date/time of access, navigation patterns;
• Audit and consent logs: Event and consent records, including hashed identifiers for integrity and traceability;
• Cookie data: As detailed in our Cookie Policy.

3. Legal Bases and Purposes

Your personal data is processed based on the following legal grounds (Article 6 GDPR):

Purpose	Legal Basis
Account creation, authentication, and portal access	Art. 6(1)(b) – Performance of a contract
Job applications, CV management, and recruitment communications	Art. 6(1)(b) – Steps prior to entering a contract
Quote requests, proposals, and pre-contract steps	Art. 6(1)(b) – Steps prior to entering a contract
Response to inquiries and support	Art. 6(1)(f) – Legitimate interest
Service improvement and analytics	Art. 6(1)(a) – Consent (for cookies)
Security, audit logging, and abuse prevention (incl. reCAPTCHA)	Art. 6(1)(f) – Legitimate interest
Compliance with legal obligations	Art. 6(1)(c) – Legal obligation

4. Cookies and Consent Management

Our website uses cookies in accordance with Lei n.º 41/2004 and the ePrivacy Directive. We have implemented a cookie consent management system that allows you to:

• Choose which cookie categories to authorize (strictly necessary, functional, analytics);
• Modify or withdraw your consent at any time;
• Block all non-essential cookies until explicit consent is provided.

For detailed information about cookies used on this site, please consult our Cookie Policy.

5. Data Retention

Personal data is retained only for as long as necessary to fulfill the purposes described above:

Data Category	Retention Period	Legal Basis
Account data	Duration of account + 12 months	Contractual necessity
Job applications and CVs	Up to 24 months from last activity	Legitimate interest
Quote/proposal records	Up to 24 months from submission	Pre-contractual steps
Contact/support messages	Up to 12 months	Legitimate interest
Audit and security logs (incl. consent records)	Up to 5 years	Legitimate interest / legal obligation

After the applicable retention periods, data will be securely deleted or anonymized.

6. Data Sharing and Processors

Your data may be shared with the following categories of recipients:

• Service providers (processors): Cloud hosting and storage (Microsoft Azure / Azure Blob Storage), email delivery (Microsoft 365 SMTP), analytics (Google Analytics), security/anti-abuse (Google reCAPTCHA), and cookie consent management (Cookie Script);
• Legal and regulatory authorities: When required by law or court order;
• Professional advisors: Lawyers, accountants, auditors bound by confidentiality.

All processors are bound by Data Processing Agreements (DPAs) in accordance with Article 28 of the GDPR, ensuring appropriate technical and organizational measures for data protection.

7. International Data Transfers

When personal data is transferred outside the European Economic Area (EEA), we ensure adequate protection through:

• Adequacy decisions by the European Commission (e.g., EU-US Data Privacy Framework);
• Standard Contractual Clauses (SCCs) approved by the European Commission;
• Binding Corporate Rules (BCRs) where applicable.

You may request information about the safeguards applied by contacting us.

8. Your Rights (Data Subject Rights)

Under the GDPR and Lei n.º 58/2019, you have the following rights:

• Right of access (Art. 15) – Obtain confirmation and a copy of your personal data;
• Right to rectification (Art. 16) – Correct inaccurate or incomplete data;
• Right to erasure (Art. 17) – Request deletion of your data ("right to be forgotten");
• Right to restriction (Art. 18) – Limit processing in certain circumstances;
• Right to data portability (Art. 20) – Receive your data in a structured, machine-readable format;
• Right to object (Art. 21) – Object to processing based on legitimate interests or direct marketing;
• Right to withdraw consent (Art. 7) – Withdraw consent at any time without affecting prior lawfulness;
• Right to lodge a complaint – File a complaint with the supervisory authority.

To exercise these rights, please contact:

We will respond within 30 days of receiving your request, as required by law.

9. Supervisory Authority

You have the right to lodge a complaint with the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados – CNPD):

10. Automated Decision-Making and Profiling

We do not currently engage in automated decision-making or profiling that produces legal effects or similarly significantly affects you (Article 22 GDPR).

Analytics data is processed in aggregate or anonymized form and is not used to make individual decisions about users.

11. Children's Privacy

Our services are not directed at individuals under 16 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a minor without appropriate consent, we will delete it promptly.

12. Security Measures

We implement appropriate technical and organizational measures to protect personal data, including:

• TLS/SSL encryption for data in transit;
• Encrypted storage for data at rest;
• Access control and authentication mechanisms;
• Audit logging with integrity controls (event/consent logs with hashed identifiers);
• Regular security audits and vulnerability assessments;
• Incident response procedures.

However, no method of transmission over the Internet is 100% secure. You use our services at your own risk.

13. Third-Party Links

Our website may contain links to third-party websites. This Privacy Policy does not apply to those sites. We encourage you to review their privacy policies before providing any personal data.

14. Policy Updates

We may update this Privacy Policy from time to time. Material changes will be communicated through:

• A notice on our website;
• Email notification (for registered users);
• An updated "Last Updated" date at the top of this policy.

We encourage you to review this policy periodically.

15. Contact Information