data protection POLICY

To establish the principles, rules, responsibilities and procedures that ensure the protection of personal data processed by xseed, promoting compliance with the GDPR, transparency towards data subjects and the adoption of appropriate technical and organisational measures.

Data Controller: xseed – Consultoria e Sistemas de Informação, Lda. 
Address: Alameda António Sérgio nº7 – 1ºA, 2795‑023 Linda‑a‑Velha, PORTUGAL 
Email for privacy and data subject rights: [email protected] 
Supervisory Authority: Comissão Nacional de Proteção de Dados (CNPD) – www.cnpd.pt 
DPO / Data Protection Officer: [email protected]

• Personal data: Information relating to an identified or identifiable natural person. 

• Processing: Any operation performed on personal data (collection, recording, storage, consultation, transmission, deletion, etc.). 

• Data subject: The natural person whose data is processed. 

• Processor: Entity processing personal data on behalf of xseed. 

• Personal data breach: A security incident resulting in the destruction, loss, alteration, unauthorised disclosure of or access to personal data.

xseed ensures that all processing activities comply with: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability.

Employees and interns: 

Identification data, contact details, contractual, payroll and tax data, attendance/working hours, training and evaluation data, IT data (access logs), and other data required by law. 

Job candidates: 

Identification, contacts, CV, academic/professional background, interview notes. 

Client and supplier representatives: 

Identification, professional contact details, position, data necessary for contract execution, invoicing and legal compliance. 

End‑users of services (when applicable): 

Data necessary for the performance or operation of the contracted service. 

Visitors of facilities (when applicable): 

Identification, entry records; CCTV data according to legal requirements. 

Only adequate, relevant and limited data is collected.

Note on employees: Consent is not used as a legal basis in the employment context except in exceptional situations with no imbalance of power.

Personal data may be collected: 
(i) directly from the data subject, 
(ii) from the client/employer (if the data subject works for a client), 
(iii) via systems and applications used in service delivery, 
(iv) from lawful public sources (e.g., public professional listings).

Data may be shared with: 

• Public authorities (judicial, regulatory, tax), when required by law; 

• Partners and processors (cloud/hosting, IT support, productivity tools, accounting, auditing, HR); 

• Clients, when necessary for contract execution and lawfully justified. 

xseed signs Data Processing Agreements compliant with Article 28 GDPR, ensuring: 

• processing under xseed’s instructions, 

• confidentiality, 

• adequate security measures, 

• support with data subject rights, 

• deletion/return of data at end of service. 

xseed may request evidence of compliance or conduct audits.

Transfers outside the EEA only occur when: 
(i) there is an adequacy decision, 
(ii) Standard Contractual Clauses (SCCs) or other safeguards apply, 
(iii) supplementary measures are implemented when needed. 

If no transfers occur, this is indicated in the relevant processing documentation.

xseed retains personal data only for the necessary period according to legal requirements and best practices: 

• Employees: duration of the employment relationship + legal deadlines 

• Candidates: up to 12 months, with consent, for future opportunities 

• Clients/suppliers: duration of the contractual relationship + accounting/tax deadlines 

• Security logs: according to internal policy and legal/technical requirements 

Data is securely deleted or anonymised after retention periods end.

Data subjects may exercise the following under Articles 12–22 GDPR: 
access, rectification, erasure, restriction, portability, objection, and withdrawal of consent (if applicable). 

Requests should be sent to [email protected]. 
xseed responds within 30 days, extendable when necessary with prior notice. 

Data subjects may lodge a complaint with CNPD (www.cnpd.pt).

xseed implements risk‑based measures, including: 

• Policies, risk management, privacy by design/default 

• Identity/access management, strong authentication, least‑privilege access 

• Encryption in transit and (when applicable) at rest 

• Backups, recovery tests, patching, hardening 

• Logging and monitoring 

• Third‑party due diligence and contractual safeguards 

• Staff training and confidentiality obligations 

• Physical security of facilities and archives

xseed maintains an up‑to‑date Record of Processing Activities, documenting purposes, data categories, recipients, transfers, retention periods and security measures, made available to the CNPD upon request.

For high‑risk processing, xseed conducts Data Protection Impact Assessments and embeds privacy principles into processes, systems and contracts.

In the event of a personal data breach, xseed will: 

1. Activate the incident response plan;

    

2. Assess risk to data subjects;
    
3. Notify the CNPD within 72 hours, when required;
    
4. Notify data subjects when the breach is likely to result in high risk;

    

5. Record the incident and implement corrective measures.

xseed does not target children. When applicable, legal age limits and parental consent requirements are followed.

Use of cookies and electronic marketing communications complies with applicable law and is detailed in specific policies (e.g., Cookie Policy, Communications Policy).

CCTV is used in compliance with legal requirements (signage, retention periods, restricted access) and is not used to monitor employee performance.

xseed may update this Policy as needed to reflect legal, organisational or technological changes. 

Last updated: 26/01/2026

This Policy was approved by xseed’s Administration and is mandatory for all employees and service providers acting on behalf of xseed. 
Non‑compliance may lead to disciplinary and/or contractual consequences, without prejudice to civil, administrative or criminal liability.