top of page
Transparent Logo.png

Privacy Policy

GuestWorld is the Data Controller. This Privacy Policy describes how GuestWorld ("we", "our") collects, uses and protects the personal information of candidates, employees, corporate clients (with regard to the natural persons who represent them) and suppliers (with regard to the natural persons who represent them). We are committed to protecting the personal data of all data subjects whose personal data we process.

​

1. DATA WE COLLECT AND PROCESS

Candidates’ data is obtained mainly through CVs submitted in spontaneous applications, responses to recruitment advertisements or through professional social networks (e.g. LinkedIn).

In the case of Employees, data is obtained in connection with the establishment and performance of an employment relationship with GuestWorld through an employment contract.

With regard to Contact Persons and Company Representatives (Clients, Partners or Suppliers), their personal data is obtained in the context of their interaction with us and the performance of a contract with the company they represent.

​

Candidates

  • Name, address and contact information (mobile phone and email);

  • Nationality, visa and residence permit;

  • Information contained in the CV, including professional experience, skills and qualifications;

  • Identification document number;

  • Professional references;

  • Information relating to the recruitment and selection process (interviews, as well as admission or selection tests and assessments);

  • Other information voluntarily provided by candidates.

 

Employees

  • Identification data: name, address, date of birth, contact information, tax identification number, Social Security identification number, nationality, visa and residence permit;

  • Family situation: marital status, number of dependants and other information that may determine entitlement to social benefits;

  • Professional activity: working hours and workplace, internal identification number, photograph, date of admission, seniority, professional category, seniority in the category, salary level/grade, performance ratings and evaluations, nature of the contract, department, working-student status, line manager, reporting-line details, security access permissions, pre-retirement, termination date, work abroad (date, duration and location), work equipment provided, authorised software applications, access permissions to IT systems, internet and email, and dates of assignment and cancellation;

  • Education: level of education/qualifications, educational institutions, course title, start and completion dates, final course/training grade, professional certification/licence, certificates, foreign language skills (writing, speaking and reading), and information technology/computer skills;

  • Professional experience: companies, admission and departure dates, positions held and main duties/tasks performed;

  • Professional training and related records, including qualifications, assessments, training provider, type of training, certificate/diploma, training hours, training schedule and training-hour credits;

  • Remuneration-related information: base remuneration, monetary or in-kind remuneration, other fixed or variable benefits, salary increases (amount, dates, progression), overtime, allowances, bonuses, subsidies, holidays, attendance and absenteeism, leave, other elements relating to supplementary remuneration, amount or rate of mandatory or optional deductions, and the corresponding tax, social security and accounting treatment, wage garnishments, pre-retirement, circumstances determining suspension of the employment contract and respective dates, and employment-related credits;

  • Disciplinary proceedings: name of the person conducting the proceedings, reasons justifying the disciplinary proceedings, relevant dates, suspension of the employee (if applicable), final decision and disciplinary sanction applied;

  • Other data: degree of employee disability, place of payment, bank account number, membership number and identification of the entity to which mandatory or optional deductions must be paid (trade union, social services, sports group, etc.), trade union representative, employee representative (for the purposes of complying with Labour Code provisions establishing rights and duties for employees who are trade union delegates or employee representatives), time credits, weekly rest days, and fit or unfit for work.

​

Corporate Clients (contact persons)

  • Name, position, business address, contact information and correspondence exchanged.

 

Suppliers (contact persons)

  • Name, position, business address, contact information and correspondence exchanged.

 

The provision of most of the data referred to above is mandatory, as it is necessary for GuestWorld to comply with its contractual and legal obligations or to pursue its legitimate interests, as explained below.

 

Outside these cases, whenever data processing is based on consent, there is no legal, contractual or other obligation to provide us with your personal data, and any refusal to provide such data will have no consequence for the contractual relationship.

 

2. PURPOSES OF DATA PROCESSING

The data collected and processed is strictly limited to what is necessary for the purposes for which it was collected.

These purposes, by category of data subject, are as follows:

 

Candidates

  • Assess the candidate’s suitability for job vacancies;

  • Conduct the recruitment and selection process;

  • Maintain candidate records for future placement opportunities;

  • Ensure compliance with legal and regulatory obligations.

​

The legal bases for processing candidates’ personal data are:

(i) Consent, both when submitting an application and for future placement opportunities;

(ii) GuestWorld’s legitimate interests in verifying and assessing applications;

(iii) Compliance with a legal obligation, such as maintaining records of recruitment processes.

 

Employees

  • Administratively manage employees;

  • Process payments and benefits;

  • Ensure compliance with legal and regulatory obligations;

  • Ensure occupational health and safety;

  • Promote company activities and events (e.g. team building).

 

The legal bases for processing employees’ personal data are:

(i) Entering into and performance of the employment contract;

(ii) Compliance with legal obligations (such as employment, tax and social security, occupational health and safety, and immigration obligations);

(iii) GuestWorld’s legitimate interests in managing, planning and organising work, protecting the assets of the company and/or its Clients, and monitoring the workplace to ensure the safety of people and property;

(iv) Consent, where applicable (collection and use of image/voice).

 

Clients (Companies)

  • Manage contractual relationships.

 

The legal bases for processing Clients’ personal data are:

(i) Entering into and performance of a contract;

(ii) Compliance with legal obligations (such as tax obligations).

 

Suppliers

  • Manage contractual relationships.

 

The legal bases for processing Suppliers’ personal data are:

(iii) Entering into and performance of a contract;

(iv) Compliance with legal obligations (such as tax obligations).

 

Where the legitimate interests identified above (or others that will be identified and communicated to you) constitute the legal basis for processing, we apply balancing and proportionality criteria to ensure that your interests or fundamental rights and freedoms as an individual do not override our legitimate interests.

 

You may obtain further information about the balancing and proportionality criteria applied by contacting us at privacidade@guestworld.pt.

 

Data Sharing

We do not share personal information with third parties, except:

  • When required by law (as may be the case with the Tax Authority (AT), Social Security (SS), Authority for Working Conditions (ACT), Agency for Integration, Migration and Asylum (AIMA), courts and enforcement agents);

  • With service providers that support the development of our operations (for example, IT services, payroll processing, and external occupational health and safety service providers), under appropriate confidentiality and data processing agreements, acting on our behalf and in accordance with our instructions;

  • With third parties to ensure the performance of contractual obligations (such as transport service providers, accommodation providers, insurance companies, vehicle rental companies and financial institutions);

  • With advisers (lawyers, accountants, auditors) for the establishment, exercise or defence of our legal rights;

  • With clients (companies) for the purposes of performing contracts (applicable to employees);

  • With a potential purchaser (and its agents and advisers) in connection with any proposed purchase, merger or acquisition of any part of our business.

 

3. INTERNATIONAL DATA TRANSFERS

Your personal data will not be transferred to countries outside the European Economic Area (EEA), i.e. third countries, on a regular or systematic basis. However, if at any time we need to transfer your personal information outside the EEA, we will take measures to ensure that the information receives the same level of protection as if it were within the EEA, including by entering into data transfer agreements using the Standard Contractual Clauses approved by the European Commission or through other mechanisms compliant with applicable law.

If you would like further information about the mechanism by which your data is transferred outside the EEA, you

may contact us at privacidade@guestworld.pt.

 

4. DATA SECURITY

We have implemented appropriate technical and organisational security measures to protect personal data against unauthorised access, alteration, disclosure or destruction, taking into account the state of the art, implementation costs and the nature, scope, context and purposes of the processing, as well as the risks of varying likelihood and severity to the rights and freedoms of natural persons.

​

5. DATA SUBJECT RIGHTS

Data subjects have the right to:

  • Obtain access to the personal data held about them;

  • Request the correction of incorrect, inaccurate or incomplete personal data;

  • Request the erasure of personal data that is no longer necessary or where its processing is unlawful;

  • Object to the processing of their personal data for marketing purposes or on grounds relating to their particular situation;

  • Request restriction of the processing of their personal data in specific cases;

  • Receive their personal data in a machine-readable format and transmit it to another controller (“data portability”);

  • Withdraw consent at any time, without affecting the lawfulness of processing carried out on the basis of consent previously given;

  • Designate a person to exercise their rights after their death (failing such designation, their heirs), or determine that such rights may not be exercised in relation to special categories of personal data or where they concern private life, image or communications data.

 

Further information on what each of these rights entails and the applicable restrictions is available at https://www.cnpd.pt/bin/direitos/direitos.htm.

 

Requests to exercise the above rights may be submitted by email to privacidade@guestworld.pt. If you submit a request relating to your data, please specify the nature of your request and the type of processing concerned. We may also request additional information to verify your identity.

 

You may also lodge a complaint with the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados – CNPD) (www.cnpd.pt) if:

(i) We do not respond within the statutory deadline, provided that you have submitted your request through the channels made available by GuestWorld for this purpose;

(ii) We fail to take any action on your request or unjustifiably refuse to comply with it;

(iii) You consider that your rights have not been properly guaranteed, in particular the right to restriction of processing and the right to object to processing.

 

6. DATA RETENTION

Personal data is retained for the period established by law or regulation or, where no such period is established, for the period necessary to fulfil the purposes described in this Policy.

In the case of data provided by Candidates, the data will be retained for 2 (two) years after the end of the recruitment processes or, in the case of spontaneous applications, after its collection, without prejudice to the possibility of retaining it for a longer period to comply with legal obligations or, with your consent, for future placement opportunities.

 

Information relating to Client and Supplier contact persons will be retained for the duration of the contract and, after its termination, for the purpose of demonstrating compliance with contractual or other obligations, until the applicable limitation period for the corresponding rights has expired.

 

With regard to employees, data will be retained for 1 year after termination of employment, without prejudice to the possibility of retaining it for a longer period to demonstrate compliance with contractual or other obligations, until the applicable limitation period for the corresponding rights has expired.

 

7. CHANGES TO THIS POLICY

This Privacy Policy is reviewed regularly whenever appropriate. Changes will be published in the public documents section of the company’s internal portal, as well as on the corporate website www.guestworld.pt. Regular consultation is therefore recommended, without prejudice to appropriate measures being taken to inform data subjects according to the significance of the changes made.

 

8. CONTACT

For questions or requests relating to this Privacy Policy, or to how we process your personal data, please contact us:

  • GuestWorld, Lda.

  • Rua José Carlos Ary dos Santos, nº 1, Bairro Monte Verde – 1685-441 Caneças.

  • privacidade@guestworld.pt

 

Caneças, 21 July 2026

 

Management

bottom of page