Privacy Policy

This Privacy Policy explains how ON RISING, TI PORTUGAL, LDA., trading as Velv ("Velv", "we", "us", "our"), a company incorporated under Portuguese law, with registered office at Calçada da Estrela 93A, 1200-662, Lisbon, Portugal, and taxpayer number (NIPC) 514280174, collects, uses, and protects personal data of visitors to velv.pt, our clients, candidates, and other individuals who interact with us.

Velv is the data controller for the personal data described in this Policy, within the meaning of Regulation (EU) 2016/679 (the "GDPR") and Portuguese Law No. 58/2019.

This Policy applies to velv.pt and to personal data we collect through forms, email, chat, or other direct contact channels on this site. It does not apply to third-party websites we may link to.

Depending on how you interact with us, we may collect:

• Contact details: name, email address, phone number, company name, and job title, when you fill in a form, send us an email, or use our chat.
• Content of your message: any information you choose to share with us through a form, email, or chat.
• Technical data: IP address, browser type, device information, and pages visited, collected automatically through cookies and similar technologies (see Section 7).
• Recruitment data: When you click to apply for an open position, you are redirected to an application form hosted on a third-party applicant tracking platform. That form displays its own data protection notice, naming Velv as the controller and explaining that your data is processed for pre-contractual recruitment purposes, with rights requests directed to legal@velv.pt. Your data is stored in a database within Velv's own workspace on that platform; the platform provider does not have access to its content, and when Velv deletes a candidate's data, the deletion is permanent.

We do not knowingly collect special categories of personal data (e.g., health, religious beliefs, political opinions) through this site. Please do not submit such data to us through our forms or email.

• Responding to your enquiries and requests made via our forms, email, or chat, based on the performance of pre-contractual steps taken at your request, or our legitimate interest in providing customer service.
• Providing our consulting, engineering, and nearshoring services to clients, based on the performance of a contract.
• Measuring aggregate website usage through server-side log analysis, to understand and improve site performance, based on our legitimate interest in understanding and improving our website.
• Analysing how visitors interact with our site (e.g., clicks, scrolling, navigation), using Google Analytics and Microsoft Clarity, based on your consent.
• Measuring and delivering online advertising, using Google's advertising tools, based on your consent.
• Complying with legal and regulatory obligations (e.g., accounting, tax, corporate law), based on compliance with a legal obligation.
• Ensuring the security of our site and preventing fraud or misuse, based on our legitimate interest in protecting our systems and users.
• Establishing, exercising, or defending legal claims, based on our legitimate interest or compliance with a legal obligation.

We do not sell your personal data to third parties, and we do not use your data for any purpose other than those listed above without informing you and, where required, obtaining your consent.

We may share personal data with the following categories of recipients:

• Analytics service providers, who help us understand how visitors use our site, whether through server-side aggregate analysis or, subject to your consent, through cookie-based analytics tools such as Google Analytics and Microsoft Clarity.
• Advertising service providers, who help us measure and deliver online advertising, subject to your consent — namely, Google's advertising tools.
• Search performance monitoring tools, which help us understand how our site performs in search results; these do not process individual visitor data or use cookies.
• Our applicant tracking platform, used to manage job applications submitted through our Careers page.
• Professional advisors, such as lawyers and accountants, where necessary to obtain advice or meet legal obligations.
• Public authorities, where required by law, court order, or valid legal request.
• A successor entity, in the event of a merger, acquisition, or sale of all or part of our business — in which case we will notify you before your data is transferred and becomes subject to a different privacy policy.

We do not disclose your personal data to third parties for their own independent marketing purposes.

Some of the service providers referred to in Section 4 — including Google, Google Analytics, and Microsoft Clarity — are based outside the European Economic Area (EEA), or belong to corporate groups headquartered outside the EEA, which may involve a transfer of your personal data to a third country.

Where this occurs, the transfer is carried out under one of the following safeguards, as applicable: an adequacy decision issued by the European Commission in respect of the destination country, the EU-U.S. Data Privacy Framework, or Standard Contractual Clauses approved by the European Commission.

You can request more information about the specific safeguard used for a given service provider by contacting us as set out in Section 11.

We keep personal data only for as long as necessary for the purposes described in this Policy:

• Contact form / email / chat enquiries: up to 2 years from your last contact with us, unless you ask us to delete your data sooner, in which case we will do so unless we have a legal reason to keep it for longer.
• Client/contractual data: for the duration of the contractual relationship and thereafter for the period required by applicable accounting and tax law (generally 10 years under Portuguese commercial law).
• Recruitment data: up to 2 years from your application, unless you ask us to delete your data sooner, in which case we will do so unless we have a legal reason to keep it for longer.

This site uses cookies and similar technologies, including analytics tools that analyse visitor behaviour (Google Analytics, Microsoft Clarity) and Google's advertising tools. Some are strictly necessary for the site to function; others (analytics and advertising cookies) are only placed with your consent, which you can give or withdraw through the cookie banner shown when you first visit the site, with "Accept" and "Reject" options presented on an equal footing. We also use a search performance monitoring tool that does not place cookies on your device. For full details of the cookies we use and their purpose, please see our Cookie Policy.

Under the GDPR, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data ("right to be forgotten"), in certain circumstances
• Restrict the processing of your data, in certain circumstances
• Object to processing based on our legitimate interest, including for direct marketing
• Data portability, where processing is based on consent or contract and carried out by automated means
• Withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal
• Lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt — or with the supervisory authority of your country of residence.

To exercise any of these rights, please contact us by email at legal@velv.pt. We will respond within the timeframes required by applicable law.

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, or misuse, both online and offline. Access to personal data is limited to personnel who need it to perform their role.

Velv maintains a dedicated internal reporting channel for reporting breaches, available here. Reports are received by legal@velv.pt; where a report concerns a member of Velv's legal team, it is instead handled by hr@velv.pt, to preserve the independence and confidentiality of the process. The processing of personal data submitted through that channel is governed by a separate, dedicated privacy notice, reflecting the specific confidentiality and data protection requirements applicable to whistleblowing reports under Law No. 93/2021. This general Privacy Policy does not apply to that channel.

If you have any questions about this Privacy Policy, about how we collect and use your personal data, or if you wish to file a complaint about a possible breach of data protection law, please contact us by email at legal@velv.pt.

We may update this Privacy Policy from time to time to reflect feedback, changes to our services, or new legal requirements. If such changes are significant, we will notify you and, where required, request your consent again.

Your trust is important to us — please do not hesitate to contact us with any questions, using the details above.