General Data Protection Regulation (GDPR) Internal Personal Data Processing Policy

1. Introduction 

This Personal Data Protection Policy aims to ensure compliance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016 (General Data Protection Regulation – GDPR), and Law no. 58/2019, of August 8, establishing the rules applicable to the collection, processing, storage and sharing of personal data by Fullback (Wisdom Select – Consultoria de Gestão, Lda). This policy applies to all processing of personal data carried out within the scope of Fullback’s activity, whether through physical or digital means, by itself or by entities subcontracted by it.

2. Identification of the Person Responsible for Treatment

Responsible: WISDOM SELECT – CONSULTORIA DE GESTÃO, LDA Address: Rua Doutor Manuel Carvalho, nº 6, R/C, 2500-328 Caldas da Rainha

Contact email: geral@fullback.pt 

3. Categories of Personal Data Processed

Fullback may process the following categories of personal data:

• Identification data: name, surname, VAT number, entity represented, position;
• Contact details: address, telephone, cell phone, e-mail address;
• Financial data: IBAN, payment history and transfers;
• Commercial data: products and services contracted or subscribed to;
• Location data (where applicable);
• Content data: communications, forms, messages;
• Responses to satisfaction surveys and questionnaires;
• Cookies and tracking technologies (see Cookies Policy).

4. Purposes of Processing and Legal Basis

Fullback processes personal data on the basis of the legal grounds set out in Article 6 of the GDPR, ensuring that each processing operation is supported by an appropriate legal basis.

The data is processed, in particular, for the management of contractual relations, based on the need to execute a contract to which the data subject is a party, or for pre-contractual steps at the request of the data subject.

Processing may also take place in compliance with legal obligations to which Fullback is subject, such as tax, accounting or crime prevention obligations.

In situations involving marketing actions, sending promotional communications or newsletters, the processing of personal data will be carried out on the basis of the explicit consent of the data subject, which may be withdrawn at any time without compromising the lawfulness of the previous processing.

For the purposes of customer loyalty, continuous improvement of services, information security, or responding to complaints and requests, Fullback may base the processing on its legitimate interest, provided that it does not override the fundamental rights and freedoms of the data subjects.

In recruitment and selection processes, personal data may be processed on the basis of consent or the need for pre-contractual due diligence, as appropriate.

In addition, the data may be used, with the consent of the owner, to carry out satisfaction surveys, market studies, participation in events, or other actions of an informative or promotional nature.

5. Data Collection and Retention

Fullback collects personal data through direct contact with data subjects (telephone, email, website, meetings), ensuring that consent is obtained when required.

Data will only be kept for the period necessary to fulfill the purpose for which it was collected or to comply with legal obligations. When there is no specific legal deadline, the data will be deleted as soon as possible.

6. Data can be transmitted to:

• Judicial, tax, police and regulatory authorities, under the terms of the law;
• Entities subcontracted to provide services, under a contractual obligation of confidentiality and security.

Fullback remains responsible for personal data, even when it is processed by third parties on its behalf.

7. International Data Transfers

Fullback may transfer data outside the European Economic Area when this is necessary for the provision of services. In such cases, it will ensure that appropriate legal mechanisms are in place, such as:

• European Commission adequacy decisions;
• Approved standard contractual clauses;
• Binding corporate rules, where applicable.

8. Security measures

Fullback adopts appropriate technical and organizational measures to ensure data security and confidentiality, including:

• Restricted access control;
• Encryption and backups;
• Incident management policy;
• Security audits and employee training.

9. Data subjects’ rights

The holders of personal data have the following rights:

• Right of access, rectification and updating;
• Right to restriction of processing;
• Right to erasure (“right to be forgotten”);
• Right to object to processing, including for marketing purposes;
• Right to data portability;
• Right to withdraw consent, where this is the legal basis.

How to exercise your rights:

• Email: geral@fullback.pt
• Address: Rua Doutor Manuel Carvalho, nº 6, R/C, 2500-328 Caldas da Rainha

10. Automated Decisions and Profiling

Fullback does not carry out automated decisions or profiling actions with legal or similar effects for data subjects. If it does, it will implement all the legal guarantees required.

11. Data Processing of Minors

Fullback does not knowingly collect personal data from minors under the age of 13. If minors’ data is processed, this will be done with the prior consent of their legal representatives, under the terms of the applicable legislation.

12. Use of Cookies

Fullback uses strictly necessary cookies and, with consent, functionality, performance and marketing cookies. For more information, please consult our Cookie Policy available at www.fullback.pt. 

13. Contacting the Data Protection Officer

Data subjects may contact the Data Protection Officer with any questions relating to the processing of their personal data at:

Email: geral@fullback.pt 

14. Complaints

Without prejudice to complaints addressed directly to Fullback, the data subject may lodge a complaint with the supervisory authority:

National Data Protection Commission (CNPD)

Website: www.cnpd.pt 

15. Updates to the Data Protection Policy

This policy was updated in April 2025 and may be revised from time to time. The updated version will always be available at www.fullback.pt.