Log inBook a demo

Legal

Privacy Policy

Effective Date: 20 September 2026

Last Updated: 20 September 2026

Controller / Platform operator:

Talent Journey, LDA

NIPC: 518824799

Registered office: Rua da Baldrufa, nº 239, 2º Fração T, 4990-035 Ponte de Lima, Portugal

Email: privacy@talentjourney.tech

Website: talentjourney.tech

Platform: app.talentjourney.tech

1. Introduction

This Privacy Policy explains how Talent Journey, LDA ("Talent Journey", "we", "us", "our") collects, uses, shares, and protects personal data when you use our website, our platform at app.talentjourney.tech (the "Platform"), and related relocation and settle-in services (together, the "Services").

We handle personal data in line with:

  • Regulation (EU) 2016/679 (the "GDPR")
  • Portuguese Law 58/2019
  • Other applicable Portuguese and EU data protection and e-privacy rules

This Policy applies to:

  • Talents (individuals using relocation or settle-in services, including family members where relevant)
  • Client company representatives
  • Providers (companies that use the Platform as infrastructure to serve their own clients) and their staff
  • Website visitors

This Policy covers the Talent Journey website and Platform only. Other Talent Journey products, if any, have their own notices.

By creating an account or using the Services, you acknowledge that you have read this Policy. Where we rely on consent, we will ask for it separately.

In plain language:

  • We do not sell your personal data.
  • We use it to run your account and your case (and the limited Platform purposes listed in Section 5). We do not use it to market your profile to other relocation businesses.
  • The Platform, including Joya, is hosted in the European Union.
  • Documents and messages on the Platform are encrypted in transit and at rest.
  • If a Provider invited you, that Provider is in charge of the case data they collect. We host it for them; we do not take it over.

2. Who Controls Your Data

2.1 Our identity

Talent Journey, LDA is established in Portugal. For questions or to exercise your rights, email privacy@talentjourney.tech. We have not appointed a Data Protection Officer. That privacy address is the contact point for all data protection matters.

2.2 When we are the controller and when we are the processor

Our role depends on who you contracted with.

Direct relocation (you or your employer contracted Talent Journey for relocation or settle-in services)

Talent Journey is the controller of the personal data we process to deliver those services, run your Platform account, communicate with you, invoice, and meet our legal duties.

Provider-run book (a Provider invited you onto the Platform)

  • The Provider is in charge of the personal data they collect. They are the controller. Talent Journey is not the controller of that case content.
  • Talent Journey is the processor: we host the data and process it on the Provider's documented instructions, under the Data Processing Addendum that forms part of the Provider Terms.
  • Talent Journey remains the controller only of Platform account data needed to operate, secure, and bill the Platform itself (for example login credentials, security logs, and invoices we issue to the Provider).

Client companies and Providers as organisations

Each company is an independent controller of its own staff account details and of personal data it holds in the employment or commercial relationship with its talents or customers. Talent Journey is an independent controller of Platform account and security data for those staff users.

Website visitors

Talent Journey is the controller of data collected on talentjourney.tech (for example contact forms and cookies, as described below).

If you are unsure who you contracted with, check your invitation, order confirmation, or the organisation named in your Platform account. You can also ask us at the privacy address above.

2.3 Supervisory authority

You may lodge a complaint with the Portuguese Data Protection Authority:

Comissão Nacional de Proteção de Dados (CNPD)

Av. D. Carlos I, 134, 1º, 1200-651 Lisboa, Portugal

Phone: +351 213 928 400

Email: geral@cnpd.pt

Website: www.cnpd.pt

You may also complain to the supervisory authority of your EU Member State of habitual residence, place of work, or place of the alleged infringement.

3. Personal Data We Collect

We collect only what is needed for the relevant role and service. The categories below describe data we may process. We do not collect every item for every person.

3.1 Talents (and family members included in a case)

Identity and contact: name (including previous names where needed), date and place of birth, nationality and citizenship(s), gender, passport or national ID details, email, phone, current address, emergency contact.

Family and household: marital status, spouse or partner details, children's details, dependents included in the relocation.

Employment: employer name and address, job title, start date, contract details where relevant to immigration or housing, salary or income information where required for a visa, permit, or rental application.

Immigration and travel: previous visas or residence permits, immigration history, previous applications and outcomes, travel history, previous addresses, and immigration issues you tell us about.

Education and qualifications: degrees, institutions, certificates, professional licences, language proficiency, where needed for a visa, permit, or credential process.

Financial (limited): bank details where we guide account opening, income verification or statements for rental applications, Portuguese tax number (NIF), social security number (NISS).

Health (only when strictly necessary): health insurance information, medical certificates or vaccination records required for a visa or permit, disability or accessibility information you choose to provide for housing or appointments. This is special-category data. See Section 6.5.

Criminal-record data (only when required by authorities): police clearance certificates required for immigration. See Section 6.5.

Documents: copies of the documents above (passport, civil status, diplomas, employment letters, proof of address, and other papers needed for the case).

Housing preferences: neighbourhoods, budget range, bedrooms and amenities, move-in timing, pets, accessibility needs.

Platform use: account credentials (password stored in hashed form), login times, IP address, device and browser type, pages and features used, uploads and downloads, messages sent on the Platform, service requests and status, feedback.

3.2 Client company representatives

Name, job title, business email and phone, company name and registration details, fiscal ID, role and permissions on the Platform, login and usage data, billing and payment information for Direct Clients.

3.3 Providers and their staff

Organisation name, registration and fiscal details, registered address, authorised representatives, staff names, business contact details, role and permissions, login and usage data, billing and payment information for Platform access, and communications with us about the account.

3.4 Website visitors

IP address, device and browser data, pages viewed, referrer, cookie identifiers (see Section 15), and information you submit in a contact or demo form (name, email, organisation, message).

3.5 Data we do not intentionally collect

We do not intentionally collect political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to identify you, or data about sexual life or orientation, except photographs required for visas or permits. If such data is sent to us by mistake, we delete it unless we must keep it to comply with law.

4. How We Collect Data

From you: registration, profiles, questionnaires, document uploads, messages, Power of Attorney where you grant it, and support requests.

From your employer or sponsoring organisation (Direct Clients): employment and contact details needed to open and run a sponsored case, after they confirm they have a lawful basis to share it.

From a Provider (if you were invited by one): the identity and case information they upload or ask you to upload so they can serve you. In that case the Provider decides what to collect; we host it.

From you after you obtain it elsewhere: visa decisions, police certificates, diplomas, medical certificates, bank statements, translations, apostilles. We generally receive these from you. We do not collect them from those third parties except in limited cases where you authorise us to act (for example a NIF application under Power of Attorney for a Direct Client).

Automatically: Platform and website logs, device data, and cookies as described in Section 15.

Generated by us or the Provider: case notes, status and milestone records, checklists, and communication logs on the Platform.

5. Purposes of Processing

Depending on the relationship, data is used to:

  • Create and secure accounts and authenticate users
  • Deliver Direct relocation and settle-in services (document preparation, guidance, appointment support, housing search coordination, NIF/NISS and similar administrative support)
  • Power Joya, our on-Platform AI assistant (a flamingo), so it can answer questions and suggest next steps using the case information you or your organisation already put on the Platform. Joya does not decide visas, permits, or housing. A human remains responsible for the case.
  • Host Provider casework on the Platform (as processor)
  • Communicate about cases, deadlines, and support
  • Process payments we issue or receive, and keep accounting records
  • Comply with tax, accounting, immigration-related, and other legal obligations
  • Detect, prevent, and investigate security incidents, fraud, and abuse
  • Improve the Platform using aggregated or pseudonymised usage information
  • Send service messages that are necessary to perform the contract
  • Send marketing only if you opt in, which you can withdraw at any time
  • Establish, exercise, or defend legal claims

We do not sell personal data.

6. Legal Bases

6.1 Contract (Article 6(1)(b) GDPR)

Processing that is necessary to provide an account, Direct Services, or Platform access you (or your organisation) requested, including case communication and document handling for that contract.

If we are the Provider's processor, the Provider relies on its own contract with its client or talent; our processing is then based on the Provider's instructions and Article 28 GDPR.

6.2 Legal obligation (Article 6(1)(c) GDPR)

Including Portuguese tax and accounting retention, responding to lawful authority requests, and carrying out filings you have authorised us to make (for Direct Services, for example NIF with Power of Attorney).

6.3 Legitimate interests (Article 6(1)(f) GDPR)

Including running and securing the Platform, supporting users, improving features with aggregated or pseudonymised data, administering our relationship with companies and Providers, and keeping records needed for claims.

We balance these interests against your rights. You may object (Section 13).

6.4 Consent (Article 6(1)(a) GDPR)

Including optional marketing, testimonials, non-essential cookies, and, where required, special-category data. You may withdraw consent at any time without affecting prior lawful processing.

6.5 Special-category and criminal-record data (Articles 9 and 10 GDPR)

We process health data and police-clearance data only when necessary for immigration, social-security, or related legal procedures, and only with explicit consent and/or where EU or Portuguese law permits processing for those obligations or for legal claims (GDPR Article 9(2)(a), (b) and/or (f), and Article 10 as applicable).

If you refuse consent where it is required, we may be unable to perform the affected part of the service.

7. Who We Share Data With

We share data only as needed to provide the Services or comply with law.

7.1 Direct Services — authorities and filings

With your authorisation we may submit NIF applications to the Portuguese Tax Authority and process NISS registration with Social Security.

You (or we, only where you have given Power of Attorney) interact with AIMA, embassies and consulates, visa application centres, city halls, health centres, and similar bodies. Documents we help you prepare contain personal data. Those submissions are required to obtain the relevant status or registration.

7.2 Your employer (company-sponsored Direct Services)

If your employer pays for a case, we share with that employer, through the Platform, case status, timelines, required actions, document-checklist status, and invoicing for the services they pay for. We do not give them copies of your underlying identity documents unless you authorise it or the employer must receive them to perform its legal role.

If you pay separately for additional services that your employer does not pay for, that work is handled as a separate case. Your employer has no access to that case.

7.3 Providers (if you were invited by one)

The Provider already has (or collects) your case data as controller. We display it to the Provider's authorised staff on the Platform. We do not take over their client relationship.

7.4 Categories of suppliers

We use other organisations to operate the Platform and, for Direct Services, to help deliver work. They receive only what they need. Categories include:

  • EU-hosted cloud infrastructure, hosting, backup, and security
  • Email, messaging, and customer-support tooling
  • Payment and accounting providers
  • Professional advisers (lawyers, accountants) bound by confidentiality
  • For Direct Services only, and only when needed: housing intermediaries, translators, or other specialists involved in your case

These parties act as processors under contract, or as independent controllers where they decide their own purposes (for example a bank where you open an account, or a government authority).

A current list of processors is available on request at privacy@talentjourney.tech.

7.5 Legal and corporate events

We may disclose data if required by law, court order, or regulator; to protect rights, safety, or the Platform; or in a merger, acquisition, or sale of assets, subject to equivalent protection and notice where legally required.

7.6 We do not share data with

Data brokers, unrelated marketers (unless you opt in), or other relocation businesses for their own prospecting.

8. International Transfers

Personal data on the Platform is stored and processed in the European Union. We do not transfer it outside the EU/EEA to run the Platform or Joya.

If you later send documents to an embassy, consulate, or authority outside the EU, that submission is yours (or is made with your Power of Attorney). It is not a transfer we make from the Platform. If a court or law ever required us to disclose data outside the EU, we would do only what that order requires.

9. How Long We Keep Data

We keep data only as long as needed for the purposes above, including:

  • Active accounts and cases: for the duration of the service or Platform relationship
  • Completed Direct cases and related Platform records: generally up to two (2) years after the case or contract ends (limitation of claims, support, and quality), then deleted or anonymised unless a longer law applies
  • Provider-hosted case content: for as long as the Provider instructs, and in any event in line with the Data Processing Addendum (return or deletion when the Provider relationship ends, subject to legal holds)
  • Financial and tax records: ten (10) years from the end of the relevant fiscal year, as required by Portuguese tax and accounting rules
  • Security logs: for a limited period needed to detect and investigate incidents
  • Marketing: until you unsubscribe or we delete inactive contacts
  • Cookies: for the lifetimes described in Section 15 and in the cookie banner

We may keep data longer if you ask us to, if law requires it, or if we need it for an ongoing claim or investigation. When a period ends, we delete or irreversibly anonymise the data, including by instructing processors.

10. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit and at rest for Platform documents and messages, access control on a need-to-know basis, staff confidentiality duties, logging, backups in the EU, and contracts with processors.

No method of transmission or storage is completely secure. You must keep your password confidential, log out on shared devices, and upload sensitive documents through the Platform rather than unsecured email.

We will notify the CNPD and, where required, affected individuals, of a personal data breach in accordance with Articles 33 and 34 GDPR.

11. Automated Decision-Making

We do not make decisions based solely on automated processing that produce legal effects or similarly significantly affect you. Joya can draft suggestions and answers; it does not approve or refuse a visa, permit, or tenancy. Case handling for Direct Services involves human review. Provider case handling is the Provider's responsibility.

12. Children

The Platform is not directed at children. We process data of minors only as part of family relocation, with the consent of a parent or legal guardian, and limited to what the procedure requires.

Parents or guardians may exercise GDPR rights on behalf of the child. We do not market to children and we do not profile children's behaviour.

If you believe we hold a child's data without proper authority, contact privacy@talentjourney.tech.

13. Your Rights

Subject to GDPR conditions and exceptions, you have the right to:

  • Be informed (this Policy)
  • Access your personal data
  • Rectify inaccurate or incomplete data
  • Erase data in certain cases (this does not override tax retention or data we must keep for claims or an ongoing contract)
  • Restrict processing in certain cases
  • Data portability for data you provided, where processing is based on consent or contract and is carried out by automated means
  • Object to processing based on legitimate interests, and an absolute right to object to direct marketing
  • Withdraw consent where we rely on consent, without affecting prior processing
  • Lodge a complaint with the CNPD or another EU supervisory authority

How to exercise: email privacy@talentjourney.tech with your name, the email on the account, which right you wish to exercise, and enough detail for us to locate your data. We may need to verify your identity.

We respond within one month, extendable by two further months for complex or numerous requests. We will tell you if we need an extension. The first request is free. We may charge a reasonable fee or refuse requests that are manifestly unfounded, excessive, or repetitive.

If Talent Journey is only the processor (Provider-run cases), we will forward your request to the Provider as controller, unless you were clearly addressing Platform-account data for which we are controller. You may also contact the Provider directly.

14. Employer-Sponsored Deletion Requests

If your employer contracted us for your Direct case and you ask us to erase data while records are still needed for that contract, tax, or claims, we will coordinate with your employer. We will tell you what we can delete and what we must retain. This does not limit your right to complain to the CNPD.

15. Cookies and Similar Technologies

We use cookies and similar technologies on the website and Platform.

15.1 What we use

Strictly necessary: required to load the site, keep you logged in, remember cookie choices, and protect the service. These do not require consent.

Preferences: remember language or similar settings. Used only if you allow them.

Analytics: help us understand how the site and Platform are used, in aggregated form. Used only if you consent.

Marketing: used only if you consent. We do not use marketing cookies unless the banner or settings offer them and you accept.

15.2 Your choice

On your first visit, a banner lets you accept, refuse, or manage non-essential cookies. You can change your choice later through the cookie settings link on the website or in your browser.

Browsers can also block cookies; blocking strictly necessary cookies may stop login or payments from working.

15.3 More detail

A short cookie list (name, purpose, duration, provider) is available in the cookie settings panel and on request at privacy@talentjourney.tech. We update that list when tools change, without naming unused vendors in this Policy.

16. Updates

We may update this Policy. The "Last Updated" date will change.

For material changes that affect your rights or how we use data, we will post the new Policy on the website and Platform and, for active users, give at least thirty (30) days' notice by email or in-account notice where practicable.

Non-material clarifications take effect when posted. Please review this Policy from time to time.

17. Contact and Language

Privacy: privacy@talentjourney.tech

Support: support@talentjourney.tech

Post: Talent Journey, LDA, Rua da Baldrufa, nº 239, 2º Fração T, 4990-035 Ponte de Lima, Portugal

This Policy is issued in English. If we publish a translation, the English version prevails if there is a conflict, except where mandatory local law requires otherwise.

Related documents: Terms for Companies, Terms for Talents, Terms for Providers, and, for Providers, the Data Processing Addendum.

This Privacy Policy is effective as of 20 September 2026.