Recruitment Privacy Notice

This Recruitment Privacy Notice explains how DECOR PITA – MATERIAIS DE CONSTRUÇÃO, S.A., hereinafter referred to as “Decorpita”, collects, uses, retains, discloses and protects personal data processed in connection with its recruitment and selection activities.

This Notice applies to:

1. a) Applications submitted for a specific vacancy;
2. b) Speculative applications;
3. c) Curricula vitae and other documents submitted to recrutamento@decorpita.pt;
4. d) Applications submitted to another email address expressly identified by Decorpita in a recruitment notice or communication;
5. e) Interviews, communications, assessments and other steps carried out as part of a recruitment process;
6. f) The preparation of a potential employment offer.

This Notice should be read together with Decorpita’s Privacy and Data Protection Policy.

Open positions may be advertised:

a) On Decorpita’s Website;

b) Through Decorpita’s social media pages;

c) On professional networking or employment platforms;

d) In institutional publications or communications;

e) Through other appropriate channels.

 

Vacancy notices published on the Website are provided for information purposes.

Decorpita’s Website does not provide:

a) Online application forms;

b) Candidate registration or profiles;

c) Restricted recruitment areas;

d) Curriculum vitae or document upload functionality;

e) Candidate databases accessible through the Website.

 

Viewing a vacancy on the Website does not, in itself, result in Decorpita receiving personal data relating to a job application.

Technical data processed when browsing the Website are governed by Decorpita’s Privacy and Data Protection Policy and Cookie Policy.

Where a vacancy is published through a social media platform or another external service, processing carried out by that platform is subject to its own terms and privacy policy.

Applications must be submitted by email to:

recrutamento@decorpita.pt

or to another email address expressly identified by Decorpita in the relevant vacancy notice.

Unless otherwise stated, an application should include:

a) A curriculum vitae;

b) Identification of the relevant vacancy;

c) Contact details;

d) Any other professional information the candidate considers relevant.

 

Candidates should carefully verify the destination address before submitting an application.

Decorpita will not request applications through public comments, social media posts or messages submitted to employees’ personal profiles.

The controller responsible for the processing of personal data is:

DECOR PITA – MATERIAIS DE CONSTRUÇÃO, S.A.

Registered office:
Estrada do Casal da Coxa, no. 2
2600-056 Rondulha
Vila Franca de Xira
Portugal

Corporate and taxpayer identification number: 503 150 541
Telephone: +351 263 287 320
General email: geral@decorpita.pt
Recruitment: recrutamento@decorpita.pt
Data protection: privacidade@decorpita.pt
Website: https://decorpita.pt

For any matter concerning the processing of personal data or the exercise of data subject rights, candidates may contact Decorpita at:

Email: privacidade@decorpita.pt

Postal address:

DECOR PITA – MATERIAIS DE CONSTRUÇÃO, S.A.
For the attention of: Data Protection
Estrada do Casal da Coxa, no. 2
2600-056 Rondulha
Vila Franca de Xira
Portugal

As at the publication date of this Notice, Decorpita has not formally appointed a Data Protection Officer.

The email address privacidade@decorpita.pt is a functional contact for privacy and data protection matters and does not, in itself, constitute the address of a formally appointed Data Protection Officer.

Personal data processed for recruitment purposes will primarily be obtained directly from the candidate through:

a) The curriculum vitae submitted by email;

b) A covering letter or introductory message;

c) Communications exchanged with Decorpita;

d) Interviews;

e) Role-related tests or assessments, where applicable;

f) Documents submitted during the process;

g) Professional references provided by the candidate.

 

Decorpita may contact a professional referee identified by the candidate after informing the candidate or where the circumstances of the application clearly indicate that purpose.

When data is collected directly from the candidate, the information required by Article 13 of the GDPR must be provided at the time of collection, including the identity of the controller, the purposes, the legal bases, the recipients, the retention periods, and the applicable rights.

Depending on the vacancy and the information provided, Decorpita may process:

 

7.1. 7.1. Identification data

a) Name;

b) Date of birth, where voluntarily provided and relevant;

c) Nationality, where required to verify eligibility to work;

d) A photograph voluntarily included in the curriculum vitae.

 

7.2. 7.2. Contact details

a) Email address;

b) Telephone number;

c) Postal address or area of residence;

d) Other contact information provided by the candidate.

 

7.3. 7.3. Academic and professional information

a) Academic qualifications;

b) Professional training;

c) Certifications;

d) Employment history;

e) Previous employers;

f) Roles and responsibilities;

g) Technical and behavioural skills;

h) Language skills;

i) Professional qualifications or licences;

j) Driving licence information, where relevant to the role.

 

7.4. 7.4. Application information

a) The position applied for;

b) Covering letter or introductory message;

c) Availability;

d) Preferred place of work;

e) Professional expectations;

f) Remuneration information, where voluntarily provided or requested on a justified basis;

g) Interview responses;

h) Notes and assessments prepared during the selection process;

i) The outcome of different selection stages.

 

7.5. 7.5. Professional references

a) Name;

b) Role;

c) Organisation;

d) Professional contact details;

e) Information concerning the candidate’s professional experience.

 

7.6. 7.6. Information required for hiring

Where a candidate is selected, Decorpita may request the information required to prepare an offer, enter into an employment contract and comply with applicable legal obligations.

Documents and data required for hiring should not be requested at an earlier stage where they are not necessary to assess the application.

Candidates should limit their applications to professional information that is appropriate and necessary to assess their suitability for the position.

Unless legally required and expressly requested, candidates should not submit:

a) Copies of identity documents;

b) Tax identification numbers;

c) Social Security numbers;

d) Banking information;

e) Passwords or access codes;

f) Detailed information concerning private or family life;

g) Information concerning sexual orientation;

h) Political opinions;

i) Religious or philosophical beliefs;

j) Trade union membership;

k) Health information;

l) Pregnancy information;

m) Biometric data;

n) Information concerning criminal convictions or offences;

o) Unnecessary third-party personal data.

 

The Labor Code limits the information an employer may request from candidates regarding their private life, health, and pregnancy status. When specific job requirements justify the collection of health information, such information must be handled in accordance with applicable legal provisions—typically through a healthcare professional who communicates only the candidate’s fitness or unfitness for the role.

As a general rule, Decorpita does not request special categories of personal data as part of an application.

Where a candidate voluntarily submits unnecessary special-category information, Decorpita may delete it or disregard it when assessing the application.

Health information will only be processed where:

a) It is strictly required due to the specific requirements of the role;

b) An appropriate legal basis applies;

c) Applicable confidentiality and security requirements are observed;

d) Processing is performed by legally competent professionals or entities.

 

Information concerning criminal convictions or a criminal record certificate will only be requested where this is required or permitted by the legislation applicable to the relevant position.

Candidates’ personal data may be processed to:

a) Receive and register applications;

b) Identify the relevant vacancy or professional area;

c) Review curricula vitae and professional experience;

d) Assess suitability for the position;

e) Compare applications;

f) Contact candidates;

g) Request clarification or additional information;

h) Arrange and conduct interviews;

i) Carry out role-related assessments;

j) Verify qualifications, professional credentials or references;

k) Organise and document the selection process;

l) Communicate the progress or outcome of the process;

m) Prepare an employment offer;

n) Comply with legal obligations;

o) Prevent or respond to complaints;

p) Establish, exercise or defend legal claims;

q) Consider speculative applications for compatible opportunities during the applicable retention period;

r) Consider a candidate for a future vacancy where the required authorisation has been obtained.

Processing may be based on:

 

11.1. 11.1. Pre-contractual steps

Processing necessary to assess an application and take steps requested by the candidate before potentially entering into an employment contract.

 

11.2. 11.2. Legitimate interests

Decorpita’s legitimate interests in:

a) Organising recruitment processes;

b) Selecting suitable candidates;

c) Managing its human resources requirements;

d) Maintaining evidence of how a process was conducted;

e) Preventing or defending complaints and legal claims.

 

11.3. 11.3. Compliance with legal obligations

Processing required to comply with employment, tax, social security, equality, safety or other statutory obligations.

 

11.4. 11.4. Consent

Consent may be used for separate and optional purposes, including retaining an application submitted for a specific position in order to consider the candidate for unrelated future vacancies.

Consent is only one of the lawful bases available under the GDPR and will not be relied upon where processing is necessary for pre-contractual steps, compliance with a legal obligation or another appropriate lawful basis.

Submitting an application is voluntary.

Certain information is, however, required in order for Decorpita to:

a) Identify the candidate;

b) Assess their experience and qualifications;

c) Contact them;

d) Associate the application with a vacancy;

e) Carry out the selection process.

 

Failure to provide such information may prevent Decorpita from assessing the application or continuing the recruitment process.

Information that is not required for the assessment is optional and its absence will not adversely affect the application.

Applications received through recrutamento@decorpita.pt, or another identified address, will be handled in accordance with Decorpita’s internal recruitment procedure.

As a general rule:

a) Human Resources receives and organises applications;

b) Curricula vitae are referred to the manager or department responsible for the vacancy;

c) Technical and professional assessment is carried out by the relevant department;

d) Human Resources manages communications and interview arrangements;

e) Interviews are conducted by the relevant managers or department heads and may include Human Resources;

f) Proposed terms of employment are reviewed and approved by the relevant internal decision-makers;

g) Decorpita’s Board or Administration provides any required approvals;

h) Human Resources formalises the employment relationship and onboarding process.

 

Personal data will only be made available internally to persons who require access in order to carry out their role in the recruitment process.

To the extent strictly necessary, personal data may be accessed or processed by:

a) Human Resources;

b) Managers and department heads responsible for the vacancy;

c) Decorpita’s Administration;

d) Personnel involved in the technical or professional assessment;

e) Email service providers;

f) Hosting, information technology maintenance and cybersecurity providers;

g) Legal advisers and other professional consultants;

h) Public bodies, courts or authorities where required by law.

 

Where an entity processes personal data on Decorpita’s behalf, it will be required to act under contract, in accordance with documented instructions and subject to confidentiality and security obligations.

Decorpita does not sell or otherwise trade candidates’ personal data.

15.1. 15.1. Applications for specific vacancies

Personal data will be retained for the duration of the recruitment process and generally for a maximum of 12 months following closure of the process, in order to:

a) Manage subsequent enquiries;

b) Demonstrate how the process was conducted;

c) Comply with legal obligations;

d) Prevent or defend complaints and legal claims.

 

The application will not be used for unrelated future vacancies without an appropriate legal basis.

 

15.2. 15.2. Speculative applications

Speculative applications may be retained for a maximum period of 12 months from receipt in order to consider the candidate for compatible professional opportunities.

 

15.3. 15.3. Successful candidates

Where the candidate is hired, the personal data required to enter into and perform the employment contract will become part of the employee’s personnel file and will be subject to the statutory and internal retention periods applicable to the employment relationship.

Data that are not required for employment should be deleted or excluded from the personnel file.

 

15.4. 15.4. Exceptional retention

Personal data may be retained for a longer period where required to:

a) Comply with a legal obligation;

b) Respond to a competent authority;

c) Establish, exercise or defend legal rights;

d) Manage a complaint or legal proceedings;

e) Investigate a security incident.

 

Portuguese legislation stipulates that, in the absence of a specific statutory timeframe, data must be retained only for the period necessary to fulfill the purpose and must be destroyed or anonymized once that purpose ceases, without prejudice to any retention required to substantiate obligations or defend rights.

Following expiry of the applicable retention period, Decorpita will securely delete:

a) Curricula vitae;

b) Covering letters;

c) Attachments;

d) Application-related messages;

e) Notes and assessments that are no longer required.

 

Where technically possible, information may be anonymised for internal statistical purposes so that candidates can no longer be identified.

Candidates should not submit curricula vitae or documentation through:

a) Public comments;

b) Messages sent to pages or profiles not identified for recruitment;

c) Decorpita employees’ personal accounts;

d) Posts accessible to third parties.

 

Where an application is received through such a channel, Decorpita may ask the candidate to resubmit it to recrutamento@decorpita.pt and delete or restrict the information received through the inappropriate channel.

Decorpita is not responsible for the privacy or security practices of social media platforms or external services used by the candidate.

Decorpita does not use decisions based solely on automated processing to select, reject or hire candidates.

No decision producing significant effects for a candidate will be made without human involvement.

As at the publication date of this Notice, Decorpita does not intend to transfer candidates’ personal data to countries outside the European Economic Area.

Decorpita will seek to use service providers that process personal data within the European Economic Area.

Where a technology provider involves an international transfer, Decorpita will ensure that an appropriate legal transfer mechanism is in place and will provide any additional information required by law.

Decorpita will implement appropriate technical and organisational measures to protect candidates’ personal data against:

a) Unauthorised access;

b) Improper disclosure;

c) Loss;

d) Destruction;

e) Alteration;

f) Misuse;

g) Unlawful processing;

h) Accidental or malicious incidents.

 

Such measures may include:

a) Restricting access to recruitment inboxes;

b) User profiles and permission management;

c) Confidentiality obligations;

d) Protection of devices and systems;

e) Authentication mechanisms;

f) Backups;

g) Technical updates;

h) Internal deletion procedures;

i) Staff awareness and training.

 

All employees and service providers involved in the processing are subject to confidentiality obligations. Law No. 58/2019 establishes duties of secrecy and confidentiality for individuals involved in personal data processing operations.

Subject to applicable law and the circumstances of the relevant processing, candidates may exercise:

 

21.1. a) The right of access;

Obtain confirmation regarding the processing of your data and access the data and information related to that processing.

 

21.2. b) The right to rectification;

Request the correction or updating of inaccurate, incomplete, or outdated data.

 

21.3. c) The right to erasure;

Request the deletion of data when the legal requirements are met.

This right may not apply when the data must be retained to comply with a legal obligation or to exercise or defend legal claims.

 

21.4. d) The right to restriction of processing;

Request the temporary limitation of data usage in the situations provided for by law.

 

21.5. e) The right to object;

The right to object, on grounds relating to the data subject’s particular situation, to processing based on Decorpita’s legitimate interests.

 

21.6. f) The right to data portability, where applicable;

To receive the provided data in a structured, commonly used, and machine-readable format, when the processing is based on consent or contractual measures and is carried out by automated means.

 

21.7. g) The right to withdraw consent where processing is based on consent;

When processing is based on consent, the candidate may withdraw it at any time.

The withdrawal does not affect the lawfulness of the processing carried out prior to such withdrawal.

 

21.8. h) Rights relating to automated decision-making.

Not to be subject, except in situations provided for by law, to a decision based solely on automated processing that produces legal effects or significantly affects the individual.

CNPD identifies, among others, the rights of access, rectification, erasure, restriction, portability, and objection.

Requests must be submitted in writing to:

Email: privacidade@decorpita.pt

or

Postal address:

DECOR PITA – MATERIAIS DE CONSTRUÇÃO, S.A.
For the attention of: Data Protection
Estrada do Casal da Coxa, no. 2
2600-056 Rondulha
Vila Franca de Xira
Portugal

The request should state:

a) The candidate’s name;

b) The email address used to submit the application;

c) The relevant vacancy or process;

d) The right being exercised;

e) Contact details for the response.

 

Where Decorpita has reasonable doubts regarding the requester’s identity, it may request additional information strictly necessary to confirm that identity.

The exercise of data subject rights is generally free of charge.

Decorpita will respond without undue delay and, in principle, within one month of receiving the request, subject to any extension permitted by law.

Candidates have the right to lodge a complaint with the competent supervisory authority:

Comissão Nacional de Proteção de Dados — CNPD

Avenida D. Carlos I, n.º 134, 1.º
1200-651 Lisboa
Portugal

Telephone: +351 213 928 400
Email: geral@cnpd.pt

The CNPD is the national supervisory authority responsible for overseeing compliance with the GDPR and Law No. 58/2019.

Candidates may first contact Decorpita through privacidade@decorpita.pt so that the matter can be reviewed and, where possible, resolved directly.

Decorpita may amend this Policy as a result of:

a) Legislative or regulatory changes;

b) Changes to its internal recruitment procedure;

c) The introduction of new recruitment tools;

d) Changes to application channels;

e) Changes to technology providers;

f) The introduction of recruitment forms or platforms;

g) Organisational or operational changes.

 

The updated version will be published on the Website together with the date of the latest update and the applicable version number.

This Policy shall be interpreted in accordance with:

a) Regulation (EU) 2016/679 — General Data Protection Regulation;

b) Portuguese Law no. 58/2019 of 8 August;

c) The Portuguese Labour Code;

d) Any other applicable Portuguese and European data protection and employment legislation.

Applications and recruitment

Email: recrutamento@decorpita.pt

or another email address expressly identified in the relevant vacancy notice.

Data protection

Email: privacidade@decorpita.pt

General contact

Email: geral@decorpita.pt
Telephone: +351 263 287 320
Website: https://decorpita.pt

Last updated: 01.09.2026
Version: 1.0