Privacy Policy.
Last updated: 12 August 2026
JOIN Engineering & Consulting, Lda. (“JOIN”, “we”, “us”) is committed to protecting your personal data. This Privacy Policy explains how we collect, use, share and protect personal data when you visit our website, contact us, apply to work with us or collaborate with us, in accordance with the EU General Data Protection Regulation (GDPR) and Portuguese Law n.º 58/2019.
1. Data controller
The data controller is JOIN Engineering & Consulting, Lda., NIPC 519432517, with registered office at Rua da Agudela, 91, 1.º Direito, 4455-019 Lavra, Portugal, and offices at Edifício Transparente, Via do Castelo do Queijo, 395, 4100-429 Porto, Portugal. For any privacy matter, contact us at info@joinengineering.com.
JOIN has not appointed a Data Protection Officer, as it is not required to do so.
2. Personal data we collect
- Contact and enquiry data: name, email address, company, phone number and the content of your message when you contact us.
- Application data: CV, LinkedIn profile, professional experience, areas of expertise, location, work preferences and any information you choose to share when applying, including spontaneous applications.
- Business relationship data: contact details and professional information of client, supplier and partner representatives, needed to manage collaborations.
- Technical data: IP address, browser type, device and usage information collected through cookies and similar technologies when you visit the website (see our Cookie Policy).
- Whistleblowing data: the information provided in reports made through our whistleblowing channel (see section 10).
3. Purposes and legal bases
Responding to enquiries: legitimate interest in communicating with you (Art. 6(1)(f) GDPR).
- Recruitment and talent pooling: steps prior to entering into a contract (Art. 6(1)(b)) and, to keep your profile for future opportunities, your consent (Art. 6(1)(a)). We will ask for your consent before keeping your profile, and you can withdraw it at any time by contacting us.
- Managing client and supplier relationships: performance of a contract (Art. 6(1)(b)) and legitimate interest.
- Legal compliance: tax, accounting and other legal obligations (Art. 6(1)(c)).
- Website operation and security: legitimate interest in maintaining a secure, functional website.
- Handling whistleblowing reports: see section 10.
We do not use automated decision-making, including profiling, that produces legal or similarly significant effects for you.
4. International transfers
JOIN works with international clients and partners, mainly within the European Union and the European Economic Area. Where personal data is transferred outside the EU/EEA, for example to clients, partners or service providers in third countries, we ensure an adequate level of protection through European Commission adequacy decisions, Standard Contractual Clauses or other safeguards permitted by the GDPR. You may request a copy of the applicable safeguards through our contact details.
5. Who we share data with
- Clients: where you are an engineering professional proposed for a project, we share relevant professional information with the prospective client, with your consent.
- Service providers: IT, hosting, communication and administrative providers acting as processors under contract.
- Authorities: where required by law.
- Whistleblowing reports: only as described in section 10.
We do not sell personal data.
6. Data retention
We keep personal data only for as long as necessary for the purposes described above:
- Enquiry data: up to 2 years.
- Application data: up to 2 years after our last interaction, unless you ask us to delete it earlier or consent to a longer period.
- Business relationship data: for the duration of the relationship and up to [2] years after it ends.
- Contractual and invoicing data: for the periods required by Portuguese law (generally 10 years).
- Technical data: see our Cookie Policy.
• Whistleblowing reports: 5 years after receipt, or longer while related legal proceedings are pending
7. Your rights
Under the GDPR you have the right to access, rectify, erase, restrict and object to the processing of your personal data, the right to data portability and the right to withdraw consent at any time (without affecting prior processing). To exercise these rights, contact info@joinengineering.com. You also have the right to lodge a complaint with a supervisory authority: in Portugal, the CNPD (Comissão Nacional de Proteção de Dados, www.cnpd.pt) or with the authority of your country of residence within the EU/EEA.
8. Security
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure, and we require the same from our processors.
9. Cookies
Our website uses cookies and similar technologies. For details on the types of cookies used and how to manage them, see our Cookie Policy Cookie Policy.
10. Whistleblowing Channel
Reports submitted through our whistleblowing channel, available at www.joinengineering.com, are processed only to receive, assess and follow up the report, in compliance with Law n.º 93/2021 and in JOIN’s legitimate interest in detecting and preventing wrongdoing (Art. 6(1)(c) and (f) GDPR). For communications related to the whistleblowing channel, the dedicated email address is compliance@joinengineering.com.
Reports may be made anonymously; if you do not provide contact details, we do not collect your identity. Access is restricted to the Compliance Officer and, where needed, the persons appointed to investigate. The identity of the reporter is kept confidential and is not disclosed without their consent, unless required by law.
Data that is clearly not relevant is deleted without delay. Reports are kept for 5 years after receipt and, regardless of that period, while related legal proceedings are pending. The rights described in section 7 may be limited where necessary to protect the identity of a reporter or the integrity of an investigation.
10. Changes to this policy
We may update this Privacy Policy from time to time. The current version, with its date, is always published on this page. Material changes will be highlighted on the website.