top of page

Bonapolia

Book a call →

Privacy Policy

Last updated: September 2026

Bonapolia LDA is a Portuguese company registered at Av. do Atlântico, 16, esc. 5.07, 1990-019 Lisboa, Portugal. This policy explains what personal data we collect through bonapolia.com, why we collect it, how we use it, and your rights under the GDPR. For personal data related to job applications on our recruitment portal jobs.bonapolia.com (operated on our behalf by Teamtailor), see the additional notice available there — this policy summarises the key points below and covers the gaps.

What we collect

When you visit bonapolia.com

  • Technical data — IP address, browser type, device type, pages visited, referrer, session duration. Collected automatically.

  • Analytics data — aggregated visitor behavior (page views, time on page, click paths). Only if you accept optional analytics cookies.

When you contact us as a client or prospect

  • Contact data — name, email, company, role, and any details you share in your message or on a call.

  • Communication history — emails, meeting notes, contract-related documents.

When you are a candidate

We process candidate data primarily through jobs.bonapolia.com, powered by Teamtailor on our behalf. Detailed notice on that portal covers applications you submit and interactions with our recruitment team. This section summarises what we collect and adds the specifics not fully covered by the Teamtailor notice.

  • Application data — name, email, phone, resume/CV, work experience, skills, education, certifications, salary expectations, availability, location, right-to-work status (where lawful), interview notes, feedback.

  • Sourcing data — public profiles (LinkedIn, GitHub, other public sources), referrals from our network, notes we compile before making first contact. We may collect this data before you apply, as part of finding suitable candidates for open roles.

  • Communication history — emails, messages, call notes with our recruiters.

  • Recruitment outcome data — role you were considered for, stage reached, decision, feedback shared with you and the hiring client.

Because some candidate data is collected from third-party sources (not directly from you), we send a short Candidate Sourcing Notice at first contact, explaining what data we have, where it came from, and your rights. This satisfies Article 14 of the GDPR.

Why we collect it

  • To respond to your inquiries. You contact us, we reply.

  • To provide our services. If we sign an engagement, we need engagement-related data to deliver it.

  • To find and present engineers for client engagements. For Staff Augmentation and Dedicated Teams roles at our clients, we source, screen, and introduce engineers who then join a Bonapolia contract. This is the core of our staffing work.

  • To improve the site. Optional analytics show us what's working. Aggregated only, no personal identification.

  • To comply with legal obligations. Invoicing, taxes, contract retention under Portuguese law.

Our lawful basis under GDPR:

  • Legitimate interest — site operation, responding to inquiries, sourcing candidates for open roles. For candidates, we have completed a legitimate interest assessment (balancing test), a copy of which is available on request.

  • Contract — service delivery to clients; contractor agreements with engineers who join a client engagement through Bonapolia.

  • Consent — analytics cookies; retention of candidate data in our database after a specific role closes.

  • Legal obligation — accounting, tax filings, employment record-keeping.

How long we keep it

  • Website analytics — up to 26 months (Google Analytics default retention).

  • Contact inquiries that didn't lead to engagement — 12 months.

  • Client engagement data — for the duration of the engagement plus 7 years (Portuguese accounting requirements for contracts and invoices).

  • Candidate data — no engagement started — 24 months from last meaningful contact, after which we either delete the record or ask for renewed consent to keep it in our database for future opportunities.

  • Candidate data — engagement started (contractor on Staff Aug / Dedicated Teams) — for the duration of the engagement plus the period required by the client contract and Portuguese accounting law (typically 7 years for financial records).

Who we share it with

We do not sell your data. We share only with:

  • Wix.com — our website hosting platform.

  • Microsoft (Outlook, Teams, Bookings) — for email, calendar, meeting scheduling, and file storage.

  • Teamtailor — recruitment portal at jobs.bonapolia.com. Processes candidate data on our behalf.

  • Client companies — for candidate profiles we present and engagement-related communication.

  • End clients of our clients — where we work through an IT consultancy, our candidates and engagement data may reach the consultancy's own end client. We disclose this to candidates before proceeding.

  • Recruiter contractors of Bonapolia — external tech recruiters engaged by Bonapolia to help with sourcing. They act as processors under our instructions.

  • Legal or tax authorities — if required by Portuguese or EU law.

International transfers

Some of your data may leave the European Economic Area (EEA). Specifically:

  • United States — some of our clients are US-based. Candidate profiles and engagement communication may be sent to them for review and hiring decisions.

  • United Kingdom — some clients are UK-based; the UK has an adequacy decision from the European Commission.

  • Armenia, Georgia, and other third countries — some of our recruiter contractors are based outside the EEA. They process candidate data under our instructions.

For transfers to countries without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (SCCs) with the receiving party, supplemented by additional safeguards where required. You have the right to request a copy of these safeguards — email us at privacy@bonapolia.com.

No automated decisions

We do not use automated decision-making or profiling that has legal or similarly significant effects on you. Every meaningful decision in our recruitment process — candidate shortlist, presentation to a client, rejection at any stage — is made by a human recruiter or hiring manager, with human review of any tooling output. We also do not train external AI models on candidate data.

Cookies

We use two types of cookies:

  • Essential — required for the site to function. Cannot be disabled.

  • Analytics — help us understand how the site is used. Optional. You choose via the cookie banner or Cookie Preferences.

You can manage your cookie choices anytime on the Cookie Preferences page. For cookies on jobs.bonapolia.com, see the Cookie Policy on that portal.

Your rights under GDPR

You have the right to:

  • Access the personal data we hold about you

  • Correct inaccurate data

  • Request deletion ("right to be forgotten")

  • Object to processing based on legitimate interest

  • Withdraw consent (analytics cookies; candidate database retention)

  • Lodge a complaint with the Portuguese Data Protection Authority (CNPD)

To exercise any of these rights, email privacy@bonapolia.com. We respond within 30 days.

Candidates can also use the self-service tools on jobs.bonapolia.com — Request my data, Remove my data, Manage my permission — under "Data & privacy" in the footer of that portal.

Changes to this policy

We update this policy when our practices change or when law requires it. Material changes are posted here. The "Last updated" date at the top reflects the most recent revision.

Contact

Bonapolia LDA
Av. do Atlântico, 16, esc. 5.07
1990-019 Lisboa, Portugal
privacy@bonapolia.com

For questions about the Teamtailor recruitment portal specifically, refer to the notice at jobs.bonapolia.com/privacy-policy or use the contact form on that portal.

bottom of page