The Data Controller of your data may be, individually, one of the companies that make up Mezzala, or all the companies that make up the Group as joint controllers, depending on the specific type of data processing. The companies that make up Mezzala are the following:

- Bastarda;
- Right 0;
- Ave Rara;
- The Web Is Bananas;

During the use of the website, Mezzala collects personal and non-personal information. Personal data should be understood as any information relating to an identified or identifiable natural person. Thus, personal data collected includes:

Name;

Email address;

Phone number;

Date of Birth;

Nationality;

Location;

Experience;

Curriculum Vitae (CV);

Before the first promotional message or newsletter is sent, the express consent of the data subject will be requested to send this type of message. This consent will be requested via email, and the data subject will only start receiving messages if they respond positively.

In addition to the personal data listed above, other data is also collected in order to ensure the technical functionalities of the website and guarantee the stability and security of navigation, such as:

User's IP address;

Date and time of the request or registration;

Content of the request (specific page);

Data volume and page transmitted;

Origin of the request;

Browser type;

User's operating system;

Language and version of the browser software;

Referral URLs;

Websites visited by the user's system through our website;

During the use of this website, Mezzala will collect your personal data for the following purposes, based on the following grounds of lawfulness:

• Registration and management of recruitment and selection processes;
• Pre-contractual steps and execution of contracts (Article 6(1)(b) of the GDPR);
• Management of contact requests, information, and complaints;
• Pre-contractual steps at the request of the data subject, legitimate interest of Mezzala (Article 6(1)(a) and (f) of the GDPR);
• Sending direct marketing communications;
• Consent of the data subject (Article 6(1)(a) of the GDPR);

Before the first marketing communication is sent to you, your express consent will be requested for the sending of communications by all Mezzala companies. In each communication, you will be given the opportunity to withdraw your consent.

Your personal data may also be processed whenever there is another ground of lawfulness that legitimizes the respective processing, namely:

• Legal obligation of Mezzala (Article 6(1)(c) of the GDPR);
• Legitimate interest of Mezzala, provided that this interest does not override your fundamental rights and freedoms (Article 6(1)(f) of the GDPR);
• Defense of your vital interests or those of a third party (Article 6(1)(d) of the GDPR);

Mezzala will store your personal data for the time strictly necessary to achieve the purpose for which it was collected, and may also retain some of your personal data to the extent necessary to comply with its legal obligations, as well as to manage or assert its rights. After the aforementioned retention periods, the personal data will be permanently deleted from our databases.

Mezzala may share your personal data with third-party entities, namely with service providers or other public entities, to the extent necessary for the pursuit of its activity. Whenever this happens, Mezzala will ensure that such entities are in a position to fulfill their obligations regarding privacy and personal data protection.

Mezzala does not transfer or store your personal data in geographical regions that do not ensure the same level of data protection as that ensured by entities located in the European Economic Area (EEA). All data transfers are carried out in accordance with applicable legislation, using the mechanisms legally provided for this purpose.

Under the current legislation on personal data protection, Mezzala ensures you the following rights as a data subject:

Right to be informed:

• At the time of collection of personal data;
• Of the contacts of the data controller;
• Of the purpose(s) of processing;
• Of the retention period;
• Of your rights as personal data subjects;
• Of the possibility of appealing to the supervisory authority to lodge a complaint (and respective contacts);
• Of the (possible) existence of automated decisions and/or profiling;
• To know where your data is stored and how it is processed;
• To be informed of how the Data Controller complies with its data protection obligations;

Right of access:

• The data subject can access their personal data; confirm the existence or not of processing of their data, and request a copy of the same;

Right to object to processing:

• The data subject has the right to object to the processing on grounds relating to their particular situation;

Right to rectification:

• The data subject has the right to rectify their personal data if it is incorrect, outdated, or incomplete;

Right to erasure:

• The data subject can request the erasure of their data provided that, in the specific case, all requirements are met;

Right to data portability:

• The data subject has the right to receive the personal data concerning them, which they have provided, in a structured, commonly used, and machine-readable format; and the right to transmit those data to another Data Controller whenever:
• The processing is based on consent or on a contract;
• The processing is carried out by automated means;

Right to restriction of processing:

• In certain situations, which must be weighed case by case, the data subject has the right to request the restriction of the processing of their data;

The exercise of rights by data subjects may be done via the e-mail address rgpd@mezzala.pt as well as in writing to the postal address of Mezzala's tax headquarters, in which you identify yourself and indicate the situation that is the subject of your request, with:

A/C: Data Protection

Address: Rua 28 de Janeiro n.º350, Candal Park WP08, 4400-335 Vila Nova de Gaia

You may also file a complaint with the National Data Protection Commission (CNPD) and/or obtain redress and/or compensation if you consider that the processing carried out violates your rights and/or applicable legislation on personal data protection and privacy.

Mezzala uses a set of appropriate security technologies and procedures to protect your personal data from unauthorized access, use, or disclosure, such as: access control; logging of user activity, and penetration testing. Your personal data is stored for hosting and backup on servers located in Portugal, in a secure environment, protected from unauthorized access. As a user, you must protect your devices against viruses or other threats that may compromise their security, through specific programs for this purpose.

Mezzala has appointed a Personal Data Protection Officer, whose duties are as follows:

• To monitor the compliance of personal data processing operations with current applicable legislation;
• To provide advice on privacy and personal data protection matters;
• To cooperate with the CNPD;
• To act as a point of contact for the CNPD, the Supervisory Authorities of other Member States of the European Union, and personal data subjects;

For the clarification of any question related to your privacy and the protection of your personal data, you may contact the Data Protection Officer via the e-mail address rgpd@mezzala.pt.