Skip to main content
Careers

Applicant Privacy Notice

The specific information GIS360 processes when you create an applicant account or apply for a position.

Effective Date: 31 August 2026

1. Data Controller And Contact

GIS360 GLOBAL IT SUPPORT, UNIPESSOAL, LDA, NIPC 517734184, is the controller of the applicant information described in this notice.

Registered address: Rua Doutor João Manuel Covas Lima, N.º 24, 7800-490 Beja, Portugal
Careers and applicant privacy email: careers@gis360.eu
Website: https://gis360.eu

GIS360 has not appointed a Data Protection Officer. Applicant privacy questions and requests are handled through careers@gis360.eu.

2. Information The Applicant Portal Processes

The GIS360 applicant portal processes the following information when you provide it or when it is generated during recruitment:

  • Account email address, one-way password hash, email-verification status, privacy-notice acceptance and last-login time
  • First and last name, telephone number, country, city and professional title
  • Primary skills, years of experience, LinkedIn URL and portfolio URL where provided
  • Your resume, its original filename, file type, file size and upload time
  • The position applied for, cover message, submission time and application status
  • Shortlisting decisions, recruitment stages, interview dates, time zone, meeting link and authorised recruitment notes
  • Recruitment emails and whether a stage notification was successfully delivered
  • Security information needed to protect the portal, including session information, login and request-limiting records and relevant server logs

The portal does not use social-media sign-in, advertising profiles, Google Analytics, automated candidate scoring or a general candidate-marketing pool.

3. Where The Information Comes From

Account, profile, resume and application information is collected directly from you through the applicant portal. Recruitment-stage information is created by authorised GIS360 recruitment personnel as your application progresses. Communications sent by you to careers@gis360.eu, or supplied during an interview, may be added to the relevant recruitment record.

GIS360 does not currently import applicant profiles from social networks or operate an integrated recruitment-agency submission service. If GIS360 receives your details through a referral or recruitment agency outside this portal, you will be told the source and provided with the applicable privacy information as required by Article 14 GDPR.

4. Required And Optional Information

Your email address, password, core profile details and a supported resume file are required to create a usable applicant profile and submit an application. The application cannot be processed if these required details are not provided. LinkedIn and portfolio URLs and the cover message are optional. Optional information does not determine whether you can create an account.

5. Purposes And Legal Bases

  • Creating and operating your applicant account: steps taken at your request before a possible employment relationship, under Article 6(1)(b) GDPR.
  • Receiving, reviewing and managing your application, contacting you and arranging interviews: steps taken at your request before a possible employment relationship, under Article 6(1)(b) GDPR.
  • Maintaining an auditable recruitment process, preventing duplicate or fraudulent submissions and protecting the portal: GIS360's legitimate interests in secure and accountable recruitment, under Article 6(1)(f) GDPR.
  • Responding to legal claims or binding requests from authorities: compliance with a legal obligation under Article 6(1)(c), or GIS360's legitimate interest in establishing, exercising or defending legal claims under Article 6(1)(f) GDPR, as applicable.

GIS360 does not use consent as the legal basis for the ordinary assessment of a job application.

6. Who Can Access Applicant Information

Access is limited to authorised GIS360 recruitment administrators and the managers involved in deciding whether to progress the application. Applicant information is not published and is not used for unrelated marketing.

The portal uses these processors to provide the service:

  • Namecheap, Inc.: cPanel shared hosting, the private applicant database, private resume storage, server security and backups.
  • Microsoft 365: delivery and storage of verification, password-reset, application and recruitment-stage emails sent from or to careers@gis360.eu.

Information may also be disclosed where GIS360 is legally required to respond to a court, regulator or law-enforcement authority.

7. International Processing

The applicant portal is hosted through Namecheap. Namecheap, Inc. is established in the United States and its Data Processing Addendum incorporates the European Commission's Standard Contractual Clauses for relevant transfers. Recruitment email is handled through GIS360's Microsoft 365 tenant. Microsoft applies its Data Protection Addendum, EU Data Boundary commitments where applicable to the tenant, and Standard Contractual Clauses for covered transfers outside the EEA.

You may request further information about the safeguards relevant to your application by emailing careers@gis360.eu.

8. Retention

Unsuccessful applications are retained for six months from the date GIS360 notifies the applicant that the application will not progress. At the end of that period, the application, associated recruitment-stage history and resume are deleted or anonymised unless GIS360 must preserve a limited record for an active legal claim or binding legal obligation.

For a successful applicant, information required to establish and administer employment may be transferred to the relevant personnel record. The copy held in the applicant portal is removed within six months after the recruitment decision, once the required employment information has been transferred.

When no active application remains, the applicant account, reusable profile and resumes are removed with the last application to reach the end of its retention period. Verification links expire after 24 hours and password-reset links expire after 60 minutes. Expired or used security-token records and request-limiting records are removed through portal maintenance.

The six-month period is GIS360's documented recruitment-retention rule. GDPR does not prescribe a universal six-month period; it requires personal information to be kept no longer than necessary.

9. Special-Category Information

GIS360 does not request information about racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric identifiers, health, sex life or sexual orientation through the applicant portal. Do not include this information in your resume or cover message unless it is strictly necessary and GIS360 has specifically requested it on a lawful basis.

10. Cookies And Portal Security

The applicant portal uses a strictly necessary secure session cookie to keep you signed in and protect authenticated requests. Production session cookies are configured as Secure, HttpOnly and SameSite=Lax. The applicant portal does not set optional advertising or analytics cookies.

Passwords are stored using one-way password hashing. Verification and reset links are single-use and time-limited. Resumes use random internal filenames and are stored outside the public website directory. Download access requires authentication and ownership or authorised recruitment access.

11. Your Rights

Subject to the conditions in GDPR, you may request access to your applicant information, correction of inaccurate information, deletion, restriction, portability, or object to processing based on legitimate interests. Where processing is based on consent in a separate situation, consent may be withdrawn without affecting processing that was lawful before withdrawal.

Send requests to careers@gis360.eu. GIS360 may request information necessary to confirm your identity before releasing or changing applicant data.

12. Complaints

You may lodge a complaint with the Portuguese supervisory authority:

Comissão Nacional de Proteção de Dados (CNPD)
Av. D. Carlos I, 134 – 1.º
1200-651 Lisboa, Portugal
www.cnpd.pt

13. Automated Decision-Making

GIS360 does not use solely automated decision-making or profiling to accept, reject, rank or shortlist applicants. Recruitment actions are taken by authorised people.

14. Notice Changes

If the applicant portal's processing changes, GIS360 will update this notice and its effective date. A material new purpose or processing activity will not be described as accepted merely because an applicant continues using the portal.