Privacy policy for the Nutrium employer brand and recruitment
Date of publication: 26-11-2025
At Nutrium, we manage our employer brand and recruitment process through our careers website (the “Careers Site”) and using a related applicant tracking system.
In this privacy policy, we explain how we process your personal data if:
1. You visit our Careers Site (as a “Visitor”)
2. You connect with us through our Careers Site to create a profile with us and receive information about current or future job openings with us (as a “Connecting Candidate”)
3. You apply for a position with us through our Careers Site or a third-party service (as an “Applying Candidate”)
4. We collect information about you from other parties, websites, and services because we believe your profile is of interest for our current or future openings (as a “Referred Candidate”)
5. We receive information about you from our employees or partners because they believe your profile is of interest for our current or future vacancies (as a “Referred Candidate”)
6. We receive information about you from a Candidate who names you as their reference (you being a “Reference”).
This privacy policy also describes your rights when we process your personal data and how you can exercise those rights.
When we use the term “Candidate” in this privacy policy, we are referring to each of the Candidates who Connect, Candidates who Apply, Recruited Candidates, and Recommended Candidates, unless otherwise specified.
1. About the processing of personal data
Personal data is any information that can be directly or indirectly associated with a living, physical person. Examples of personal data include name, email address, phone number, and IP address. The processing of personal data is any automated use of personal data, such as the collection, creation, analysis, sharing, and deletion of personal data.
There are laws and regulations on how companies can process personal data, known as data protection laws. Different data protection laws apply to different types of personal data use and in different parts of the world. An example of a data protection law that is relevant to our use of your personal data as described in this privacy policy is the EU Data Protection Regulation (2016/679, “GDPR”).
Most obligations under the GDPR apply to the so-called data controller. A data controller is the entity that decides for what purposes personal data will be processed and how the processing will be carried out. The data controller may use a so-called data processor. A data processor is an entity that is only allowed to process personal data as instructed by the data controller and cannot use the personal data for its own purposes.
We are the data controller when we process your personal data as described in this Privacy Policy.
2 What personal data do we process?
All individuals
- Device information - If you visit our Careers Site, we will collect information about your device, such as your IP address, browser type and version, session behavior, traffic source, screen resolution, preferred language, geographic location, operating system, and device settings/usage.
- Technical and statistical data - If you visit our Careers Site, we will collect technical and statistical data about your use of the site, such as information about the URLs you visit and your activity on the site.
- Communication data - We will collect and store your communication with us, including the information you provided in the communication. This may include the content of emails, video recordings, social media messages, the information you add to your account with us, surveys, etc.
- Contact data - Such as your name, email address, phone number, and physical address.
Candidatos
- Interview data, assessments, and other recruitment process information—such as interview notes, assessments, and tests taken, salary requirements.
- Information in your application—such as your resume, cover letter, work samples, references, letters of recommendation, and academic qualifications.
- Information from your public profile - This means the information we collect about you from public sources related to your professional experience, such as LinkedIn or your current employer's website.
- Information provided by references - This means the information we receive from our employees or partners who referred you to us, or from the people you listed as your references.
3. Where do we get your personal data from?
All individuals
- From the Careers Site. If you visit our Careers Site, we collect technical and statistical information about how you use the Careers Site and information on your device.
- Directly from you. Most of the information we process about you is received directly from you, for example, when you apply for a position with us or connect with us. You can always choose not to provide us with certain information. However, some personal data is necessary for us to process your application or provide you with the information you have requested.
Referrals
- From the person for whom you are a referral. If a Candidate lists you as a reference, we will collect your contact details from the candidate so that we can contact you.
Candidates
- From public sources. We may collect personal data about you from public sources, such as LinkedIn or your current employer's website.
- From our references. We may receive information about you from our employees or partners (such as recruitment service providers) when they consider your profile to be of interest for our current or future vacancies.
- From your references. If you provide us with references, we may collect information about you from them.
- Data we create ourselves or in collaboration with you. Information about your application and profile is usually created by us, or by us in collaboration with you, during the recruitment process. It may, for example, include notes from interviews with you, assessments, and tests taken.
4. For what purposes do we process your personal data?
Protecting and enforcing our rights, interests, and the interests of third parties, for example, in the context of legal proceedings.
Affected individuals: The individual(s) affected by the legal issue—this may include individuals from all of the categories listed above.
Categories of personal data used: All categories of personal data indicated above may be used for this purpose.
Share your personal data with other recipients for the purposes mentioned in Section 5 below.
Affected individuals: Varies depending on the purpose of sharing, see Section 5 below.
Categories of personal data used: All categories of personal data listed above may be used for this purpose.
Collecting information about your use of the Careers Site using cookies and other tracking technologies, as described in our Cookie Policy.
Affected individuals: Visitors.
Categories of personal data used: Device information.
Maintain, develop, test, and ensure the security of the Careers Site.
Affected individuals: Visitors.
Categories of personal data used: Device information; Technical and statistical data.
Analysis of how the Careers Site and its content are being used and its performance, to obtain statistics and improve operational performance.
Affected individuals: Visitors.
Categories of personal data used: Device information; Technical and statistical data.
To provide you with updates on job openings with us.
Affected individuals: Applicants who connect.
Categories of personal data used: Contact data; Communications data.
Reviewing profiles and applications sent to us. This also includes communicating with you about your application and profile.
Individuals affected: Candidates who Connect; Candidates who Apply.
Categories of personal data used: All categories of personal data listed above may be used for this purpose.
Collection and evaluation of your professional profile on our own initiative. This also includes communicating with you regarding your profile.
Affected individuals: Obtained Candidates; Recommended Candidates.
Categories of personal data used: All categories of personal data indicated above may be used for this purpose.
Contact you directly about specific and future vacancies in our company.
Individuals affected: Candidates.
Categories of personal data used: All categories of personal data indicated above may be used for this purpose.
Record the interview(s) with you, when conducted via the Teamtailor platform.
Individuals affected: Candidates.
Categories of personal data used: Communication data.
To contact you to request your participation in surveys.
Individuals affected: Candidates.
Categories of personal data used: All categories of personal data indicated above may be used for this purpose.
Contacting you to ask you to provide information about a Candidate and to evaluate the information you provide.
Individuals affected: References.
Categories of personal data used: Contact data; Communication data.
5. With whom do we share your personal data?
Our service providers. We share your personal data with our suppliers who provide services and features in our employer branding and recruitment process. For example, this includes recruitment service providers and the supplier of our Career Site and its applicant tracking system.
Our group companies. We share your personal data with our group companies when they provide us with services and functionality for our employer branding and recruitment process, such as access to specific systems and software.
Companies that provide cookies on the Careers Site. If you give your consent, cookies are set by companies other than us, which will use the data collected by these cookies in accordance with their own privacy policy. You can find information about the cookies to which this applies on our Cookie Policy page.
To authorities and other public actors—when we are ordered to do so. We will share your personal data with authorities and other public actors when we have a legal obligation to do so.
To parties involved in legal proceedings. If necessary to protect or defend our rights, we share your personal data with public authorities or other parties involved in a potential or existing legal proceeding. This may happen, for example, in the event of complaints of discrimination.
Mergers and acquisitions, etc. In the context of a potential merger, sale of company assets, financing, or acquisition of all or part of our business to another company, we may share your personal data with other parties involved in the process.
6. On what legal basis do we process your personal data?
In order to process your personal data, we need to have a legal basis. A legal basis is a reason for processing personal data that is justified under the GDPR.
When we process your personal data for the purposes described in this Privacy Policy, the legal basis we rely on is typically that the processing is necessary for our legitimate interest in being able to recruit talent with the relevant skills for us. We have concluded that we have a legitimate interest in being able to process personal data for this purpose; that the processing is necessary to achieve that purpose; and that our interest outweighs your right not to have your data processed for this purpose.
You can contact us for more information about how this assessment was made. See Sections 9 and 10 below for our contact details.
There may be specific circumstances where processing is only carried out if and when you give your consent to the processing. This is the case, for example, if we propose to record an interview with you. See Section 9 below for more information about your right to withdraw consent.
7. When do we transfer your personal data outside the EU/EEA, and how do we protect it?
We always try to process your personal data within the EU/EEA.
However, some of our service providers process your personal data outside the EU/EEA. We also use suppliers whose parent company, or the parent company of a subcontractor, is based outside the EU/EEA. In these cases, we have taken into account the risk that personal data may be disclosed in countries outside the EU/EEA, for example, due to a request from an authority.
In cases where another recipient of your personal data (as described in Section 5 above) is based outside the EU/EEA, this also means that your personal data is transferred outside the EU/EEA.
When we, or one of our suppliers, transfer your personal data outside the EU/EEA, we ensure that a safeguard recognized by the GDPR is used to enable the transfer. We use the following safeguards:
When your personal data is transferred outside the EU/EEA, we also implement appropriate technical and organizational safeguards to protect personal data in case of disclosure. The protective measures we implement depend on what is technically feasible and sufficiently effective for the transfer in question.
If you would like more information about the cases in which your personal data is transferred outside the EU/EEA, you can contact us using the contact details provided in sections 9 and 10 below.
8. How long do we keep your personal data?
All individuals
If we process your personal data for the purpose of protecting and enforcing our rights, we will retain your personal data until the relevant legal issue has been fully and finally resolved.
Visitors
We retain your personal data for one (1) year for security reasons. Cookie retention periods are set out in our Cookie Policy. We retain your personal data to analyze the performance of the Careers Site for as long as we retain personal data about you for other purposes.
Applicants
If you are a Connecting Applicant (only), we retain your personal data for as long as you remain connected with us.
For other types of Applicants, we retain your personal data to decide whether you are a suitable candidate for the relevant vacancy(ies) in our company.
If you are unsuccessful in the initial recruitment process, we retain your personal data for as long as necessary to consider, and potentially contact, you for future relevant job vacancies.
If you are hired, we will retain your personal data during your employment for purposes other than those mentioned above, of which you will be informed.
Referrals
We retain your personal data for as long as we retain the personal data of the candidate for whom you acted as a reference.
9. Que direitos tem e como os pode exercer?
In this section, you will find information about your rights when we process your personal data. As described below, some of the rights are only exercised when we process your personal data under a specific legal basis.
If you wish to exercise any of the rights listed here, we suggest that you:
- Visit the Data and Privacy page on our Careers Site, where we provide features that allow you to exercise your rights;
- Log in to your account with us, where you can use your account settings to exercise your rights; or
- Contact us directly at dpo@nutrium.com.
Right to be informed
You have the right to be informed about how we process your personal data. You also have the right to be informed if we plan to process your personal data for any purpose other than that for which it was originally collected.
We provide you with this information through this privacy policy, through updates on our Careers Site (see also Section 11 below), and by responding to any questions you may ask us.
Right of access to your personal data.
You have the right to know whether we process personal data about you and to receive a copy of the data we process about you. In addition to receiving a copy of your data, you will also receive information about how we process your personal data.
Right to access and request the transfer of your personal data to another recipient (“data portability”).
You may request a copy of the personal data concerning you that we process for the performance of a contract with you, or based on your consent, in a structured, commonly used, and machine-readable format. This will allow you to use this data elsewhere, for example, to transfer it to another recipient. If technically feasible, you also have the right to request that we transfer your data directly to another recipient.
Right to have your personal data deleted (“right to be forgotten”).
In some cases, you have the right to request that we delete your personal data. This is the case, for example, if it is no longer necessary to process the data for the purpose for which it was collected; if you withdraw your consent; if you have objected to the processing and there are no legitimate and compelling reasons for the processing. (For the separate right to object, see below).
Right to object to our processing of your personal data.
You have the right to object to the processing of your personal data based on our legitimate interest, with reference to your personal circumstances.
Right to restrict processing.
If you believe that the personal data we process about you is inaccurate, that our processing is unlawful, or that we do not need the information for a specific purpose, you have the right to request that we restrict the processing of that personal data. If you object to our processing as described above, you may also request that we restrict the processing of that personal data while we evaluate your request.
When the processing of your personal data is limited, we will only process it (except for storage) with your consent or for the establishment, exercise, or defense of legal claims, to protect the rights of another natural or legal person, or for reasons related to an important public interest.
Right to rectification.
You have the right to request that we rectify inaccurate information and complete information about you that you consider incomplete.
Right to withdraw your consent.
When we process your personal data based on your consent, you have the right to withdraw that consent at any time. If you do so, we will no longer process your data for the purposes for which you withdrew your consent. However, this does not affect the lawfulness of the processing that was based on your consent before it was withdrawn.
Right to lodge a complaint.
If you have complaints about our processing of your personal data, you can lodge a complaint with the data protection authority in Portugal. You can find their contact details here.
You can also lodge a complaint with your national data protection authority, which you can find in the list here if you are based in the EU. If you are based in the UK, you can lodge a complaint with the Information Commissioner's Office here.
10. Who can I contact to make comments or ask questions?
If you would like to contact us to exercise your rights, or if you have any questions, comments, or concerns about how we process your personal data, you can contact us by sending an email to dpo@nutrium.com.
11. Updates to this Privacy Policy
We update this privacy policy whenever necessary—for example, because we have started processing your personal data in a new way, because we want to make the information even clearer for you, or if it is necessary to do so to comply with applicable data protection laws.
We advise you to check this page regularly for any changes. You can always check the top of this page to see when this privacy policy was last updated.
