Privacy and Cookie Policy
Last updated: 3 September 2026
1. Scope and purpose
This Policy explains how we collect, use, share and protect the personal data of users of Bridgetown's corporate website, and describes the use of cookies and equivalent technologies.
It is prepared in accordance with Regulation (EU) 2016/679 (GDPR), Law no. 58/2019 of 8 August, and Law no. 41/2004 of 18 August, which transposes the ePrivacy Directive.
It applies to the website bridgetown.pt.
2. Data controller
- Corporate name: Bridgetown Talent Agency, Lda
- NIPC (Portuguese corporate tax identification number): 513191976
- Registered office: Jardins do Buzano, Lote 166, Loja B, Buzano, 2785-717 São Domingos de Rana
- Privacy contact: joao@btagency.pt
Part I – Personal data protection
3. Personal data we process
- Contact form: email address and message content;
- Subscription list: email address, communication preferences, record of consent, and history of opens and clicks in communications sent;
- Browsing data: IP address, device identifiers, browser type, operating system, pages visited and traffic source, collected through cookies under Part II;
No special categories of data are processed through the website. Please do not include health data, beliefs or other sensitive data in messages, nor personal data of third parties without lawful grounds to do so.
4. Purposes, legal bases and retention periods
| Purpose | Legal basis | Retention |
|---|---|---|
| Responding to requests submitted through the contact form | Legitimate interest – Article 6(1)(f) GDPR; or pre-contractual steps – Article 6(1)(b), when the contact concerns the conclusion of a contract | For the period necessary to respond and, subsequently, for the legally applicable periods, in particular for the exercise or defence of rights |
| Sending informational and promotional communications to subscribers | Consent – Article 6(1)(a) GDPR and Article 13-A of Law no. 41/2004 | Until consent is withdrawn; evidence of consent retained for 5 years after withdrawal |
| Assessment of applications and unsolicited proposals | Pre-contractual steps and legitimate interest | 1 ano |
| Non-essential cookies and equivalent technologies | Consent – Article 5 of Law no. 41/2004 | See section 13 |
| Website security and prevention of abusive use | Legitimate interest | For the period necessary for the purpose |
| Management of complaints, disputes and exercise of rights | Legitimate interest and legal obligation | Until the expiry of the applicable limitation periods |
Where the legal basis is legitimate interest, the data subject may object to the processing at any time; in the case of direct marketing, the objection will always be honoured without the need for justification.
We collect only the data necessary for each purpose. Optional fields in forms are identified as such, and failure to provide them does not prevent us from responding to the request.
Once the retention periods indicated above have expired, the data are securely deleted or irreversibly anonymised.
5. Commercial communications
As no goods or services are sold through this website, communications are sent exclusively on the basis of prior, freely given, specific, informed and unambiguous consent, expressed through an unticked checkbox that is separate from acceptance of the Terms and Conditions of Use.
All communications include a free and simple mechanism for unsubscribing, processed without undue delay. Consent to receive communications is never a condition for responding to a contact.
6. Recipients and processors
Data may be disclosed to:
- Website hosting and maintenance provider: Push The Button LDA.
- Email marketing platform used for the subscription list – BREVO;
- Audience analytics tools – Google Analytics;
- Email and productivity service providers – Resend Ireland
- Accounting, auditing and legal advisers;
- Public authorities, where there is a legal obligation to disclose the data.
All processors are bound by contract pursuant to Article 28 GDPR and process the data exclusively in accordance with our documented instructions.
Links to social media platforms on the website are simple hyperlinks and do not transmit data to those platforms before being activated by the user.
7. Transfers to third countries
Where processing involves the transfer of personal data outside the European Economic Area, the legally required mechanisms and safeguards under the GDPR will be observed, including an adequacy decision by the European Commission or Standard Contractual Clauses.
8. Data subject rights
Under Articles 15 to 22 GDPR, the data subject has the right to:
- Access their personal data and obtain a copy;
- Request the rectification of inaccurate or incomplete data;
- Request the erasure of data, where applicable;
- Request restriction of processing;
- Object to processing based on legitimate interest and, without restriction, to processing for direct marketing purposes;
- Request data portability for data processed on the basis of consent or contract performance;
- Withdraw consent at any time, without affecting the lawfulness of processing based on consent given prior to its withdrawal.
Requests may be sent to joao@btagency.pt. The data subject may also lodge a complaint with the Portuguese Data Protection Authority (CNPD), Av. D. Carlos I, no. 134, 1st floor, 1200-651 Lisbon – www.cnpd.pt.
9. Security
We adopt technical and organisational measures appropriate to the risk, designed to protect personal data against destruction, loss, alteration, unauthorised disclosure or access, taking into account the nature of the data processed, the context and the purposes of processing.
In the event of a personal data breach, the measures will be taken and notifications made as legally required.
10. Automated decision-making and profiling
No solely automated decisions are made that produce legal effects or similarly significantly affect the data subject.
Part II – Cookies
11. What are cookies
Cookies are small text files that a website places on the user's terminal equipment – computer, tablet or mobile phone – which allow that equipment to be recognised on subsequent visits.
This Part also covers other technologies with an equivalent function, such as tracking pixels, web beacons, local storage, session storage and device identifiers. Whenever this Policy refers to “cookies”, it means all of these technologies.
12. Legal framework and applicable rule
The storage of information on the user's equipment, or access to information already stored on it, is only permitted with prior consent, except where it is strictly necessary to provide a service expressly requested by the user. Legitimate interest is not a valid legal basis for non-essential cookies, including analytics cookies.
13. How we obtain consent
On the first visit, a preference management mechanism is presented that meets the following requirements:
- Prior blocking: no non-essential cookie is installed or read before the user gives consent;
- Equal prominence: the “Accept all” and “Reject all” options are presented at the same level, with the same visual prominence, format and number of clicks;
- Granularity: the user can accept or reject each category separately;
- No pre-selection: no non-essential category is enabled by default;
- Not consent: continuing to browse, scrolling the page, closing the banner or remaining inactive does not constitute consent;
- Reversibility: consent can be withdrawn at any time, as easily as it was given, through the permanent “Cookie Settings” link in the footer;
- Record of evidence: we retain a record of the date, time, version of the text displayed and choices made;
- Renewal: preferences are requested again whenever there are relevant changes.
14. Cookies used
| Name | Category | Purpose | Duration | Owner |
|---|---|---|---|---|
| ga | Analytics | Audience measurement and usage statistics | 12 months |
15. Categories
- Strictly necessary: essential for the operation of the website and for expressly requested services, such as security and form submission. They do not require consent and cannot be disabled;
- Functional: improve the experience by remembering preferences, such as language or region. They require consent;
- Analytics: allow us to understand how the website is used and improve it. They require consent, with no exception for first-party analytics;
- Marketing and advertising: allow campaigns to be measured and personalised content to be presented on and off the website. They require consent.
16. Third-party cookies and transfers
Some cookies may be placed by third parties identified in the table in section 14, acting as independent controllers or joint controllers, and may process data outside the European Economic Area. Such transfers rely on the safeguards described in section 7.
17. How to manage or delete cookies
Preferences can be changed at any time through the “Cookie Settings” link in the footer. Cookies can also be blocked or deleted through browser settings, although blocking strictly necessary cookies may impair the functioning of the website.
Where processing associated with cookies involves personal data, the rights described in section 8 apply, including the right to lodge a complaint with the CNPD.
18. Changes and contacts
This Policy may be updated periodically, and the updated version will be published on this page with an indication of the date of the last update. Part II is reviewed whenever there are changes to the cookies used.
For any questions relating to personal data protection or cookies: joao@btagency.pt
