Privacy Policy
Last updated: July 2026
Duvalli, Lda., headquartered at Parque Industrial Lusopark, Avenida do Mar, 154, 4520-102 Espargo, Santa Maria da Feira, Portugal, is responsible for processing personal data collected through this website. This policy describes what data we collect, how we use it, and your rights as a data subject.
Data We Collect
We collect personal data only when voluntarily provided to us, namely: (a) through direct email contact at info@duvalli.com — name, email address and any other information included in the message; (b) through the job application form — name, contact details, address, curriculum vitae and any documents the applicant chooses to submit; (c) through the catalogue access form, if the user chooses to complete it in order to view the online catalogue — contact name, company name and tax ID (NIF), email address and telephone number.
Purpose and Legal Basis
Data collected by email is processed on the basis of legitimate interest (Art. 6(1)(f) GDPR) to respond to your requests. Application data is processed on the basis of legitimate interest for recruitment purposes. Data from the catalogue access form is processed on the basis of legitimate interest (Art. 6(1)(f) GDPR), in order to handle the catalogue access request within a business-to-business relationship. Contact by our sales team only takes place with your prior, explicit consent (Art. 6(1)(a) GDPR), given through the dedicated option in the form; this consent may be withdrawn at any time by email to info@duvalli.com, without affecting the lawfulness of processing carried out beforehand.
Data Processors
Duvalli uses the following processors: Google LLC, within the Google Workspace service, for hosting the application form and storing submitted data — acting as a processor under a Data Processing Agreement (DPA) in accordance with Art. 28 GDPR. The reporting portal is operated by Workky (workky.com), which acts as an independent data controller for data submitted therein.
Retention Period
Job application data is retained for a maximum period of 6 (six) months from the date of submission, after which it is deleted. Email contact data is retained for a maximum period of 6 (six) months after the conclusion of the communication. Data submitted through the catalogue access form is retained for a maximum period of 6 (six) months from submission, after which it is deleted.
International Transfers
Google LLC may process data on servers located outside the European Economic Area, namely in the United States. Google is certified under the EU-U.S. Data Privacy Framework, which benefits from a European Commission adequacy decision, and additionally applies the Standard Contractual Clauses approved by the European Commission as a further safeguard, in order to ensure an adequate level of protection for the transferred data.
Cookies
This website uses only preference cookies stored locally on your device (localStorage) to save your language choice and consent status. We do not use tracking, advertising or behavioural analytics cookies.
Your Rights
Under the GDPR, you have the right to: access your personal data; request rectification of inaccurate data; request deletion of your data; object to processing based on legitimate interest; withdraw, at any time, consent previously given for commercial contact; and request restriction of processing. To exercise these rights, contact us at info@duvalli.com. You also have the right to lodge a complaint with the competent supervisory authority: CNPD — Comissão Nacional de Proteção de Dados (www.cnpd.pt).
Contact
For any questions regarding the protection of your personal data, contact Duvalli at info@duvalli.com or by post to Parque Industrial Lusopark, Avenida do Mar, 154, 4520-102 Espargo, Santa Maria da Feira, Portugal.