Last updated: 14 August 2026 · Applies to all iComply services and websites
iComply Portugal (“iComply”, “we”) develops and operates a governance, risk and compliance platform (“Platform” or “Service”) accessible at icomply.pt and on its subdomains and applications. This Privacy Policy explains, in a transparent manner, what personal data we process, for what purposes, on what legal basis, and what rights data subjects have, in accordance with Regulation (EU) 2016/679 (“GDPR”) and other applicable national legislation (Law No. 58/2019).
The data controller for personal data collected via the website and the Platform is Contemporary Constellation Lda, with its registered office at Rua Mouzinho da Silveira, 32, 1250-167 Lisbon, Portugal, company registration number 516 756 583 (“iComply”, “we”, “our”).
This policy applies to: (i) visitors to the corporate website; (ii) registered users of the Platform (customer accounts, customer employees and guests); (iii) participants in webinars, forms and downloadable content; and (iv) candidates in recruitment processes. When we process personal data on behalf of a client, in connection with the use of the Platform to manage their own organisation’s compliance, we act as a data processor under the terms of a Data Processing Agreement (“DPA”) entered into with that client — in which case, it is the client organisation, and not iComply, that determines the purposes and means of the processing, and that organisation’s privacy policy applies to the respective data subjects.
Depending on your relationship with us, we may collect the following categories of data:
| Category | Examples |
|---|---|
| Personal details and contact information: | Name, job title, company, work email address, telephone number |
| Account details: | Login credentials, settings, session history, permissions |
| Usage data: | Interactions with the Platform, audit records, technical logs |
| Device and browsing data: | IP address, browser type, operating system, cookie identifiers |
| Communications: | Support messages, business correspondence, replies to forms |
| Billing details: | Name/organisation to be invoiced, registered address, payment history (card payments are processed by a PCI-DSS-certified service provider) |
| Recruitment: | CV, cover letter, employment history |
We do not intentionally collect special categories of data (Article 9 of the GDPR) via the website. Should the content processed by our clients on the Platform include such data, the safeguards set out in the relevant DPA shall apply.
| Purpose; | Legal basis |
|---|---|
| Creating and managing accounts, providing the contracted service; | performance of the contract (Article 6(1)(b)) |
| Invoicing and compliance with tax obligations | Legal obligation (Article 6(1)(c)) |
| Responding to enquiries, requests for demonstrations and support requests | Legitimate interest / pre-contractual measures (Article 6(1)(b) and (f)) |
| Improving the Platform, security and fraud prevention | Legitimate interest (Article 6(1)(f)) |
| Sending newsletters, content and marketing communications | Consent (Article 6(1)(a)), which may be withdrawn at any time |
| Analytics and marketing cookies | Consent, as per the cookie banner |
We collect data directly from you (registration, forms, contract signing), automatically through your use of the website and the Platform (cookies, server logs) and, occasionally, from public sources or business partners (e.g. B2B databases for prospecting, always on the basis of legitimate interest and with the option to object).
We do not sell personal data. We share data, where necessary, with:
All processors who process personal data on our behalf are bound by a data processing agreement (Article 28 of the GDPR), with confidentiality and security obligations equivalent to our own.
Where a data processor is located outside the European Economic Area, we ensure an adequate level of protection through Standard Contractual Clauses approved by the European Commission, applicable adequacy decisions, or other mechanisms provided for in Chapter V of the GDPR. You may request a copy of the applicable safeguards via the contact details set out in section 13.
We retain personal data only for as long as is necessary for the purposes for which it was collected: account and contractual data, for the duration of the contractual relationship and for a further 10 years after its termination, for the purposes of defending rights and fulfilling tax and accounting obligations (Article 123 of the CIRC); data relating to unsuccessful job applicants, for up to 12 months; marketing data, until consent is withdrawn or after 3 years of inactivity; cookie records, in accordance with the time limits set out in the Cookie Policy.
We implement technical and organisational measures appropriate to the risk, including encryption in transit and at rest, role-based access control, multi-factor authentication, segregation of environments, activity logging and monitoring, periodic penetration tests and incident response plans, in line with the best practices required of a governance, risk and compliance platform.
Under the GDPR, you have the right to: access your data; rectify incorrect or incomplete data; request erasure (‘right to be forgotten’); restrict processing; object to processing, including for direct marketing purposes; request data portability; and withdraw your consent at any time, without affecting the lawfulness of any processing carried out prior to such withdrawal. To exercise these rights, please contact us using the methods set out in section 13; we will respond within one month at the latest, which may be extended by a further two months in particularly complex cases.
O website utiliza cookies próprios e de terceiros para funcionamento essencial, desempenho, personalização e marketing. Detalhes sobre categorias, finalidades, prazos e como gerir as suas preferências encontram-se na nossa Política de Cookies.
Our services are intended for business users and are not aimed at anyone under the age of 18. We do not intentionally collect data from minors.
We may update this policy from time to time to reflect legal, technical or organisational changes. The current version will always be available on this page, with the date of the last update shown. Material changes will be communicated by email or via a prominent notice on the Platform at least 15 days in advance.
If you have any questions regarding this policy or the processing of your personal data, please contact us at [email protected] or in writing at Rua Mouzinho da Silveira, 32, 1250-167 Lisbon, Portugal. You also have the right to lodge a complaint with the National Data Protection Commission (CNPD), whose registered office is at Av. D. Carlos I, 134, 1st floor, 1200-651 Lisbon — www.cnpd.pt.
