Privacy Policy

Empower You Consulting respects the privacy of the people with whom it interacts. This policy explains how personal data collected through the website and in the context of training, coaching and development, business consulting and management, marketing and communication, recruitment and event services are processed.

1. Who is responsible for processing the data

Empower You Consulting is the trading name of ACMM - Consultoria e Gestão de Negócios, Unipessoal Lda., tax identification number 513181350, with its registered office at Rua José Ricardo Samora de Barros, Condomínio Lux Garden, Lote 5, Edifício E, 6.º B, 8005-143 Faro, Portugal.

ACMM is the controller when it determines the purposes and means of using the data. In certain projects carried out for client companies, EYC may process data on behalf of those companies and in accordance with their instructions. The role of each entity depends on the service and is defined for the project in question.

For questions about data protection, you can contact us at info@empower-y.com.

2. What personal data we process

The data processed depend on how each person interacts with us:

• Contact through the website — name, email, telephone number when provided, subject, message and technical data associated with submitting and securing the form, including IP address, site language and the dates of the request and acceptance of this policy in the form.
• Emails received — the sender’s address and information included in the message and attachments.
• Clients, suppliers and partners — identification and contact details of representatives and contact persons, as well as data necessary to prepare proposals and manage the contractual relationship.
• Training — identification and contact details of trainees, data necessary for enrolment and issuing certificates, attendance records, assessments and learning outcomes.
• Coaching and development — identification and contact details of participants, information necessary for ongoing support, responses to and results of behavioural assessment tools, such as DISC, and information included in individual reports.
• Events — data necessary for registration and organisation, as well as photographs and videos taken during events.
• Marketing and communication — data made available in client companies’ databases and contact details provided by individuals through forms, advertisements and other campaign-related activities.
• Social media management — access details for social media accounts and pages provided by some clients, including credentials or administration permissions, when necessary to manage the respective channels.
• Recruitment — data included in CVs, applications and communications relating to the selection process.
• Website — technical data necessary for its operation and security and, if statistics cookies are accepted, data relating to use of the site.

Data may be provided directly by the data subject, by a company engaging our services or through a form associated with a campaign. Where data are not obtained directly from the data subject, the information required by law is provided in accordance with the applicable provisions.

The general contact form is not intended to collect health data or other special categories of data. Please do not include such information in your message. Any processing of such data within a specific service requires a separate assessment of its necessity and the applicable legal conditions.

3. Purposes and legal bases for processing

Contacts, proposals and business relationships

We use data received through the website or by email to respond to requests, provide information and prepare proposals. Depending on the nature of the contact, the legal basis may be taking steps prior to entering into a contract at the request of the person concerned or a legitimate interest in managing professional contacts.

We process the data necessary to provide services, communicate with clients and suppliers, issue invoices and comply with legal obligations. The applicable legal bases may include performance of a contract, compliance with legal obligations and a legitimate interest in managing the professional relationship.

Vocational training

We process trainees’ data to manage enrolments, deliver training, record attendance and results, issue certificates and comply with applicable administrative and legal requirements. Depending on the circumstances, this processing is based on performance of the contract, compliance with legal obligations or a legitimate interest in organising the contracted training.

Coaching and development

We process participants’ data to conduct sessions, administer behavioural assessment tools, provide ongoing support for programmes and prepare the envisaged reports. The applicable legal basis depends on how the programme is organised and on the relationship established with the participant and the contracting entity. Any disclosure of individual results to the contracting company is limited in scope and communicated to the participant before sharing takes place.

Events

We process participants’ data to manage registrations, communications and matters necessary for organising events. We may take photographs and videos; the use of images for publicity is handled in accordance with the specific purpose, the applicable legal basis and the image rights of the people involved.

Marketing, communication and digital campaigns

As part of the services provided to clients, we process databases supplied by them and collect new contact details through the campaigns we manage. These campaigns may run through Google Ads, TikTok Ads and LinkedIn Ads, using forms on the platforms themselves or on pages to which the advertisements direct interested individuals.

When managing clients’ social media, we use the access granted solely to administer the channels and carry out the tasks agreed with each client.

For each campaign, the information provided at the point of collection identifies the data controller, the purposes of collection and where the contact details will go. When a campaign is carried out for a client company, subsequent use of the data follows the framework established for that campaign. Sending electronic direct marketing communications is subject to the applicable legal requirements, including those relating to consent and objection.

Data provided in the website’s general contact form are not used to send advertising or newsletters merely because a request for information has been made.

Recruitment

We process candidates’ data to receive and assess applications, contact interested individuals and conduct selection processes. When recruitment is carried out for a client company, the candidate is informed of the involvement of the entities concerned and of any disclosure of the application to the contracting company.

Website security and statistics

We process the technical data necessary for website security and preventing misuse of the form on the basis of our legitimate interest. We use Google Analytics to measure use of the site only when the visitor accepts statistics cookies, on the basis of their consent.

4. Confidentiality in coaching

Responses to assessment tools, results, individual reports and information shared during the ongoing support are accessed only by those who need them to deliver the programme.

A company’s engagement of the programme does not mean that all session content is disclosed to it. Before an individual report or result is shared with the contracting entity, the participant is informed of the content, recipients and purpose of that sharing. The information disclosed is limited to what is necessary for the stated purpose.

5. Photographs and videos at events

Participants are informed about photographs or videos being taken and about any use of the images on the website, on social media or in other communication channels. Documenting an event and using images for promotional purposes are distinct purposes.

Where a specific use requires individual authorisation, that authorisation is obtained before publication. This policy does not replace the information or authorisation necessary for using the image of an identifiable person.

6. Recipients and external platforms

To the extent necessary for each purpose, data may be accessed by or disclosed to the team and professionals delivering the services; client companies under the terms defined for each project; entities and platforms involved in managing and certifying training; and suppliers involved in organising events.

We may use website and email hosting providers, external platforms for data storage and processing, and the advertising platforms Google Ads, TikTok Ads and LinkedIn Ads in campaigns involving them. Google Analytics processes website usage data when the relevant statistics cookies are accepted. We may also disclose data to authorities where required by law.

The role of each platform and access to data depend on the features used. When a provider processes data on our behalf, the relationship is governed by the applicable data protection obligations. The use of external platforms may involve transfers outside the European Economic Area; in such situations, the safeguards legally required for the specific processing are applied.

7. Retention periods

We retain data for the period necessary for the purposes for which they were collected, taking into account legal obligations, applicable contracts and, where necessary, the exercise or defence of rights.

• Requests received through the website — up to 24 months after the last contact. If a request leads to a contractual relationship, the relevant periods for that relationship and its associated documents apply.
• Cookie preferences — 6 months in the browser.
• Google Analytics statistics — for the period configured in the relevant account, which may be 2 or 14 months.
• Training, coaching, events, recruitment and campaigns — for the time necessary for their respective purposes and applicable obligations. For services provided on behalf of clients, the contractually defined instructions on retention and deletion are also followed.

The availability of contact details in Google Ads, TikTok Ads and LinkedIn Ads accounts is subject to the terms of the features used on each platform. Data exported from these platforms are subject to the retention criteria of the entity responsible for the campaign.

8. Your rights

Under the terms and within the limits provided for by law, you may request access to your data, their rectification or erasure, restriction of processing and data portability. You may object to processing where that right applies, including the use of your data for direct marketing.

If processing relies on your consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out previously. To change your cookie preferences, use the “Cookie settings” option in the website footer.

To exercise your rights, write to info@empower-y.com. We respond within the time limits set by the GDPR, generally within one month. When we process data on behalf of a client company, we coordinate the request with the data controller.

You may also lodge a complaint with the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados) at www.cnpd.pt.

9. Cookies and measurement technologies

The website uses cookies necessary for its operation and, subject to consent, statistics cookies associated with Google Analytics. The full list, purposes and duration of the cookies can be found in the Cookie Policy. You may change your preferences in “Cookie settings” in the site footer.

Campaigns run on Google Ads, TikTok Ads and LinkedIn Ads may use forms and mechanisms specific to those platforms. Any use of pixels, tags or other advertising technologies on the website is described in the Cookie Policy and presented in the consent options, where applicable.

10. Security

We adopt appropriate technical and organisational measures to protect data against improper access, loss, alteration or unauthorised disclosure. The website uses an encrypted HTTPS connection, the form has protection against automated submissions, and access to requests received is limited to password-protected personal accounts.

Access to clients’ social media accounts is reserved for the professionals involved in managing them, within the permissions granted by the client. Use of that access is limited to providing the contracted service.

11. Minors

The website is intended primarily for businesses and professionals and was not designed to intentionally collect data from minors under the age of 16 through the general form. If we become aware of improper collection, we will assess the situation and take the necessary measures. Where an activity involves minors, the necessary information and authorisations are handled specifically for that activity.

12. Links to other websites

The website may contain links to social media and third-party websites. Data processing carried out in those services is governed by their respective privacy policies.

13. Changes to this policy

This policy may be updated to reflect changes in our services, the tools used or legal requirements. The date of the version in force is indicated at the beginning of this page.