Applicant Privacy Notice
How Betalyra handles your personal data when you apply for a role.
Last updated: 16 July 2026 · Version 1.0
When you apply to a role advertised by Betalyra, we process some of your personal data. This notice explains what we collect, why, who we share it with, how long we keep it, and the rights you have. Please read it before applying.
This notice covers applications only. For how we handle data when you simply browse our website, see our Privacy Policy.
Who is responsible for your data
The controller of your personal data is:
Betalyra Sociedade Unipessoal Lda. Avenida General Eduardo Galhardo 115, Edificio Nucase 2775-564 Carcavelos, Portugal NIPC: 516793250
For any question about this notice or your data, contact us at hello@betalyra.com.
An important point about how we recruit
Betalyra recruits both for its own team and on behalf of client companies. For many roles, including this one, we collect and screen applications first, and then share the profiles of shortlisted candidates with the prospective employer (our client) so they can continue the process.
That means:
- If you are shortlisted, your application data (including your CV and the links you provide) will be shared with the client company hiring for this role.
- The client then becomes a controller of your data in its own right, under its own privacy notice.
- We do not name the client in the job advert. We will tell you which company the role is with at the appropriate point in the process, before we share your profile with them.
If you do not want your data shared with the prospective employer, please do not apply, as sharing shortlisted profiles is the purpose of the process.
What data we collect
You apply by email. We do not run an application form, so we only ever hold what you choose to send us:
- Identity and contact details: your name, email address, phone number (if you provide it), and your location or country of residence.
- Professional information: the contents of your CV, work history, education, skills, salary expectations, and your right to work / eligibility for the role.
- Links you share: your GitHub, portfolio, LinkedIn or similar, and the information contained on those pages.
- Application and assessment records: your cover letter or message, any technical task or assessment results, interview notes, and our correspondence with you.
We ask you not to send us special category data (for example information about your health, religion, ethnicity, political opinions, trade-union membership or sexual orientation). We do not need it to assess your application and you should not include it in your CV or messages.
Why we process your data, and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Receiving and assessing your application; communicating with you about it | Taking steps at your request prior to entering a contract — Art. 6(1)(b) |
| Screening and shortlisting candidates, and sharing shortlisted profiles with the prospective employer | Our legitimate interests and the client’s legitimate interests in filling the role — Art. 6(1)(f) |
| Keeping limited records to defend against or respond to legal claims | Our legitimate interests — Art. 6(1)(f) |
Where we rely on legitimate interests, we have balanced those interests against your rights and consider the processing proportionate. You can object at any time (see your rights below).
We do not keep a talent pool. We do not retain your data for future roles, and we do not ask for your consent to do so.
Who we share your data with
- The prospective employer (our client) — for shortlisted candidates, as described above.
- Our internal team — only the people at Betalyra involved in the specific hiring process.
- Service providers acting on our behalf (processors):
- Proton Mail (Proton AG, Switzerland) — hosts our email, and therefore your application and anything you attach to it;
- Proton Meet (Proton AG, Switzerland) — video interviews, where used;
- Microsoft Teams (Microsoft Ireland Operations Limited) — video interviews, where used.
Because applications reach us by email rather than through a form, our website host never receives your application data.
We do not sell your data or use it for advertising.
International transfers
- Proton AG is based in Switzerland, which is outside the EEA. The European Commission has decided that Switzerland provides an adequate level of data protection, so this transfer is covered by an adequacy decision under Art. 45 GDPR and needs no additional safeguards.
- Microsoft contracts with us through Microsoft Ireland Operations Limited. Where Microsoft processes data outside the EEA, the transfer is protected by the EU Standard Contractual Clauses in Microsoft’s data protection addendum, alongside its EU Data Boundary commitments.
You can ask us for more detail using the contact above.
How long we keep your data
- If you are not selected, we keep your application data for 6 months after the process for this role closes, and then delete it.
- If your profile is shared with the client, the client keeps your data under its own retention policy, which is outside our control.
Automated decision-making
We do not make decisions about your application by solely automated means, and we do not use AI to automatically rank, score or reject candidates. A member of our team reviews every application. [Keep this statement accurate: if you ever introduce automated screening, this notice and your legal basis must be updated, and additional obligations under the EU AI Act and GDPR Art. 22 will apply.]
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- ask us to correct inaccurate data;
- ask us to delete your data (right to erasure);
- ask us to restrict or object to our processing, in particular where we rely on legitimate interests;
- receive certain data in a portable format (data portability).
To exercise any of these, email hello@betalyra.com. We will respond within one month.
If you are unhappy with how we handle your data, you can lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt. You may also complain to the supervisory authority in your own EU/EEA country.
Providing your data
Providing your data is not a legal obligation, but we need it to consider you for the role. If you choose not to provide it, we will not be able to process your application.
This notice is a template prepared for review and finalisation with your legal adviser or DPO. It is not legal advice.