Pursuant to Regulation (EU) 2016/679 of 27 April – General Data Protection Regulation (hereinafter referred to as the GDPR), Law No. 58/2019 of 8 August and Regulation (EU) 2024/1689 of 13 June – Artificial Intelligence Regulation (AI Act), this Privacy and Data Protection Policy aims to establish and provide information on all the rules for the collection and processing of the personal data provided to Shaken Academy by the respective Data Subjects, within the scope of its training programmes (hereinafter referred to as the “Programme”, a term covering any training programme developed and delivered by the Company, namely AI Dive for Business and MBAI), describing, for this purpose, all the conditions, guidelines and internal procedures adopted by the Company in the process of collecting and processing personal data.
The concepts defined in Article 4 GDPR are used in this Privacy and Data Protection Policy (hereinafter referred to as the Policy) and have the same meaning as is attributed to them in that regulation.
1. IDENTIFICATION OF THE CONTROLLER OF PERSONAL DATA AND SCOPE OF APPLICATION
1.1 Shaken Academy, Unipessoal Lda., NIPC 519.187.261, with registered office at Avenida Infante Dom Henrique n.º 143 – Piso 1, 1950-406 Lisboa and with the email address dpa@shakenacademy.pt (hereinafter referred to as the Company) is the entity responsible for the collection and processing of the personal data provided by the respective Data Subjects, for the purposes set out in section 2 of this Policy. For the purposes of this Policy, unless otherwise indicated, the expression User/Users refers to the Data Subject of the personal data.
1.2 This Privacy and Data Protection Policy applies to all personal data collected by the Company through the contact, pre-registration, registration and feedback forms, and any other forms used by it, regardless of whether they are made available on the websites and landing pages operated by it, on domains operated by other entities of the group of which the Company forms part or on third-party platforms engaged by it for that purpose, as well as through email and other communication channels, through the video surveillance systems of its premises, and to the data of participants communicated to it by the client entities that contract the Programme for their employees, and is intended to inform the User, under and for the purposes of Articles 13 and 14 GDPR.
1.3 Users must read this Privacy and Data Protection Policy carefully and decide freely whether they wish to provide their personal data to the Company, prior to sending them.
1.4 Any personal data provided or sent without the conditions of this Policy and/or any provision of the applicable European and national legislation having been met shall be immediately erased by the Company.
1.5 The User declares that the data provided to the Company are true, accurate, complete and up to date, being responsible for any non-conformity that may arise, and the Company may periodically request the review and updating of the personal data collected and processed, in order to keep them accurate and up to date.
1.6 In editions of the Programme contracted by client entities for their employees, the Company acts as an independent controller of the participants’ personal data, determining the purposes and means of the processing operations described in this Policy. The client entity is the controller with regard to the selection of the participants and the communication of their personal data to the Company, and it is incumbent upon it to ensure that it has a lawful basis for such communication.
2. PERSONAL DATA COLLECTED, PURPOSES AND LEGAL BASIS FOR PROCESSING
2.1 Users are natural persons, members of the general public, of legal age, who provide, directly or indirectly, their personal data under the terms of and in accordance with the purposes described in the following clauses.
2.2 The Company only collects and processes personal data that are adequate, relevant and limited to what is necessary to pursue its purposes, in accordance with the principles of Article 5 GDPR.
2.3 Personal data whose processing is necessary for compliance with contractual and legal obligations are processed, respectively, on the basis of Art. 6(1)(b) and (c) GDPR, without prejudice to the rights provided for in section 6 of this Policy.
2.4 Depending on the purpose in question, personal data are processed on the following legal bases:
- Consent of the Data Subject;
- Necessity of the data for compliance with legal obligations by the Company;
- Necessity of the data for the formalisation of pre-registration and registration in the Programme and the management of participation;
- Necessity of the data for the purposes of the legitimate interests of the Company, provided that the interests or fundamental rights or freedoms of the Data Subject do not prevail.
2.5 The Company may collect and process the following personal data:
- Identification data: Full name, Date of birth, Gender, Type, number and expiry date of the identification document (Citizen Card, Passport or equivalent), Tax Identification Number, Nationality and Place of birth;
- Contact data: Electronic mail address (e-mail), Address and Mobile Phone Number;
- Payment and billing data: Name or company name for billing, NIF/NIPC, tax residence and record of transactions;
- Professional and academic data: Employer, role, professional area and educational qualifications;
- Participation and training data: attendance and punctuality records contained in the signed attendance sheets, elements of the continuous assessment and of the Final Project, responses to feedback and satisfaction questionnaires and incident records;
- Browsing data: Cookies that require the User’s consent;
- Image data: Photograph, video and sound;
2.6 The personal data collected by the Company are processed in accordance with the following purposes:
| No. | PURPOSE | DESCRIPTION OF THE PURPOSE | CATEGORIES OF PERSONAL DATA |
|---|---|---|---|
| 1 | Management of contact and information requests | Responding to contact requests, requests for information or other communications sent through websites, landing pages, forms or other official channels of the Company or operated by it. | Identification data and contact data - Art. 6(1)(f) GDPR |
| 2 | Management of the pre-registration and registration processes | Managing the pre-registration and registration processes for the Programme, including the validation of the data submitted, the administrative organisation of the processes, payment and billing, communication with the participants and, where applicable, with the client entities that register them. | Identification data and contact data - Art. 6(1)(b) GDPR; Professional and academic data and billing data - Art. 6(1)(b) and (c) GDPR |
| 3 | Organisation of participation in the Programme | Organising and managing participation in the Programme, including the formation of groups and teams, schedules, sessions, activities, the provision of access to the tools used, the recording of attendance and other operational aspects related to its attendance. | Identification data and contact data - Art. 6(1)(b) GDPR; Professional and academic data - Art. 6(1)(b) GDPR; Participation and training data - Art. 6(1)(b) GDPR; |
| 4 | Management of the participants' training experience | Monitoring the participants' training experience, preparing and adapting content, activities and methodologies, collecting and analysing the feedback and satisfaction questionnaires, and ensuring appropriate participation in the Programme. | Identification data - Art. 6(1)(b) GDPR; Professional and academic data - Art. 6(1)(b) GDPR; Participation and training data - Art. 6(1)(b) GDPR; |
| 5 | Incident management | Recording and monitoring incidents of non-compliance with the Programme Regulations and with the guidelines of the training team and the measures adopted, including possible exclusion from the Programme and, where applicable, communication to the client entity. | Identification data and contact data - Art. 6(1)(b) GDPR; Participation and training data - Art. 6(1)(f) GDPR; |
| 6 | Communication with emergency or medical assistance entities | Informing the entities responsible for the coordination and provision of emergency medical care in the event of an accident, mishap or other situation that may affect the health or safety of the registered participant. | Identification data and contact data - Art. 6(1)(b) and (d) GDPR; |
| 7 | Management of insurance and claims | Reporting, monitoring and managing claims under the personal accident insurance policies taken out by the Company. | Identification data and contact data - Art. 6(1)(b) GDPR; |
| 8 | Institutional and operational communication | Communicating with participants, client entities and other interested parties, including sending instructions, materials, certificates and relevant information about the Programme, operational changes or other matters related to the Company. | Identification data and contact data - Art. 6(1)(b) GDPR; |
| 9 | Sending of newsletters and invitations and dissemination of group initiatives | Sending communications, newsletters and invitations and disseminating activities, initiatives, events, programmes and campaigns organised or promoted by the Company and by the other entities of the group of which it forms part, namely Associação Topsail, Associação 101010 Portugal, Shaken Not Stirred, Lda. and Shaken Not Stirred Ventures Spain, S.L., as well as by the brands through which they operate, namely TUMO Portugal, 42 Portugal, Shaken Academy and Shaken Futures. The User may, at any time and free of charge, withdraw consent or object to these communications, through the link provided in each communication or through the contacts indicated in section 11. | Identification data and contact data - Art. 6(1)(a) GDPR; |
| 10 | Compliance with legal, contractual or regulatory obligations | Complying with the legal, contractual or regulatory obligations applicable to the Company (namely tax and accounting obligations, insurance obligations, the issuance and registration of professional training certificates on the SIGO platform, pursuant to Ordinance No. 474/2010 of 8 July, and responding to requests from public authorities), as well as organising and keeping the technical-pedagogical file of each training course and demonstrating the compliance of the training activity before the certification body. | Identification data and contact data - Art. 6(1)(b), (c) and (f) GDPR; Other necessary categories of data, depending on the applicable obligation - Art. 6(1)(b), (c) and (f) GDPR; |
| 11 | Production of statistical information, reports and impact analysis | Producing statistical information, activity reports, internal studies, impact assessment and continuous improvement of the Programme, using aggregated, anonymised or pseudonymised data. | Identification data and contact data - Art. 6(1)(f) Professional and academic data and participation and training data - Art. 6(1)(f) GDPR; Browsing data - under the Cookie Policy; These data will be processed in aggregated or pseudonymised form, the legal bases for their processing being compatible for statistical purposes, pursuant to Art. 5(1)(b) GDPR. |
| 12 | Management of website browsing and cookies | Ensuring the operation of the websites, analysing their use and performance, providing additional functionalities and managing browsing preferences, under the Company's Cookie Policy. | Browsing data and cookies: - Art. 6(1)(a) GDPR, except for strictly necessary cookies - Art. 6(1)(b) and (f) GDPR; |
| 13 | Use of images | Capturing, using, reproducing, editing, archiving and disseminating images, videos and sounds of the Users, for promotional, advertising and educational purposes relating to the activities, initiatives and events of the Company, under the Image Rights Policy. | Image data — Art. 6(1)(a) GDPR; |
| 14 | Video surveillance of the Company's premises | Ensuring the safety and protection of persons and property on the Company's premises, by means of a video surveillance system (CCTV), pursuant to Law No. 34/2013 of 16 May. | Image data — Art. 6(1)(f) GDPR and Art. 19 of Law No. 58/2019 of 8 August. |
2.7 The payment data collected in the context of individual registration in the Programme are processed exclusively for the purposes of making the payment, issuing the respective invoice-receipt and complying with the applicable legal obligations.
2.8 The Company does not keep, nor store in any database or on its servers, any card data or bank credentials. These data are entered directly on the payment page of the entity responsible for their processing - Stripe (Stripe Payments Europe, Ltd.), which processes them as an independent controller, under its own privacy policy.
2.9 The available means of payment are Visa, Mastercard and Discover cards and Google Pay, and may vary depending on the User’s device and country.
3. CONSENT
3.1 The personal data provided through the contact, pre-registration, registration or feedback forms, or through any other form owned by the Company, whose processing is based on consent, as identified in clause 2.6, will only be collected and processed with the free, specific, informed and unambiguous consent of the User.
3.2 Authorisation for the collection and processing of personal data may be expressed in writing or through the selection of options in the contact, pre-registration, registration or assessment forms or in any other form owned by the Company.
3.3 The Company does not intentionally collect personal data from persons under 18 years of age, the Programme being intended exclusively for persons of legal age.
3.4 Consent may be changed or withdrawn at any time by the User, with effect for the future. To do so, it is sufficient to send an email to dpa@shakenacademy.pt, indicating the consent(s) that the User wishes to change or withdraw.
3.5 Following the withdrawal of consent, the Company ceases the processing of the personal data collected exclusively on the basis of consent and, within 30 days of receipt of the communication referred to in the previous clause, erases them. The processing of personal data collected on the basis of another ground provided for in Art. 6 GDPR – namely the performance of the registration contract or compliance with legal obligations – remains in effect for the periods indicated in section 4.
3.6 Refusal or withdrawal of consent does not affect attendance of the Programme. In cases where the provision of certain data is a necessary condition for the performance of the service provision contract, as identified in clause 2.6, failure to provide them makes it impossible to formalise or maintain the registration, not by reason of refusal of consent, but due to the objective impossibility of providing the service.
The User acknowledges that certain programmes or activities depend, by their nature, on the provision of certain data by the participants, and the Company may not carry them out if the conditions necessary for their execution are not met.
4. RETENTION PERIOD
4.1 The personal data collected by the Company are kept only for the period necessary to fulfil the purposes for which they were collected, the Company having defined, without prejudice to legal obligations requiring a shorter or longer period, the following retention periods.
4.2 The periods indicated in the following table derive from the purposes and grounds identified in clause 2.6, from the different nature of the risk associated with each type of data and from legal requirements, where applicable.
4.3 The period of 5 (five) years applicable to identification, contact, professional and participation data corresponds to the recommendation addressed by the Direção-Geral do Emprego e das Relações de Trabalho (Directorate-General for Employment and Labour Relations – DGERT) to certified training providers regarding the retention of training records and documentary evidence, and is based on the Company’s legitimate interest in demonstrating the compliance of its training activity in monitoring, audit or certification renewal procedures, being extended until the conclusion of any such procedure concerning the edition in question. The issuance and registration of professional training certificates are carried out on the SIGO platform, pursuant to Ordinance No. 474/2010 of 8 July, this being the means by which the participants’ access to duplicate copies of their respective certificates is ensured.
| CATEGORY | TYPES OF DATA | RETENTION PERIOD |
|---|---|---|
| Identification data | Full name | Until 5 years have elapsed after the end of the Programme; |
| Date of birth | Until 5 years have elapsed after the end of the Programme; | |
| Type, no. and expiry date of the identification document | Until 5 years have elapsed after the end of the Programme; | |
| Tax Identification No. | Up to 10 years after the issuance of the last tax document, where applicable (tax obligation); in all other cases, up to 13 months after the end of the relationship with the Company; | |
| Nationality and Place of birth | Until 5 years have elapsed after the end of the Programme; | |
| Gender | Until 5 years have elapsed after the end of the Programme; | |
| Contact data | Full name | Until 5 years have elapsed after the end of the Programme; |
| Electronic mail address - e-mail | Until 5 years have elapsed after the end of the Programme; | |
| Address | Until 5 years have elapsed after the end of the Programme; | |
| Mobile phone no. | Until 5 years have elapsed after the end of the Programme; | |
| Professional and academic data | Employer, role and professional area | Until 5 years have elapsed after the end of the Programme; |
| Educational qualifications | Until 5 years have elapsed after the end of the Programme; | |
| Participation and training data | Attendance records, assessment elements, feedback and satisfaction questionnaires and incident records | Until 5 years have elapsed after the end of the Programme; |
| Image data | Image, video and sound used by the Company | Until 8 years have elapsed from the date of capture; |
| Image and video - Video surveillance | 30 days; | |
| Identification and contact data — contact requests | Name, email address, mobile phone no. and content of the request | Up to 2 years from the response to the request or from the User's last contact, unless the request gives rise to pre-registration or registration, in which case the periods provided for the other categories apply; |
| Record of consents | Record of the authorisations given in the forms and in the cookie management panel (date, version of the applicable document and option chosen) | Up to 5 years from the withdrawal of consent or the end of the relationship with the Company, as proof of compliance with Art. 7(1) GDPR; |
| Browsing data | Cookies and online identifiers | Under the terms and within the periods indicated in the Cookie Policy; |
4.4 Upon expiry of the periods indicated and, except in compliance with a legal or contractual obligation to which it is bound, the Company shall anonymise, pseudonymise or erase the personal data securely.
4.5 The data processed for statistical purposes are anonymised as soon as the statistical operation so permits and, in any case, at the end of the periods indicated in clause 4.1. Thereafter, they are only kept in aggregated and anonymised form, not allowing the identification of the Data Subjects and, in turn, they cease to fall within the category of personal data. While pseudonymised, the data retain the nature of personal data and benefit from the security measures of section 7.
4.6 The retention periods identified above derive from the different nature of the risk associated with each type of data and from the Company’s need to maintain their processing, in accordance with the purposes and grounds referred to in clause 2.6 of this Policy, and from legal requirements, where applicable.
5. USE OF ARTIFICIAL INTELLIGENCE TOOLS
5.1 Attendance of the Programme may involve access to and use of artificial intelligence tools (hereinafter referred to as AI) developed and made available by external providers, the use of which is governed by their respective terms of use and privacy policies, those providers acting as independent controllers of the data entered into them.
5.2 The tools used in the Programme are communicated to the participants at the start of each training course and made available through accounts created by the User or through licences whose cost is borne by the Company, the account being, in both cases, individually held by the User.
5.3 The Company does not request, does not collect and does not have access to the personal data and other information that the User enters into those tools, their use being carried out freely and autonomously by the User.
5.4 The Company warns that the tools referred to in the preceding clauses allow the User to enter information on their own initiative, and it is therefore expressly recommended that no personal data of the User or of third parties, nor confidential information, namely of the User’s employer, be entered, the information that the User decides to enter being the sole responsibility of the User.
5.5 The Company does not determine the purposes or the means of the processing carried out by those tools, and does not assume the role of controller with regard to the data entered into them on the User’s initiative.
5.6 The results, assessments or comments that the AI tools generate on the work and challenges carried out within the scope of the Programme, when requested by the User, are produced by the tool itself and are not used by the Company to assess the User or to decide on the issuance of the training certificate.
6. USERS’ RIGHTS
6.1 The Company guarantees the defence of all the rights of Users relating to the protection of their personal data, in accordance with the legislation in force.
6.2 Under the legislation governing the processing of personal data, Users have the right to request from the Company access to the personal data concerning them, their rectification, their erasure, restriction of processing, objection to processing, the right to data portability, the right not to be subject to decisions based solely on automated processing under Article 22 GDPR, and the right to withdraw, at any time, the consents given, in accordance with clause 3.4 of this Policy.
6.3 Pursuant to the preceding clause, Users’ rights must be exercised through the following email address: dpa@shakenacademy.pt. The Company responds to requests within one month of their receipt, extendable by two months where the complexity or number of requests so justifies, informing the User of such extension.
6.4 In the aforementioned contact, Users must, in any case, send a copy of a document proving their identity (avoiding, if possible, sending a copy of the citizen card), specifying the right or rights they wish to exercise.
6.5 The User has the right to lodge complaints with the supervisory authority (Comissão Nacional de Proteção de Dados (Portuguese Data Protection Authority) - https://www.cnpd.pt/), when dissatisfied with the way in which their personal data are processed.
7. SECURITY
7.1 The Company declares that it has implemented and will continue to implement the technical and organisational security measures necessary to ensure the security of the personal data provided to it, with a view to preventing their alteration, loss, processing and/or unauthorised access, taking into account the current state of technology, the nature of the data stored and the risks to which they are exposed.
7.2 Users’ personal data are processed with the legally required level of protection to ensure their security and to prevent their alteration, loss, processing or unauthorised access, taking into account the state of technology.
7.3 Pursuant to the preceding clauses, the Company establishes the following security and protection measures for the personal data it processes: the pseudonymisation, anonymisation and encryption of data that allow the User to be identified, the control and restriction of access to storage databases, the immediate erasure of data that are not used and the setting of retention periods for the data collected for the strictly necessary period.
7.4 Without prejudice to the provisions of the preceding clauses, the Company informs the User that the transmission of data over the Internet entails risks that are not entirely under its control, and it therefore cannot absolutely guarantee the security of the data during their transmission to its systems. This warning does not set aside the security measures referred to in clauses 7.1 to 7.3, nor the Company’s liability under the law.
8. COMMUNICATION AND TRANSFER OF DATA TO THIRD PARTIES
8.1 The Company undertakes to adopt the necessary and appropriate measures to ensure that any personal data that may be transferred are processed in accordance with appropriate security measures, without compromising the level of protection of natural persons guaranteed by the legislation in force.
8.2 The Company may use third parties, located within or outside the European Economic Area (EEA), for the provision of certain services, within the purposes described above, which may involve access by such entities to the personal data processed. These third parties include, namely, the following categories: hosting, email and online form providers, the payment service provider (Stripe), the electronic signature service provider used for the conclusion and archiving of training contracts, the insurance company with which the personal accident insurance was taken out, where applicable, the providers of the artificial intelligence tools whose licences are borne by the Company, referred to in section 5, providers of browsing statistical analysis services, the client entity that contracted the User’s participation in the Programme and public authorities, including DGERT, when legally required.
8.3 Where the User has given the consent provided for in purpose 9 of clause 2.6, their identification and contact data are communicated to the other entities of the group of which the Company forms part, identified above, exclusively for the purpose described therein. Each of those entities acts, with regard to such processing, as an independent controller, being subject to the obligations incumbent upon it under the GDPR, and the withdrawal of consent with any of them is communicated to the others.
8.4 When using third parties, the Company undertakes to adopt the necessary and appropriate measures to ensure that such entities offer high guarantees in the processing of Users’ personal data, which shall be duly enshrined and safeguarded in a written contract to be entered into between the Company and the third-party entity(ies).
8.5 Whenever the third parties are located outside the EEA, the transfer takes place on the basis of an adequacy decision of the European Commission concerning the country of destination or, in the absence thereof, by means of standard contractual clauses approved by the European Commission (Article 46 GDPR) or another mechanism provided for in Chapter V GDPR, and the User may request information on the applicable safeguards through the contact dpa@shakenacademy.pt.
8.6 Without prejudice to the provisions of the preceding paragraphs, the Company informs the User that it is not liable for acts carried out by third parties that are unlawful and that breach the security measures imposed by the Company and subscribed to by them, or that violate the data protection agreements and contracts entered into between the Company and third parties, to the fullest extent permitted by applicable law.
9. COOKIES
9.1 Cookies are files or text files containing small amounts of information that are downloaded and stored on the User’s device, through their browser, when they visit a website.
9.2 The use of cookies on the websites operated by the Company – including the identification of the cookies used, their respective purposes, the retention periods and the means of managing or withdrawing consent – is governed by the Cookie Policy, available on the websites operated by the Company.
9.3 Cookies that are not strictly necessary are only installed on the User’s device after prior, free, specific, informed and unambiguous consent, given through the cookie management panel presented on first access to the website. The User may accept or refuse the installation of these cookies, retaining, in any case, full access to the website.
10. AMENDMENTS TO THE PRIVACY POLICY
10.1 The Company reserves the right, at any time, to adjust or amend this Policy, the amendments being duly published on the respective websites.
10.2 The updated Policy is available on the websites operated by the Company and on any that may be created.
11. COMMUNICATIONS BETWEEN THE COMPANY AND USERS
11.1 For further information or questions about the Shaken Academy Privacy and Data Protection Policy, Users and the general public may contact its services by the following means: sending an email to dpa@shakenacademy.pt or communication by post to Shaken Academy, Unipessoal Lda., Avenida Infante Dom Henrique n.º 143, Piso 1, 1950-406 Lisboa.
11.2 Users undertake to keep their mobile phone and email contacts up to date, and must immediately inform the Company of any change to them.
The version of the Privacy and Data Protection Policy currently in force was published on 14 October 2026.