|English · Português · Español

Privacy Policy

Date: February 2026

1. Introduction

This Privacy Policy aims to inform data subjects about how we process the personal data we collect from users of this website, from beneficiaries of its EAP (Employee Assistance Programs) services, and from other data subjects who interact with us or with our services.

The protection of your personal data is a priority for us. Therefore, with this policy we intend to help data subjects understand what personal data is collected, how and why it is used, to whom it is disclosed, and how their privacy is protected, in strict compliance with applicable legislation, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 ("General Data Protection Regulation" or "GDPR").

2. Data Controller

Pulso - Europe Portugal, Lda. (hereinafter "Pulso") is the entity responsible for the processing of personal data associated with its activity of providing employee assistance services.

3. Personal Data Processed

Personal data means any information, of any nature, relating to an identified or identifiable natural person (data subject). A person who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to their physical, physiological, psychological, economic, cultural or social identity is considered identifiable.

In the course of our activity, we may process the following personal data, as necessary and applicable, namely:

  • Identification data (e.g. name, date of birth, gender and country);
  • Contact data (e.g. email and mobile number);
  • Professional data (namely, employer entity and employee number);
  • Health and well-being data (depending on the support services requested by the data subject, may include information on psychological well-being);
  • Family-related data (depending on the support services requested, may include information on the household or pets);
  • Tax and financial information (depending on the support services requested, may include general information on the economic situation that the data subject wishes to share);
  • Other types of data (depending on the support services requested, may include information on legal proceedings);
  • Navigation data (such as IP address, device, operating system, language, country and pages visited).

The identification of employees who can benefit from employee assistance services is provided by their employer. Subsequently, only the data necessary for the provision of the support services requested by the data subject will be collected from the data subjects.

4. Purposes and Lawfulness of Processing

We will only process your personal data for specific and legitimate purposes, determined at the time of collection, and such data will not be processed for other purposes, except for archiving in the public interest, scientific or historical research, or for statistical purposes, in which cases, under the GDPR, there is no incompatibility with the initially defined purposes.

In the course of our activity, we collect the data necessary for the management and development of campaigns. In particular, your personal data may be processed for the following purposes:

  • Provision of services under employee assistance programs;
  • Response and management of contacts and requests and subsequent relevant communication;
  • Development of anonymised statistical analyses of the services we provide;
  • Maintenance, optimisation and personalisation of website navigation.

We process your personal data only in accordance with the lawful bases provided for in the GDPR, namely:

  • Data subject consent, when applicable;
  • Performance of a contract with the data subject or for pre-contractual steps at their request;
  • Compliance with legal obligations to which we are subject;
  • Protection of the vital interests of the data subject or of another person;
  • Pursuit of legitimate interests, except where overridden by the interests or fundamental rights and freedoms of data subjects.

Additionally, if you voluntarily provide such data, special categories of data (in particular, health data) may be processed with your consent, in accordance with Article 9(2)(a) of the GDPR.

5. Retention of Your Personal Data

The personal data collected is processed in strict compliance with applicable legislation and stored in specific databases created for this purpose.

The period for which data is stored and retained varies according to the purpose for which the information is processed. There are legal requirements that oblige us to retain data for a minimum period, in which case we will apply that period.

Where there is no legal retention period, data will be stored for as long as the contractual relationship with the employer that contracted the support services for its employees is maintained, after which it will be appropriately processed, destroyed or anonymised.

6. Data Subject Rights

Under applicable legislation, the data subject has the following rights in relation to the processing of their personal data:

  • Right to be informed: The data subject has the right to receive information about the terms of processing of their personal data.
  • Right of access: The data subject has the right to obtain confirmation as to whether or not personal data is being processed and, where applicable, to access their personal data and information on the purposes of processing, categories of data, recipients, retention period, among others.
  • Right to rectification: The data subject has the right to obtain without undue delay the rectification or updating of inaccurate personal data concerning them.
  • Right to erasure: The data subject has the right to obtain the erasure of their personal data without undue delay, within the limits provided by law.
  • Right to restriction of processing: The data subject has the right to obtain restriction of processing where one of the conditions under the GDPR applies.
  • Right to data portability: The data subject has the right to receive the personal data concerning them that they have provided in a structured, commonly used and machine-readable format.
  • Right to object: The data subject has the right to object at any time, on grounds relating to their particular situation, to processing of their personal data, including where data is processed for direct marketing.
  • Right not to be subject to automated individual decision-making: The data subject has the right not to be subject to a decision based solely on automated processing of their personal data, including profiling, which produces legal effects concerning them or similarly significantly affects them.
  • Withdraw consent: Right to withdraw consent for processing where consent is the lawful basis, at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
  • Complaint: You also have the right to lodge a complaint with a supervisory authority (in Portugal, the National Data Protection Commission - CNPD) via their website: https://www.cnpd.pt/

In light of the above, you may at any time request access to your personal data, as well as its rectification, erasure or restriction of processing, data portability, or object to its processing, by written request addressed to Pulso at privacidade@pulso-group.com.

7. Security of Processing

We have adopted technical and organisational measures, as well as internal controls, to ensure a level of security appropriate to the risk to privacy, data protection and information security, which we review and improve periodically, to ensure the security and protection of your personal data in terms of its availability, integrity and confidentiality, and to prevent its loss, misuse, alteration, unauthorised processing or access, or any other form of unlawful processing.

8. Data Transfers

Pulso uses other entities for the development of its activity, including service providers that support employees who request assistance services. Depending on the services you request, Pulso will transmit your data to the specialist professionals who will support you.

Personal data collected directly from data subjects by specialists in each support area will not be shared with Pulso or with the employer of the employee benefiting from the support services; it is confidential.

For the provision of our services, we may also use other suppliers (e.g. data hosting or IT support) who may have access to your personal data. Pulso ensures that such subcontractors are bound by confidentiality obligations, process data only for the purposes we authorise, and offer sufficient guarantees of implementation of appropriate technical and organisational measures so that processing meets the requirements of applicable legislation and ensures the security and protection of data subjects' rights.

Where we are bound by legal obligations to share data or by requests from authorities, we may transfer personal data to third parties in compliance with such obligations and in accordance with applicable legal rules.

Certain service providers or other third parties to whom we may transfer your data are established in third countries or international organisations outside the European Economic Area. As some countries may not be bound by the same data protection obligations, Pulso applies additional safeguards to ensure that data is adequately protected. In this regard, Pulso carries out these data transfers in accordance with the safeguards provided for in the GDPR, in particular adequacy decisions or standard contractual clauses issued by the European Commission.

For further information or to exercise your data protection rights, contact us at privacidade@pulso-group.com.

9. Cookies

We use cookies on our website. To find out more about cookies and how we use them, please see our Cookie Policy.

10. Contact

If you have any questions about how we process your personal data or wish to exercise your rights as a data subject, you may contact our Data Protection Officer at privacidade@pulso-group.com.

11. Review of this Privacy Policy

We reserve the right to change the content of this Privacy Policy at any time without prior notice; it will be updated immediately on the website.

DATE: February 2026