Last updated: September 2026
1. Who we are
Bonapolia, Lda. ("Bonapolia", "we") is a Portuguese company, NIPC 517 626 837, registered at Av. do Atlântico, 16, esc. 5.07, 1990-019 Lisboa, Portugal. We are the controller of the personal data processed through this career site.
This career site is operated for us by Teamtailor, which acts as our processor. For data we process through bonapolia.com, see the Privacy Policy at bonapolia.com/privacy.
Questions about your data: privacy@bonapolia.com
2. What we do and why we process your data
Bonapolia builds engineering teams for product companies and IT consultancies in Europe and the US. Engineers who join an engagement do so as independent professionals under a B2B service contract with Bonapolia. Bonapolia is your contracting party; you do not become an employee of Bonapolia or of the client.
We process your data to:
assess whether you fit an open engagement or future ones;
contact you about engagements that match your profile;
present your profile to a client, with your agreement (see section 5);
prepare and manage a contract with you if an engagement goes ahead;
keep your profile in our talent pool, if you have given us permission.
You are not required to provide your data. Without it, we cannot consider you for engagements.
3. What we collect and where it comes from
From you: name, contact details, CV, work history, skills and stack, experience level, English level, availability, time zone, rate expectations and currency, country of contract (legal jurisdiction), preferred contract type, answers to our questions, and anything you write to us.
From other sources: public professional profiles (for example LinkedIn or GitHub) and referrals from people who know you. When we collect data about you this way, we tell you within one month at the latest, or at our first contact with you if that is sooner, and ask whether we may keep it.
From our process: notes from calls and interviews, the engagements you were considered for, the stage reached, and feedback from us and from clients.
We do not ask for sensitive data (health, religion, ethnic origin, political views, etc.). Please do not include it in your CV.
4. Legal basis
Legitimate interest — finding and contacting professionals for open engagements, and assessing candidates who apply. We have balanced this against your interests; you can object at any time (section 9).
Steps before a contract, at your request — when you apply or ask to be put forward for an engagement.
Contract — once you sign a contract with Bonapolia.
Consent — keeping your profile in our talent pool after a specific process ends, and sharing your profile with a specific client. You can withdraw consent at any time; withdrawal does not affect processing done before it.
Legal obligation — accounting and tax records under Portuguese law, once a contract exists.
5. Who we share your data with
We do not sell your data. We share it only with:
Clients. We present your profile to a client only after we have told you which engagement it is and you have agreed. Clients use it to decide whether to interview you.
End clients of our clients. When our client is an IT consultancy, your profile may reach the consultancy's own end client. We tell you before this happens.
Recruiters working with Bonapolia, some of whom are based outside the EEA. They act under our instructions.
Service providers acting as our processors: Teamtailor (this career site and our candidate database), Microsoft (email, calendar, file storage, video calls), and similar providers bound by data processing agreements.
Authorities or legal advisers, where the law requires it or to establish or defend legal claims.
6. Transfers outside the EEA
Some recipients are outside the European Economic Area:
United States — some of our clients are US-based. Your profile reaches them only in the situations described in section 5.
United Kingdom — covered by an EU adequacy decision.
Other countries (for example Armenia or Georgia) — where some recruiters working with Bonapolia are based.
Where the country has no EU adequacy decision, we rely on the European Commission's Standard Contractual Clauses or, for a US recipient certified under the EU-US Data Privacy Framework, on that framework. Where neither applies, we transfer your profile only because you asked us to put you forward for that engagement. You can ask for a copy of the safeguards at privacy@bonapolia.com.
7. How long we keep your data
Sourced or referred, no permission given: deleted within 30 days of our permission request, unless you are in an active process with us.
In the talent pool with your permission: 24 months from our last meaningful contact. Before that period ends we ask whether you want to stay; if you don't confirm, we delete your data.
Application for a specific engagement that did not go ahead: until the process ends, then as above — kept only with your permission.
If you sign a contract with Bonapolia: for the duration of the contract, then for as long as Portuguese accounting and tax law requires for contract and invoicing records (generally 10 years).
8. Automated decisions
We do not make decisions about you by automated means alone. Tools may help us search and organise profiles, but every decision — shortlisting, presenting you to a client, or closing your application — is made by a person.
9. Your rights
You have the right to:
access the data we hold about you and receive a copy;
correct inaccurate data;
have your data deleted;
restrict processing or object to it, including processing based on legitimate interest;
withdraw consent at any time;
receive data you provided in a portable format.
You can use the self-service tools under "Data & privacy" on this site (Request my data, Remove my data, Manage my permission), or email privacy@bonapolia.com. We reply within one month.
You can also complain to the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt.
10. Security
We limit access to your data to people who need it for the purposes above, use providers with appropriate security measures, and require confidentiality from everyone who handles it.
11. Changes
We update this policy when our practices or the law change. The date at the top shows the latest version. If a change significantly affects how we use your data, we will tell you by email.
12. Contact
Bonapolia, Lda. Av. do Atlântico, 16, esc. 5.07, 1990-019 Lisboa, Portugal privacy@bonapolia.com
