Privacy Policy
This Privacy Policy explains how SAGRES S.p.A. ("Sagres", "we", "us") collects, processes, and safeguards personal data through https://sagresadvisory.com/, in full compliance with Regulation (EU) 2016/679 (**General Data Protection Regulation - GDPR**) and Portuguese Law no. 58/2019.
1. Data Controller Information
The entity determining the purposes and means of processing personal data on this website is:
SAGRES S.p.A.
Registered Office: Via Montenapoleone 8, 20121 Milan (MI), Italy
VAT / Tax Code: IT 07676810968 | REA: MI-1975640
Portugal Operations: Av. José Gomes Ferreira 15, 1.º andar – 1495-139 Algés (Lisbon)
Dedicated Privacy Desk:
PEC:
2. Categories of Personal Data Collected
- Browsing Data: IP addresses, browser specifications, operating systems, access timestamps, visited URIs, and diagnostic server logs.
- Contact & Inquiry Data: Full name, professional email address, telephone number, organization name, job role, and message content submitted via contact forms.
- Recruitment Data: Curriculum Vitae (CV), professional qualifications, education records, and employment history submitted under the "Careers" section.
- Consent Telemetry: Logged records of consent preferences submitted via the Cookie Consent banner.
3. Legal Bases and Retention Schedule
| Purpose | Processed Data | Legal Basis (GDPR) | Retention Period |
|---|---|---|---|
| Site Security & Hosting | IP address, system logs, session tokens. | Legitimate Interest (Art. 6(1)(f)) to secure infrastructure and prevent fraud. | Max. 6 months in server logs. |
| Contact Handling & Quotes | Identity details, business email, telephone, inquiry. | Pre-contractual Steps (Art. 6(1)(b)) or Legitimate Interest (Art. 6(1)(f)). | Duration of inquiry + max. 24 months for commercial records. |
| Talent Acquisition (Careers) | CV, references, qualifications, contact details. | Pre-contractual Measures (Art. 6(1)(b)) & Consent (Art. 6(1)(a)). | Up to 12 months from receipt. |
| Analytics & Performance | Aggregated metrics, masked IP analytics events. | Consent (Art. 6(1)(a)) collected via cookie banner. | Up to 12 months or until revoked. |
4. Distinction: Sagres as a BPO Data Processor
Important Notice on Credit Management & BPO:
When Sagres delivers Credit Management and Customer Care on behalf of corporate creditor partners (e.g., banks, telecom, utilities), Sagres operates as a Data Processor (Art. 28 GDPR). The processing of debtor records is governed by the privacy notice of the originating creditor (the Data Controller). Inquiries regarding individual credit files should be addressed to the specific team indicated on the communication received or to
5. Data Sharing and Processors
Personal data is handled by strictly authorized personnel and trusted technical partners, including:
- European cloud infrastructure providers (Aruba S.p.A.);
- IT maintenance, cybersecurity, and telecommunication partners;
- Competent public, administrative, or judicial bodies when legally mandated.
6. International Transfers
All primary processing and databases reside within the European Economic Area (EEA). Any secondary service requiring cross-border transfers outside the EEA relies strictly on European Commission Adequacy Decisions or Standard Contractual Clauses (SCCs) alongside encryption safeguards.
7. Data Subject Rights
Under Articles 15 to 22 of the GDPR, you hold the right to:
- Access and obtain copies of your personal data;
- Rectify incomplete or inaccurate information;
- Erase your data ("Right to be Forgotten") where legally applicable;
- Restrict or Object to specific processing routines;
- Data Portability in a structured, machine-readable format;
- Withdraw Consent at any time without retroactive impact.
To exercise your rights, email us at
