Last updated: 24 August 2026 · Version 1.0
1. Who we are
Lápis Ligeiro – Unipessoal Lda, NIF 515302996, with registered office in Lisboa, Portugal, trading as Placement in Portugal, is responsible for the personal data described in this policy.
For any privacy matter: [email protected] · Rua da Atalaia 204, 1200-045 Lisboa · +351 933 270 222.
2. Who this applies to
- Trainees – students and graduates who create an account to look for an internship.
- Company contacts – people at host companies who register to publish offers.
- Visitors – anyone browsing the site or contacting us.
3. What we collect
Trainees. When you register through Google, LinkedIn or Facebook we receive your name and email from that provider. You then complete your profile, which may include:
- Contact: name, email, phone, messaging apps, nationality, date of birth, gender.
- Education: university, country and level of studies, degree, field of study, languages.
- Documents: CV, motivation letter, portfolio, video CV.
- Availability: start date, duration, whether you are studying, Erasmus+ details.
- University contact: your Erasmus coordinator's name, phone and email, if you provide them.
- Placement record: your applications and their status, and our notes from interviews.
- Account: encrypted password, login method, registration and activity dates, cookies.
Please do not include health, religious or political information in your CV. Our service is for people aged 18 or over.
Company contacts. Company name, VAT number, address, sector, size, website and logo, plus the contact person's name, position, email and phone. Payment card details are handled by our payment provider and never stored by us.
4. Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Running your account and matching you to internships | Performance of our contract with you |
| Sending your CV and profile to host companies | Performance of our contract with you |
| Erasmus+ and internship paperwork | Contract and legal obligation |
| Service emails about your account and applications | Performance of our contract with you |
| Marketing emails and newsletters | Your consent |
| Referral for accommodation | Your consent |
| Invoicing, accounting and tax | Legal obligation |
| Security, fraud prevention and improving the service | Our legitimate interests |
5. Sharing with host companies
The purpose of registering is to be considered for internships. When your profile matches an offer, we send the host company your name, nationality, university, field of study, languages, availability and CV – plus your motivation letter and portfolio if you uploaded them.
- We send your details only to companies with a relevant open position.
- Each host company is then independently responsible for the data it receives.
- Host companies are in Portugal. If an offer ever involves a company outside the EU/EEA, we will tell you first.
- Ask us at any time which companies received your CV.
6. Accommodation
If you ask for help finding somewhere to live, we pass the details needed to arrange a room – normally your name, email, phone, arrival date, length of stay, city and any preferences – to LX – Book a Room, Lda (NIF 513835628), a company related to us through common ownership.
- This is optional and never a condition of getting an internship.
- We share only what is needed to check availability – never your CV, grades or our notes.
- LX – Book a Room handles the booking under its own privacy policy.
- You can withdraw at any time by writing to us.
7. Marketing
With your consent, we send occasional emails about new internship offers matching your profile, deadlines, and news that may be useful to you.
- You give this consent through a separate, unticked box – never bundled with the terms, and never required to register.
- Every marketing email has a one-click unsubscribe link. You can also write to [email protected].
- Withdrawing is free, takes effect promptly, and does not affect your account or applications.
- We do not sell your data or share it for anyone else's marketing.
You will still receive essential service messages, such as confirmation that your CV was sent to a company – these are part of the service, not marketing.
8. Who else processes your data
We use selected providers who process data on our instructions under a written contract: website and database hosting (EU); Brevo, for sending emails (EU); Re:amaze, for our support inbox (United States, under EU Standard Contractual Clauses); Google, LinkedIn and Facebook, for sign-in; Google Analytics, subject to your cookie choice; and our payment provider.
We may also disclose data to public authorities, to universities for Erasmus+ paperwork, and to our accountants or lawyers where the law requires or allows it.
Transfers outside the EU/EEA only happen where the European Commission recognises the country as providing adequate protection, or under Standard Contractual Clauses. You can request a copy of these safeguards.
9. How long we keep it
- Trainee account, profile and CV: while your account is active. If you are placed, 5 years after the placement ends; if not, 3 years after your last activity, then deleted or anonymised.
- Erasmus+ agreements and certificates: 5 years after the placement ends, or longer if required.
- Company accounts and offers: while the relationship is active, then 5 years.
- Invoices and accounting records: as required by Portuguese tax law.
- Marketing list: until you withdraw consent.
- Support conversations: 3 years from the last message.
You can ask us to delete your data sooner – see section 11.
10. Cookies
We use strictly necessary cookies to keep you logged in and the site secure. We also use analytics cookies to understand how the site is used; these are only set if you accept them. You can change or withdraw your choice at any time through the cookie banner or your browser settings. Refusing analytics cookies does not affect your use of the site.
11. Your rights
You have the right to access your data, correct it, have it erased, restrict or object to how we use it, receive it in a portable format, and withdraw consent at any time.
Write to [email protected]. We reply within one month; if a request is complex we may extend this by two months and will tell you why. Exercising these rights is free.
If you are unhappy with how we handle your data you can complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134 – 1.º, 1200-651 Lisboa, www.cnpd.pt, or to the authority in your own country.
12. How we protect your data
Access to our admin platform is restricted to authorised staff with individual accounts, traffic between your browser and our site is encrypted, and passwords are stored hashed, never in plain text. No system is completely secure; if a breach occurs that is likely to put your rights at risk, we will notify the CNPD within 72 hours and inform you where required.
13. Changes
We may update this policy. The version and date at the top always show the current one. If we make a significant change we will tell you by email or through the platform before it takes effect.