Privacy Policy

Introduction

This Privacy Policy explains how LUMINOUS GIANT — UNIPESSOAL LDA (“Luminous Giant”, “Careersity”, “we”, “us”, or “our”), operating the Careersity brand, collects, uses, and protects personal data when you visit https://www.careersity.work (the “Site”).

Processing is governed by Regulation (EU) 2016/679 (the “GDPR”), Portuguese Law No. 58/2019 of 8 August (implementing the GDPR in Portugal), and, for cookies and similar technologies, Portuguese Law No. 41/2004 of 18 August. This policy should be read together with our Cookie Policy and Terms of Use.

Data controller

The data controller responsible for personal data processed through the Site is:

• LUMINOUS GIANT — UNIPESSOAL LDA, single-member private limited company (sociedade unipessoal por quotas)
• NIPC 519357124
• Rua Companhia dos Caolinos, 102, R/C Esq Tras, 4460-205 Senhora da Hora, Matosinhos, Porto district, Portugal
• Manager / sole shareholder: Carlos Miguel Ferreira de Castro Enes de Oliveira (NIF 235578428), sole shareholder and manager
• General contact: hello@careersity.work
• Privacy contact: privacy@careersity.work

Given the nature, scope, context, and risks of processing carried out through this Site, we are not required to appoint a Data Protection Officer (DPO) under Article 37 of the GDPR. To exercise your rights or ask privacy questions, contact privacy@careersity.work.

Scope and audience

This Privacy Policy applies to personal data processed through the Careersity coming-soon Site at https://www.careersity.work, including localised paths (for example /en, /pt, /es, and other supported locales). The Site is a marketing hold screen describing a future live index of job roles. It does not currently offer user accounts, contact forms, waitlists, newsletter signup, job applications, or payment features.

It applies to visitors who browse the Site. When the product opens, additional processing (for example accounts and CV storage) will be described in an updated Privacy Policy before those features go live. This policy should be read together with our Cookie Policy, which describes cookies and similar technologies.

Categories of personal data processed

Depending on how you interact with the Site, we may process the following categories of data. We do not currently operate contact forms or waitlists on Careersity, and we do not invent or collect form fields that the Site does not provide.

• Technical and security data: IP address, user-agent, relevant HTTP headers, and server or Cloudflare Worker logs generated when you request pages or assets, as part of hosting, CDN delivery, security, and reliability on Cloudflare’s network.
• Cookies and similar technologies: as described in our Cookie Policy, including the consent record cookie (cc_cookie, typically 6 months) and, only if you opt in, Google Analytics cookies (_ga / _ga_*, typically up to 2 years; _gid, typically 24 hours).
• Analytics (consent only): aggregated usage data collected by Google Analytics 4 when you accept analytics cookies via our cookie banner (vanilla-cookieconsent, opt-in). We do not use advertising cookies; ad_storage and related advertising signals remain denied.

We do not currently create user accounts on the Site, do not profile visitors for behavioural advertising, and do not sell personal data.

Planned future product processing

When Careersity’s product opens, we plan to process additional personal data related to user accounts and CVs. Account data is expected to be stored in Cloudflare D1, and CV blobs in private Cloudflare R2. Job listings indexed by Careersity are expected to be public snapshots of third-party postings.

Those features are not active on the coming-soon Site. Before they launch, we will update this Privacy Policy (and related notices) to describe purposes, legal bases, retention, subprocessors, and your rights for that processing. Until then, this section is informational only and does not describe current data collection.

Purposes and legal bases

We process personal data only for specified purposes, on the following legal bases under the GDPR and Law No. 58/2019:

• Operate, secure, and deliver the Site (hosting, CDN, HTTPS, edge security, and anti-abuse on Cloudflare): Art. 6(1)(f) GDPR — legitimate interests in keeping the Site available and secure. We balance this interest against your rights by limiting collection to what is necessary for those purposes.
• Store and honour cookie consent choices (cc_cookie and the consent UI): Art. 6(1)(c) and/or 6(1)(f) GDPR — legal obligation under cookie rules where applicable, and/or legitimate interests in recording and respecting your choice; non-essential cookies additionally require consent under Law No. 41/2004.
• Aggregated traffic measurement with Google Analytics 4: Art. 6(1)(a) GDPR — consent. Analytics cookies are blocked until you opt in via the cookie banner.
• Compliance with legal obligations (for example responding to lawful requests): Art. 6(1)(c) GDPR — legal obligation.

You may withdraw consent for analytics at any time via Manage cookie preferences without affecting the lawfulness of prior processing based on consent.

Recipients and processors

We share data only with processors that provide services to us, acting on our instructions under Article 28 of the GDPR. We do not sell data or share it for behavioural advertising.

• Cloudflare, Inc. (and affiliated Cloudflare entities): hosting, CDN, Cloudflare Workers, edge security, and related infrastructure for https://www.careersity.work. Global operations; transfers outside the EEA may occur, including to the United States.
• Google Ireland Limited / Google LLC: Google Analytics 4, only with your consent. Transfers outside the EEA may occur, including to the United States.

You may request information about contractual safeguards by contacting privacy@careersity.work. Processors act on our instructions and under appropriate contractual terms where required by law.

International transfers

Some processors process data outside the European Economic Area, including in the United States (notably Cloudflare and, when you consent, Google Analytics).

Where transfers occur, we implement appropriate safeguards under GDPR Chapter V, which may include Standard Contractual Clauses (SCCs) adopted by the European Commission, adequacy decisions where applicable, and supplementary technical and organisational measures offered by providers (for example encryption in transit and access controls).

Retention periods

We retain personal data only as long as necessary for the purposes described:

• Cloudflare / Worker and security logs: according to Cloudflare retention practices and our operational needs for security and reliability.
• Consent record (cc_cookie): typically 6 months (renewable upon a new choice).
• Analytics data: according to GA4 configuration and _ga / _ga_* / _gid cookie lifetimes; processing stops when you withdraw consent, subject to residual retention in Google’s systems as described in Google’s documentation.

After the applicable retention period, data is deleted or irreversibly anonymised, unless retention is required by law. Retention for future product features (accounts, CVs) will be specified when those features launch.

Data subject rights

Where the GDPR applies to you, you have the following rights (Articles 15–22), subject to the conditions and exceptions in the GDPR and Law No. 58/2019:

• Access your personal data
• Rectify inaccurate data
• Request erasure (“right to be forgotten”), where applicable
• Restrict processing
• Object to processing based on legitimate interests
• Data portability, where applicable
• Withdraw consent at any time, without affecting the lawfulness of prior processing

We respond within one (1) month of your request, extendable by two (2) further months where necessary, and will inform you of the reasons for any extension. You also have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1st floor, 1200-651 Lisbon, Portugal — www.cnpd.pt. To exercise your rights, contact privacy@careersity.work.

Minors

The Site is not directed at persons under 16 years of age. We do not knowingly collect personal data from minors under 16. If you become aware that we have collected a minor’s data without a valid legal basis, contact privacy@careersity.work so we can delete it.

Security measures

We implement appropriate technical and organisational measures under Article 32 of the GDPR, including:

• HTTPS encryption in transit
• Hosting and delivery on Cloudflare’s edge network with DDoS and perimeter protections
• Consent Mode gating so non-essential analytics storage waits for your choice
• Data minimisation for current Site processing (no contact forms or waitlists on the coming-soon Site)

No measure guarantees absolute security. Please use good judgement when sharing sensitive information by email or other channels outside the Site.

Changes to this policy

We may update this Privacy Policy from time to time, including when the Careersity product opens or when processors, cookies, or legal requirements change. Material changes will be reflected in the “Last updated” date at the top of this page. We recommend periodic review. The version published on the Site prevails.

Effective date of the current version: 25 August 2026.

Contact

To exercise your rights or ask questions about this Privacy Policy, contact privacy@careersity.work. Accepted languages include European Portuguese and English.

For general contractual or legal matters that are not privacy-related: legal@careersity.work. General Site enquiries: hello@careersity.work.

Postal address: LUMINOUS GIANT — UNIPESSOAL LDA, Rua Companhia dos Caolinos, 102, R/C Esq Tras, 4460-205 Senhora da Hora, Matosinhos, Porto district, Portugal.