Privacy notice

1. Who is responsible?

BSJ Invest lda at the Portuguese address below is responsible for website enquiries. Het Financieel Huis bv is the Belgian contract holder; other countries are managed by BSJ Invest lda. Roles may differ for a particular EAP, Guidance or L&D service; programme privacy information identifies the relevant parties.

Use our contact page or GDPR request form for privacy questions and rights requests.

2. What information is processed?

Contact, quote, EAP and franchise enquiries collect the details you provide, such as name, work email, organisation, phone, country and message. EAP requests may include employee counts, package and organisation inputs; franchise requests may include background, experience, network and launch plans.

Separate confirmations given with requests, and when they were given, are recorded. For administration accounts, sign-in and security data are processed. Your country preference may be stored in your browser. Hosting and security services may process request data such as IP addresses, timestamps and errors.

3. Purposes and legal bases

We use enquiry data to respond, prepare quotes or take steps before a contract at your request. Contract performance is the legal basis for necessary contract administration; legal obligations may require billing and record keeping.

Security, abuse prevention and necessary business follow-up may rely on legitimate interests balanced against your rights. Where consent is necessary, it must be specific and freely given and can be withdrawn. Reading a notice is not consent to all processing. Request-related contact consent is not general marketing consent.

4. Sensitive data and confidential support

General forms are not for medical records, identity numbers or sensitive employee data. Provide only what is necessary for the business enquiry. Personal support belongs in the designated professional channel.

EAP support is external and confidential. Conversation content is not shared with HR or employers unless the employee explicitly requests it and agrees what may be shared. Professionals must comply with applicable legal obligations. Health data requires an applicable Article 9 GDPR condition in addition to a lawful basis and suitable safeguards.

5. Recipients

Data is for staff and providers who need it for the relevant task, including enquiry follow-up, contracts, hosting and security. Professional partners, including Workplace Options and Telus Health, may deliver support under programme arrangements. Website requests are not automatically shared with these partners.

Appropriate data-processing agreements should apply to anyone processing data on our behalf. An independent professional may be responsible for their own records. Operational usage monitoring does not give employers access to personal conversations.

6. International processing

International programmes may involve services or technical processing outside the European Economic Area. Such transfers require assessment of the data, recipients, purposes and safeguards.

Where required, an adequacy decision or suitable safeguards such as standard contractual clauses apply, with assessment and additional measures where necessary. Ask for the recipients, locations and safeguards relevant to your programme. This notice does not guarantee EU-only storage.

7. Retention

Data is kept no longer than necessary for the purposes and applicable duties. Appropriate periods depend on enquiries, contracts, tax obligations, potential disputes and professional record rules. No single period applies to all data.

Identity documents for rights requests are solely for necessary verification. Authorised staff remove them once verification is complete and further retention is unjustified. A minimal request and outcome record may be retained to demonstrate compliance. Ask about the period applicable to your data.

8. Security and incidents

Enquiry records and identity attachments are not publicly readable. Identity files are in private storage accessible only to authorised administrators. Appropriate safeguards should include access control and data minimisation.

No online service can guarantee absolute security. Potential breaches are assessed and, where GDPR requires, notified to the supervisory authority without undue delay and where feasible within 72 hours. Individuals are notified where a breach is likely to create a high risk to their rights.

9. Rights and complaints

Subject to applicable conditions, you may request access, correction, erasure, restriction or portability and object to certain processing. You may withdraw consent prospectively without affecting past lawful processing.

Erasure is not absolute: legal retention, legal claims or other exceptions may apply. We normally respond within one month; complex or multiple requests may require up to two additional months, with notice in the first month.

You may complain to your competent authority, including Belgium’s GBA, the Netherlands’ AP or Portugal’s CNPD. You do not have to contact us first.

10. Cookies, updates and contact

The cookie policy explains cookies and local browser storage. The GDPR page explains rights requests and contains the erasure form.

This notice is updated as purposes or practices change. Material changes require appropriate communication; a revised notice does not automatically permit incompatible reuse. Contact the organisation below for questions.