1. Who is responsible for your data

The controller of your personal data is Photon Devotion - Lda, the company behind the mino.works brand ("MINO", "we", "us"). It is registered in Portugal under tax and registration number 517672200, with registered office at Avenida do Atlântico, n.º 16, Escritório 2.01, Parque das Nações, 1990-019 Lisboa, Portugal.

You can reach us about anything in this policy at legal@mino.works, or by post at the address above. We have not appointed a Data Protection Officer, as we are not legally required to. Requests sent to legal@mino.works are handled directly by the management team.

2. Scope

This policy explains how we handle personal data when you visit mino.works, contact us, subscribe to our newsletter, apply for a job, or interact with us as a client, prospective client or partner. How we use cookies and similar technologies is explained in more detail in our Cookie Policy.

3. What data we process, why, and on what legal basis

3.1 When you contact us

If you use the contact form, email us or call us, we process your name, email address, phone number (if given), company (if given) and the content of your message. We use this data to reply to you and, where you are interested in working with us, to prepare a proposal and follow up on it.

Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR). Where we follow up on a business conversation, our legitimate interest in developing commercial relationships (Article 6(1)(f) GDPR).

We record how you found us, for example a referral, a search, social media, the press or an event, so that we can understand which of our activities bring us new conversations. This is based on our legitimate interest in measuring our own marketing, and it is used only in aggregate.

3.2 Newsletter

If you subscribe, we process your email address and, if you give them, your name and company. We use them to send you our newsletter, and we measure whether emails are opened and which links are clicked, so that we can improve future editions.

Legal basis: your consent (Article 6(1)(a) GDPR). You can unsubscribe at any time using the link in every email or by writing to legal@mino.works.

3.3 Job applications

If you apply for a job or send an unsolicited application, we process the data you provide: your contact details, CV, portfolio, and any certificates or other documents you attach. We use them to assess your application, contact you for interviews and, if you agree, to consider you for future openings.

Your data is accessed only by the people involved in the selection process: the partners and the manager of the team that is hiring. Printed copies used during interviews are destroyed after the process ends.

Legal basis: steps taken at your request before entering into an employment contract (Article 6(1)(b) GDPR). For keeping your application for future openings, your consent (Article 6(1)(a) GDPR).

3.4 Website analytics and advertising measurement

With your consent, given through the cookie banner, we use:

• Google Analytics 4, to understand how visitors use the website (pages viewed, time on site, approximate location, device, and how they arrived).

• Microsoft Clarity, to produce heatmaps and anonymised session replays that show how visitors move through our pages. Clarity masks text you type and images before any data leaves your browser.

• Google Ads conversion measurement, to know whether a visit that started from one of our ads led to a contact request.

Where you consent to marketing cookies, two further features apply:

• Google Signals. If you are signed in to a Google account and have allowed Google to personalise ads, Google may associate data about your visit with your Google account. This supports cross-device measurement, aggregated demographic and interest reports, and advertising audiences. We only see aggregated reports and never your Google account details. You can control this in your Google account at https://myadcenter.google.com.

• User-provided data. If you submit a form on our website, Google Analytics may collect the email address and phone number you entered. These are converted into a one-way hash before being sent to Google, which uses them to match the contact request to an ad interaction more accurately, under Google's advertising terms.

Legal basis: your consent (Article 6(1)(a) GDPR, and Article 5 of Law 41/2004 for storing and reading information on your device). If you refuse, these tools do not set cookies or collect these data for those purposes. You can change your choice at any time through the cookie banner, which you can reopen from our Cookie Policy.

Our consent platform keeps a record of your cookie choice, as required by law.

3.5 Clients, suppliers and partners

When we work with you or your company, we process the business contact details of the people involved (name, role, email, phone) to manage the relationship, deliver projects, invoice, and meet our legal and accounting obligations.

Legal basis: performance of a contract (Article 6(1)(b) GDPR), legal obligations (Article 6(1)(c) GDPR), and our legitimate interest in managing business relationships (Article 6(1)(f) GDPR).

3.6 Social media

We have pages on Instagram and LinkedIn. When you interact with them, the platforms process your data under their own policies. For the aggregated statistics they give us about our pages ("Page Insights"), Meta and LinkedIn act as joint controllers with us. We use those statistics only in aggregate, to understand what content works.

4. Profiling and automated decisions

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Where you consent to marketing cookies, Google may include you in advertising audiences (see section 3.4). This is a form of profiling carried out by Google, and you can refuse it in the cookie banner or in your Google account settings.

5. Who we share your data with

We do not sell your personal data. We share it only with service providers that process it on our behalf, under contracts that oblige them to protect it and use it only on our instructions. These fall into the following categories:

• website hosting and form handling;

• email, documents and productivity tools;

• analytics and advertising measurement (Google, Microsoft), as described in section 3.4;

• consent management;

• newsletter delivery;

• contact, proposal and project management tools;

• embedded content providers (Vimeo, Kuula).

We may also disclose data where the law requires it, for example to tax authorities or courts.

6. Transfers outside the European Economic Area

Some providers, or their sub-processors, may process data in the United States or other countries outside the EEA. Where this happens, we rely on the EU–US Data Privacy Framework for certified providers, or on the European Commission's Standard Contractual Clauses, together with any additional safeguards required.

7. How long we keep your data

• Contact requests that do not lead to a project: 24 months after our last exchange

• Proposals and client records: For the duration of the relationship, then for as long as needed to meet legal obligations. Accounting and tax records: 10 years

• Newsletter: Until you unsubscribe

• Job applications for a specific opening: Until the selection process ends. If you agree, we keep your application for future openings for up to 24 months

• Unsolicited applications: Up to 24 months, unless you ask us to delete it sooner

• Google Analytics data linked to cookies or identifiers: 14 months, reset on each new visit

• Consent records (Cookiebot): 12 months, as described in the cookie declaration

When the period ends, the data is deleted or irreversibly anonymised.

8. How we protect your data

We use access controls, so that only the people who need data for their role can see it. We use providers with recognised security certifications, two-factor authentication on the accounts that hold personal data, and masking of form contents in session recordings. Everyone at MINO who handles personal data is bound by confidentiality obligations.

9. Your rights

Under the GDPR, you have the right to:

• access the personal data we hold about you;

• rectify inaccurate or incomplete data;

• erase your data;

• restrict our processing in certain circumstances;

• receive the data you provided to us in a structured, commonly used, machine-readable format, and have it transmitted to another controller (portability);

• object at any time to processing based on our legitimate interests, including follow-ups on business conversations;

• withdraw your consent at any time, without affecting the lawfulness of processing carried out before you withdrew it.

To exercise any of these rights, write to legal@mino.works. We will reply within one month. We may ask you to confirm your identity before acting on a request.

You also have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, www.cnpd.pt, or with the supervisory authority of the EU country where you live or work.

10. Changes to this policy

We may update this policy when our practices or the law change. The date at the top shows the latest version. If a change significantly affects how we use your data, we will make it clear on the website.