Privacy Policy
Introduction
Welcome to the incredible journey of you becoming you.
TiJUBU and Truleadership, Unipessoal, Lda., its legal entity, (collectively, "TiJUBU", "Truleadership", "Trulea", "Company", "the Services," "we," "us," or "our") welcome you (the "User", "you" or "your") to our website at https://tijubu.com/ as well as to any additional website, webpages (such as landing pages for marketing purposes) and/or mobile applications owned and/or operated by TiJUBU (collectively, the "Site"), that allows for free or trial version or demo, or usage by the paying customer's (the "Customer") end users to our web-based and mobile platform (collectively, the "Service" or "Services").
This page informs you of our policies regarding the collection, use and disclosure of personal data when you use our Site and Services. The terms used in this Privacy Policy have the same meaning as in our Terms of Use, available at https://tijubu.com/terms-of-service, unless otherwise defined here.
How to read this Policy: two different roles
We process personal data in two distinct roles, and it is important to know which applies:
- As controller, for personal data relating to website visitors, individual and trial users, marketing contacts, and account administration and support. For this data we decide the purposes and means, and this Policy describes that processing.
- As processor, for the personal data that our business customers upload to the Services about their own employees and workforce (for example, compensation data in TiJUBU Pay Analysis). For that data, our customer is the controller, we act only on the customer's documented instructions under a Data Processing Agreement, and the customer's own privacy notice governs how that data subject's information is handled. Section 9 explains this further.
1. Controller and contact
1.1 For the processing described in this Policy, the controller is Truleadership, Unipessoal, Lda. (details above).
1.2 You can contact us on any data protection matter at dataprotection@tijubu.com or at the registered office.
2. Purposes and lawful bases
We process personal data, in our role as controller, for the following purposes and on the following lawful bases under Article 6 GDPR:
| Purpose | Lawful basis |
|---|---|
| Website and account management (providing the Site, registering and administering accounts) | Performance of a contract (Art. 6(1)(b)); our legitimate interest in operating and securing the Site (Art. 6(1)(f)) |
| Responding to requests, clarifications and complaints (support) | Performance of a contract or steps prior to a contract (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)) |
| Performing a purchase or subscription contract | Performance of a contract (Art. 6(1)(b)) |
| Processing payments for paid subscriptions (via a third-party payment processor acting as independent controller) | Performance of a contract (Art. 6(1)(b)); compliance with tax and accounting obligations (Art. 6(1)(c)) |
| Compliance with legal obligations toward authorities | Legal obligation (Art. 6(1)(c)) |
| Marketing (newsletters, materials, event invitations, promotions) | Prior, specific and separate consent (Art. 6(1)(a)) |
3. Categories of personal data
In our role as controller we may process:
We collect only the data necessary for the purposes above (data minimization). We do not collect categories of data beyond those needed for a stated purpose. You are responsible for providing accurate data and for keeping it up to date; you may correct it at any time (Section 5).
4. Retention
We retain personal data only as long as necessary for the purpose for which it was collected:
| Data | Retention |
|---|---|
| Website and account data | Duration of registration, or up to 3 months after the last visit for unregistered visitors |
| Support and complaints | The period necessary to handle the request and any applicable legal limitation period |
| Subscription contract data | The period required to perform the contract and meet legal obligations |
| Data kept for legal obligations | The period required by the applicable legal obligation |
| Marketing data | Until you unsubscribe or withdraw consent |
For newsletters, processing begins when you submit the subscription form and ends when you unsubscribe via the link in any newsletter, after which we confirm removal by email.
5. Your rights
5.1 You have the right to be informed and to access, rectify, erase, restrict, port and object to the processing of your personal data, and, where processing is based on consent, to withdraw consent at any time without affecting prior lawful processing.
5.2 You can delete your account and associated personal data through the "My Profile" section, or by contacting dataprotection@tijubu.com. On deletion we remove personal data from our systems unless retention is legally required.
5.3 Exercise your rights in writing to the registered office or to dataprotection@tijubu.com. You also have the right to lodge a complaint with the supervisory authority, currently the CNPD (Comissão Nacional de Proteção de Dados) in Portugal, or your local authority.
5.4 Where we act as processor for customer data (Section 9), please direct your rights request to the relevant customer (the controller); if you contact us, we will forward your request to that customer.
6. Security
6.1 We implement appropriate technical and organizational measures to protect personal data, including: anti-malware and firewall protection; differentiated, role-based access; unique credentials and password quality rules; detection of unauthorized access; removal of access on termination of a relationship; periodic backups; and periodic penetration testing. We review and update these measures.
6.2 If a personal data breach occurs, we will notify the competent authority without undue delay and, where feasible, within 72 hours of becoming aware, and we will inform affected data subjects where required by law. Where we act as processor, we notify the relevant customer (the controller) without undue delay so that it can meet its own obligations.
8. International transfers
8.1 Personal data we process as controller is processed within the EEA where possible. Some website analytics and marketing tools may involve recipients outside the EEA (see Section 10); where that occurs, we rely on an adequacy decision, the EU-US Data Privacy Framework where the recipient is certified, or EU Standard Contractual Clauses with appropriate safeguards.
8.2 Personal data we process as processor for the Services (customer data) is hosted within the EEA, in Amazon Web Services, Ireland. We do not transfer it outside the EEA except as described in the applicable Data Processing Agreement and with a compliant transfer mechanism.
9. Customer data processed on behalf of our customers (TiJUBU as processor)
9.1 When a business customer uses the Services to process personal data about its employees or workforce, the customer is the controller and TiJUBU is the processor. We process that data only on the customer's documented instructions, under a Data Processing Agreement that meets Article 28 GDPR.
9.2 In that role we do not decide the purposes of the processing, we do not use the data for our own purposes, and we do not use it to train artificial-intelligence models for the benefit of any third party or other customer.
9.3 If you are an employee or other individual whose data has been uploaded to the Services by your employer or another organization, that organization is responsible for informing you and for handling your data protection rights. Its own privacy notice applies. If you contact us, we will refer or forward your request to that organization.
11. Changes to this Policy
11.1 We may update this Policy. We will publish the updated version with a new effective date and, where the change is material, bring it to your attention by an appropriate means (for example email to registered users or a notice on the Site) rather than by posting alone.