Privacy Policy
How we collect, use, and protect your personal data when you use Tonnie.
1. Who we are
Tonnie is a platform that helps international talent relocate and helps companies hire globally with confidence. When you use the Tonnie website, web app, or mobile app (collectively, the “Service”), Tonnie — Turn ON International Expertise, Lda. (“Tonnie”, “we”, “our”) is the data controller of your personal data.
This Privacy Policy applies to anyone who uses the Service: talents creating a Tonnie Citizen account, companies using Tonnie Business, clients of Talent Services, candidates sponsored through the platform, and website visitors.
2. What data we collect
We collect the following categories of personal data:
2.1 Information you provide directly
- Account data: name, email, password (hashed), date of birth, nationality, current country, destination country.
- Profile data: CV, qualifications, work history, languages, portfolio links.
- Readiness data (MESH): responses to our readiness assessment covering motivation, language, soft skills and hard skills.
- Cultural preparation data: progress on IQulture missions, quiz answers, self-reported reflections.
- Relocation data: documents you upload (passport, qualifications, proof of employment), housing preferences, travel details.
- Payment data: for paid plans, processed via our payment provider. We do not store full card details on Tonnie servers.
- Communications: messages you send through in-app chat, email, or our AI co-pilot.
2.2 Information collected automatically
- Usage data: pages visited, features used, time spent, device type, browser, language settings, anonymised IP address.
- Cookies e tecnologias semelhantes: consulta a nossa Política de Cookies separada.
- Cookies and similar technologies: see our separate Cookies Policy.
2.3 Information from third parties
- Single sign-on providers (Google, LinkedIn, Apple) — only the fields you explicitly authorise.
- Sponsoring companies — when a company sponsors your journey on Tonnie Business, they share basic identifying information with us to initiate your account.
- Public registries — for company verification, we may consult public commercial registers.
3. Why we process your data
We process your personal data for the following purposes:
- To provide the Service — create and manage your account, run readiness assessments, generate your IQulture score, deliver relocation plans, and enable AI co-pilot responses.
- To match talents and companies — when you opt in, surface candidates to companies on Tonnie Business based on readiness data and role fit.
- To communicate with you — send operational emails (account confirmations, deadline reminders) and, with your consent, product updates.
- To improve Tonnie — analyse aggregated and anonymised usage patterns to refine the MESH framework and platform features.
- To prevent fraud and keep the Service secure — detect suspicious behaviour, enforce Terms, protect other users.
- To comply with legal obligations — including tax, accounting and responding to lawful requests from authorities.
4. Legal bases (GDPR Art. 6)
Under the EU General Data Protection Regulation we rely on the following legal bases:
- Contract (Art. 6.1.b) — to deliver the Service you signed up for.
- Legitimate interest (Art. 6.1.f) — for analytics, product improvement and fraud prevention, balanced against your rights.
- Consent (Art. 6.1.a) — for marketing emails, optional cookies, and any processing of special category data (such as language proficiency details that could indirectly reveal ethnic origin).
- Legal obligation (Art. 6.1.c) — for records we are legally required to keep.
You can withdraw consent at any time. This does not affect the lawfulness of processing carried out before withdrawal.
5. How long we keep your data
- Account data: while your account is active, and up to 24 months after deletion request (for dispute and legal hold purposes), unless a longer retention is required by law.
- Readiness data (MESH): 36 months from your last assessment, after which it is anonymised for research.
- Relocation documents: 12 months after the end of your relocation journey, then securely deleted.
- Financial records: 10 years (required by Portuguese tax law).
- Logs and analytics: up to 13 months.
6. Who we share data with
We do not sell your personal data. We share it only with the following categories of recipients:
- Service providers acting on our behalf under data processing agreements (hosting, email delivery, payment processing, AI model providers, analytics). A current list is available on request.
- Sponsoring companies — only the data fields you explicitly consent to share (for example, your MESH score and CV on Tonnie Business).
- Authorities — where required by law or to protect the rights of Tonnie, users, or third parties.
- Buyer in case of business transfer — in the event of merger, acquisition or sale, your data may transfer to the buyer under the protections of this policy.
7. International data transfers
8. Your rights
Under GDPR and Portuguese Law No. 58/2019, you have the right to:
- Access a copy of your personal data.
- Rectification of inaccurate or incomplete data.
- Erasure (“right to be forgotten”).
- Restriction of processing in certain circumstances.
- Data portability — receive your data in a structured, commonly used format.
- Object to processing based on legitimate interest, including direct marketing.
- Withdraw consent at any time, where processing is based on consent.
- Lodge a complaint with the Portuguese Data Protection Authority (CNPD) or your local supervisory authority.
9. Security measures
Security is a continuous discipline at Tonnie. Our measures include:
- Encryption in transit (TLS 1.3) and at rest for sensitive data.
- Hashed passwords (bcrypt) — we never store plaintext passwords.
- Role-based access controls and least-privilege defaults for our team.
- Annual security reviews and penetration testing.
- Mandatory security and privacy training for everyone at Tonnie.
No system is perfectly secure. If we ever detect a breach affecting your rights, we notify the CNPD within 72 hours and you directly when required by law.
10. Children’s data
Tonnie is intended for users aged 18 and over. We do not knowingly collect data from minors. If we become aware that a minor has provided us with personal data, we delete it.
11. Changes to this policy
We may update this Privacy Policy from time to time. Material changes are notified at least 30 days in advance by email and through an in-app banner. The “Last updated” date at the top of the page always reflects the current version.
12. How to contact us
For any privacy question, data request or complaint:
- Email (Proteção de Dados): [email protected]
- Postal address: Tonnie — Turn ON International Expertise, Lda., [Rua ••], [Postal Code] Lisbon, Portugal
- Data Protection Officer (DPO): [email protected]
Questions about your data?
Email our Data Protection team. We respond within 30 days — usually much faster.