Privacy Policy

Introduction

Within the scope of it´s activity HEED CAPITAL SGOIC, S.A. (hereinafter referred to as "Heed Capital") collects personal data from its Customers or potential Customers. Heed Capital ensures that the processing of its personal data is carried out in accordance with the privacy protection rules set out in Regulation (EU) 2016/679 ("GDPR") and other applicable national legislation, as well as in accordance with the confidentiality duties to which Heed Capital is subject to the terms of the Regime Geral dos Organismos de Investimento Coletivo (Lei nº. 16/2015).

This policy as a general nature and the information contained therein may be supplemented and updated by other policies of a more specific nature in the context of the processing of certain types of personal data.

1) Definition of Personal Data

Personal data is the information concerning a living, identified or identifiable person. Personal data is also the set of distinct information that can lead to the identification of a specific person.

Personal data that has been de-identified, coded or pseudonymised, but which can be used to re-identify a person, remains personal data and falls within the scope of the GDPR.

Personal data that has been rendered anonymous so that the person is not or is no longer identifiable are no longer considered personal data. For data to be truly anonymous, anonymization must be irreversible.

The GDPR protects personal data regardless of the technology used to process them - it is technologically neutral and applies to both automated and manual processing, provided that the data is organized in accordance with predefined criteria (e.g. in alphabetical order). It is also irrelevant how the data is stored - in a computer system, via video surveillance, or on paper; in all these cases, personal data are subject to the protection requirements of the RGPD.

2) Definition of Personal Data Processing

The processing of personal data covers a wide range of operations carried out on personal data, by manual or automated means. It includes the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, comparison or interconnection, limitation, erasure or destruction of personal data.

3) Responsible for processing personal data

Your data will be processed by Heed Capital, legal entity number 506.292.622, with headquarters at Rua Alexandre Herculano nº 25 – 4º andar, 1250-008 Lisboa.

Heed Capital is the entity responsible for the processing of your personal data insofar as it is the entity responsible for determining the purposes and means of processing your personal data.

4) Data processed by Heed Capital

The personal data collected corresponds to the data:

1. Identification and contact details ® Name; Number of Identification Documents; Signature; Address; Telephone contact details; E-mail address.

2. Biographical Data ® Date of Birth; Sex; Nationality; Place of Birth; Marital Status; Household Information; Academic Qualifications; Data relating to Profession.

3. Financial Data ® Patrimony; Income; Responsibilities in the Financial Sector; Salary Amount.

4. Segments and Profiles ® Commercial Segment; Investor Profile; Proclivity for the Acquisition of Financial Products.

5. Use of Sites ® Visits to Heed Capital's page, including information on the IP address, geographical location and browser used.

4.1) Data provided voluntarily by the user

The User is free, when reading specific information, to provide his/her personal data through the site to access certain freely chosen products and/or services. On the basis of your consent, your personal data will be processed for the activation of the product and/or service freely chosen by you. The granting of the requested consent is optional and, in the absence of such consent, it will not be possible to proceed with the relevant activations. The User has the right to revoke the previously given consent at any time.

The processing of the data will always be carried out:

1. In full compliance with existing legislation, on the basis of the information provided and in a fair and transparent manner;

2. In a precise and up-to-date manner;

3, Objectively: the data will be stored only for the time necessary for the performance of the services covered by the contract.

4.2) Navigation data

The computer systems used to operate this website collect, during its normal operation, some personal data from Users, the transmission of which is implicit in the use of Internet communication protocols.

This information is not collected with the intention of identifying the User but, due to its very nature, it may be possible, through links with data maintained by third parties, to identify the Users.

This category of data includes IP addresses, browser type, operating system, domain name and addresses of sites from which access has been made, information on pages visited by the User within the site, access time, session duration, internal path analysis and other parameters related to the operating system and the environment of the User's device. This IT technical data is collected and used in an aggregated and anonymous way for the sole purpose of:

1. Improve the quality of the service provided and optimize the functionalities of the site;

2. To understand the behavior of the User, in order to improve our online communication;

3. Collect statistical information about the use of the site.

This data can also be used for:

1. Comply with national regulations and communicate operational and credit risk monitoring obligations;

2. Determine liability in the case of hypothetical computer crimes and for investigations in the event of any legal action.

The provision of the data described above is necessary to navigate the site, and a refusal to provide it implies the impossibility to carry out such activity. The data provided will be processed for the time necessary to carry out the operations described here.

4.3) Marketing and promotion

In addition, on the basis of your consent, on the pages dedicated to the collection of your personal data, these will be processed for the following purposes:

1. To receive communications regarding the various types of products from Heed Capital. This treatment includes: conventional and non-conventional marketing, telemarketing, advertising information, sending advertising material or carrying out market research, direct sales activities or interactive commercial communications on products and services, concerning any product already active at the time of subscription or possibly activated in the future.

2. Receive only those communications that are most related to your preferences and habits; this processing includes the analysis of personal data collected to evaluate and predict certain personal aspects, including professional activity, economic situation, personal preferences and interests, behavior, location, to limit the communications only to products or related promotions based on the analyses previously performed. The granting of data is optional and the lack of consent to such processing compromises the performance of the communications described above. The user has the right to revoke the consent given previously at any time. The data provided will be retained for twelve months after the transfer and will subsequently be rendered anonymous or deleted.

3. Receiving communications relating to products and services offered by other companies; this includes the communication of personal data to partner companies of Heed Capital - including, but not limited to, third parties and/or other companies of Heed Capital - for traditional and non-conventional marketing purposes, telemarketing, business information, sending advertising material or carrying out market research, direct selling activities or interactive business communications about products, services and other activities relating to third party products. The granting of data is optional and the lack of consent to such processing compromises the performance of the activities described above. The User has the right to revoke the consent given previously at any time.

Such personal data may be collected in person, by (i) filling in forms and/or subscribing to products/services, (ii) digital platforms, (iii) website or (iv) telephone contact.

It should be noted that under the terms of the Lei de Branqueamento de Capitais e ao Financiamento do Terrorismo (Law to Combat Money Laundering and Terrorist Financing), the following identification data and respective proofs must be collected and processed: (i) photograph; (ii) full name; (iii) signature; (iv) date of birth; (v) nationality in the identification document; (vi) type, number, expiry date and issuer of the identification document; (vii) tax identification number or, when there is no tax identification number, the equivalent number issued by a competent foreign authority; (viii) profession and employer, if any; (ix) full address of permanent residence and, if different, tax domicile; (x) place of birth; and (xi) other nationalities not in the identification document.

5) Purposes of treatment

Heed Capital will collect and process personal data from Customers and Potential Customers (or their representatives), guarantors or other parties or potential parties to the contract for the following purposes and legal grounds:

1. Execution of contracts entered into or for pre-contractual due diligence at the request of the holder;

2. Accounting and financial reporting;

3. Provision of information and responses at the request of Public Authorities;

4. Legal obligations of retention, payment or declarations for tax purposes;

5. Prevention of money laundering and terrorist financing crimes;

6. Prevention of fraud;

7. Provision of information to customers;

8. Customer segmentation;

9. Profiling;

10. Development of products and services;

11. Production of control and management information;

12. Improvement and monitoring of service quality;

13. Operational risk management;

14. Management of litigation processes;

15. Use of cookies on the Heed Capital page.

Any of the purposes is based on the execution of a contract and contractual steps and/or the legitimate interest of the party responsible for processing and/or complying with a legal and regulatory obligation.

6) Communication of Personal Data

Heed Capital may have to communicate personal data or give access to it to other entities in order for them to process it, on your behalf and for your account. In such cases, Heed Capital will take the necessary contractual measures to ensure that the subcontractors respect and protect the personal data transmitted as required by EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016.

Personal data may also be transmitted to third parties - entities other than Heed Capital or subcontractors - such as, for example, companies with which Heed Capital has partnerships if the data subject has consented - or entities to which the data must be communicated by law, such as the tax authority.

Heed Capital will only transmit personal data to the following categories of recipients:

1. Companies belonging to the same group, namely when they act as service providers;

2. Entities and authorities to whom personal data must be communicated by virtue of a legal obligation (such as the Comissão do Mercado de Valores Mobiliários, the Banco de Portugal, the Autoridade Tributária, Tribunais e Autoridades Policiais);

3. Subcontractors of Heed Capital (e.g. depositary and placement entities).

7) Rights of holders of personal data

In accordance with the applicable law, the holders of personal data have the following rights:

1. Right to Information: This consists of the right of Customers to be informed by Heed Capital, among other things, about the purpose of the data processing, to whom they may be communicated, what their rights are and under what conditions they may exercise them, as well as what data they are obliged to provide;

2. Right of Access: This consists of the right of Customers to access their personal data provided by them, without restriction, without excessive delay or cost, as well as to know any available information regarding the origin of such data;

3. Right of Rectification: This is the right of Customers to demand that their data is accurate and current, and to request its rectification from Heed Capital;

4. Right of Elimination: (or to "forget"), which is the right of Customers to demand the deletion of their personal data from Heed Capital's records when they are no longer used for the purposes for which they were collected, without prejudice, however, to the periods of retention required by law;

5. Right of Opposition: This is the right of Customers to object, at their request and free of charge, to the processing of their personal data for reasons relating to their particular situation or for marketing purposes. Heed Capital ceases to process the personal data in question, unless it has legitimate reasons for doing so and unless these take precedence over the interests of their holders.

6. Right to limitation of processing: This is the right of Customers to ask Heed Capital to limit the processing of their data in certain circumstances, in particular (i) when they dispute the accuracy of their personal data, for a period enabling Heed Capital to check their accuracy; (ii) if the processing is unlawful and the Customer objects to the erasure of the data, requesting instead the limitation of its use; or (iii) when Heed Capital no longer needs the Customer's personal data for processing purposes, but such data is requested by the Customer for the purposes of declaration, exercise or defense of a right in legal proceedings;

7. Right to Portability: The holder may request Heed Capital to provide the personal data provided by him/her in a structured format for current use and automatic reading. He or she also has the right to ask Heed Capital to pass on these data to another controller, provided that this is technically possible. This right to portability may only be exercised in cases where (i) the processing is based on express consent or on performance of a contract; (ii) the processing in question is carried out by automated means;

8. Right to Complain to the CNPD: This consists in the right to lodge, without prejudice to any other remedy of an administrative or judicial nature, a complaint with a supervisory authority, in particular in the Member State of his habitual residence, place of work or the place where the alleged infringement has taken place, if the data subject considers that the processing of personal data relating to him is in breach of the GPDR and other applicable national legislation. In Portugal the supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD).

9. Right not to be subject to exclusively automated individual decisions: Heed Capital will not take decisions that affect the data subject on the basis of an exclusively automated procedure.

For the exercise of any of their rights, including to access their data or request its rectification, deletion or oppose its processing in accordance with the law, Customers should send an e-mail to dadospessoais@heedcap.com or send a written communication addressed to Heed Capital, with headquarters at Rua Alexandre Herculano nº 25 – 4º andar, 1250-008 Lisboa.

The Client will be informed of the measures within one month from the time the order is placed. This period may, however, be extended to two months, when necessary, taking into account the complexity of the request and the number of requests. In any event, you will always be informed of this extension and of the reasons for the delay within the original deadline.

8) Automated processing and profiling

Heed Capital does not make automated individual decisions based on the segmentation of personal data.

9) Data of retention period

Heed Capital shall process and retain personal data only for the purposes referred to above for such time as may be necessary or mandatory for the fulfilment of those purposes, applying a criterion for retention of personal data appropriate to each processing operation and in line with the legal and regulatory obligations to which it is subject.

After the respective retention period has elapsed, Heed Capital shall delete or anonymize the personal data where they should not be retained for any other purpose.

Heed Capital may keep personal data for periods longer than the duration of the contractual relationship, either on the basis of its consent, or to ensure rights or duties related to the contract, or because it has legitimate interests on which it is based, but always for the period strictly necessary for the achievement of the respective purposes and in accordance with the guidelines and decisions of the National Data Protection Commission.

1. If the purpose is related to the fulfilment of the contract® The retention period will correspond to the duration of the contract. Heed Capital may keep the data for periods longer than the duration of the contractual relationship, on the basis of the consent of the data subject.

2. If the purpose relates to legal, fiscal or regulatory obligations®The retention period shall correspond to the legal periods of limitation and forfeiture associated with legal, fiscal or regulatory obligations. For example, 7 years after the end of the contractual relationship, in accordance with the Law on the Prevention of Money Laundering and Terrorist Financing.

3. If the purpose is related to the development and customization of products and services® The retention period may last up to one year after the end of the contractual relationship.

10) Indirect Collection of Personal Data

In specific circumstances, Heed Capital may collect personal data through third parties. In such cases, the entity concerned shall provide the holder with the necessary information regarding the protection and processing of his personal data at the first contact.

11) Data Protection Officer

For any clarification regarding this Privacy Policy, the Customer/User may contact the Data Protection Officer at Heed Capital , through the following channels:

1. Email: dadospessoais@heedcap.com

2. Mail: Heed Capital SGOIC, S.A, with head office at Rua Alexandre Herculano nº 25 – 4º andar, 1250-008 Lisboa

3. Telephone: 214200530

Customers may also, if they wish, submit complaints or requests for information to the Comissão Nacional de Proteção de Dados, which is the national supervisory authority for the purposes of the General Data Protection Regulation.

12) Exercise of Rights

The exercise of rights by the data subject indicated shall be free of charge unless the request is manifestly unfounded or excessive, in which case a reasonable fee may be charged for the associated costs.

13) Security measures

Heed Capital undertakes to adopt the appropriate technical and organizational measures to protect the data for which the controller is responsible against accidental or unlawful interference causing unauthorized destruction, alteration, disclosure or access and any other unlawful form of processing.

To this end, Heed Capital has at its disposal a set of technologies and security procedures for the protection of users' personal data against unauthorized access, use or disclosure, such as the storage of personal data collected in computer systems with limited access and located in controlled facilities.

14) Changes to privacy policy

Heed Capital reserves the right to make readjustments or changes to this Privacy Policy at any time, such changes being duly advertised by Heed Capital.