Privacy
Policy

The privacy policy of HCapital Partners – SCR, SA with respect to the processing of personal data described below, complies with EU Regulation 2016/679, approved on 27 April 2016, with effect from 25 May 2018, designated as the General Regulation on Data Protection (“GDPR”) and the remaining regulations applicable to privacy and data protection.

Controller

The controller is HCapital Partners – SCR, S.A. (the “Company”), headquartered at Av. Duque de Ávila 46, 8º, 1050-083 Lisbon, Portugal

Purpose of the Treatment of Personal Data

HCapital Partners – SCR, SA treats personal data, defined as information relating to an individual, including: name; age; date of birth; genre; email address; postal address; country of residence; family circumstances (for example, marital status and dependents); employment and education details; financial and tax information, for the following purposes:

• Fulfillment of a legal obligation

HCapital Partners – SCR, SA, as a private equity and venture capital company, is subject to several legal obligations, namely to the Legal Framework for Venture Capital Funds and Companies, Social Entrepreneurship and Specialized Investment, to legislation on Money Laundering and Terrorist Financing, as well as to provisions on the supervision of private equity and venture capital activities by the Securities Market Commission.

• Execution of a contract in which the data subject is a party, or for pre-contractual procedures at the request of the data subject

HCapital Partners – SCR, S.A., processes personal data in connection with private equity and ventures capital operations and complementary activities.

• As part of legitimate interests

HCapital Partners – SCR, SA, processes personal data, where necessary, in order to protect the legitimate interests of the Company and third parties, in particular the establishment of procedures to ensure the security of HCapital Partners – SCR, SA, its IT network, its IT systems, among others.

• Based on the consent given for the processing of personal data for one or more specific purposes

HCapital Partners – SCR, S.A., treats personal data for specific purposes, provided that it has obtained the data subject’s consent and within the limits of that consent. Consent may be revoked at any time, with such revocation being applicable only to situations that occur in the future and therefore having no retroactive effect. This also applies to the revocation of any consent that has been provided to the Company before May 25, 2018.

Outsourced entities

HCapital Partners – SCR, SA uses, in specific cases, outsourced entities for data processing (such as information systems service providers, salary processing companies, entities performing due diligence) for the purposes indicated above, who also assume the obligation to comply with the GDPR and other regulations applicable to privacy and data protection.

Transfers of personal data

HCapital Partners – SCR, SA, as a controller, determines that all personal data treatments should be held within the EEA territory or in countries considered to have an adequate level of protection by specific decision of the European Commission.

If, at a given moment, HCapital Partners – SCR, SA determines, as a controller, the necessity to proceed with transfers of data to third countries, the later will be performed in compliance with the GDPR legal requirements, including, whenever necessary, the execution of EU standard model clauses.

Information Security Policy

HCapital Partners – SCR, SA uses technical and organizational security measures to protect against manipulation, loss, destruction and unauthorized access to the data that it collects. Security measures are constantly optimized according to the latest technological advances.

Retention Period

HCapital Partners – SCR, S.A. retains personal data for a period that varies, in accordance with the purpose that lead to retaining such information. If no legal requirements apply, the information is maintained and retained only for the period necessary to achieve the purpose of its collection and treatment and always within the limits allowed by the National Data Protection Commission, after which it will be erased.

Rights of data subjects

In accordance with the applicable legislation, data subjects are granted the following rights:

• Right of Access: right to obtain the confirmation and copy of the processed personal data;
• Right of Rectification: right to request the rectification of inaccurate or incomplete personal data;
• Right to Elimination: right to request the deletion of personal data. The latter is limited in case of collection for fulfillment of legal requirements;
• Right to Limitation: right to request the limitation of the processing of personal data;
• Right to Copy and Portability: right to receive a copy of the data in a structured format, when applicable, as well as the right to its portability (when the treatment is consented or contracted);
• Right to Opposition: right to oppose, at any time, the processing of data. The latter is limited in case of collection for fulfillment of legal requirements.
• Right to Lodge a complaint: the data subject has the right to lodge a complaint at the competent privacy authority in case he/ she considers to have a motive to do so under privacy laws. The competent Portuguese authority is Comissão Nacional de Proteção de Dados (“CNPD”) www.cnpd.pt