Privacy Policy

The data controller is:

THINKONE.IO, UNIPESSOAL LDA NIPC: 514816899 Registered office: Startup Abrantes, Núcleo Nersant, Rua José Dias Simão, Sala 1, Alferrarede, 2200-062 Abrantes, Portugal Email: contact@alagoareserve.com

Depending on how you use the website, we may process:

• Your name, email address, telephone number and messages;
• Account, login and password-reset information;
• Information supplied when requesting or accessing investment materials;
• Investor eligibility, identity and compliance information, where required;
• Technical and security information, including IP address, device, browser and access logs; and
• Cookie preferences and website usage information.

Please do not send sensitive or highly confidential information through the general contact form. Where necessary, we will provide an appropriate secure channel.

We process personal data to:

• Respond to enquiries and take requested steps before entering into a contract;
• Assess and manage access to the private investor area;
• Provide investment information and manage investor relationships;
• Verify identity, investor eligibility and compliance with applicable law;
• Protect the website, its users and confidential investment materials;
• Maintain business, accounting and legal records; and
• Send marketing communications where you have consented or where otherwise permitted by law.

Our legal bases are pre-contractual steps or performance of a contract, compliance with legal obligations, our legitimate interests in operating and securing the website and managing genuine investment enquiries, and consent where required.

Providing information marked as mandatory may be necessary to process your request, grant access or meet legal obligations. Without it, we may be unable to proceed.

We do not make decisions producing legal or similarly significant effects based solely on automated processing.

Where necessary, we may share personal data with:

• Hosting, cloud storage, authentication, email and IT-security providers;
• Professional advisers, auditors and compliance providers;
• Identity, investor-eligibility or anti-money-laundering verification providers;
• Relevant companies or professional parties involved in the investment opportunity; and
• Courts, regulators, tax authorities or law-enforcement bodies where required by law.

Recipients may only use the information for the relevant purpose and under appropriate confidentiality and data-protection obligations. We do not sell personal data.

We aim to store and process personal data within the European Economic Area. If a service provider processes data outside the EEA, we use a lawful transfer mechanism, such as a European Commission adequacy decision or Standard Contractual Clauses, together with additional safeguards where required.

You may contact us for further information about the safeguards applying to a transfer.

We retain personal data only for as long as reasonably necessary:

• General enquiries: up to 24 months after the last relevant contact;
• Investor-area accounts: while active and for up to 24 months after closure or the last account activity;
• Technical and security logs: up to 12 months;
• Consent records: while consent remains valid and afterwards for as long as necessary to demonstrate compliance; and
• Contractual, accounting, investor-verification and legal-compliance records: for the applicable statutory period or as necessary to establish, exercise or defend legal claims.

After an investor-area account is deleted, we retain for up to 24 months a one-way, keyed cryptographic fingerprint derived from the account email address. We do not retain the email address itself in this record, and the fingerprint cannot be used to recover it. We use the fingerprint solely to identify a repeat registration for administrative review and to protect the integrity and security of the investor-access process. Our legal basis is our legitimate interests under Article 6(1)(f) GDPR. We do not use the fingerprint for marketing or profiling, and we do not share it with third parties. It is permanently erased when the 24-month period expires.

Where an email address has been blacklisted to prevent abuse or protect confidential materials, we may retain the readable email address for as long as reasonably necessary for that purpose. Blacklist records are not used for marketing and are accessible only to authorised administrators.

Information may be retained longer where required by law, a regulator, litigation or an active investigation.

Subject to applicable law, you may request:

• Access to your personal data;
• Correction or deletion;
• Restriction of processing;
• Data portability;
• Objection to processing based on legitimate interests; and
• Withdrawal of consent at any time, without affecting processing carried out before withdrawal.

To exercise a right, email contact@alagoareserve.com. We may request information necessary to verify your identity and will normally respond within one month.

You may object at any time to our retention and use of a registration fingerprint or blacklist record based on legitimate interests by emailing contact@alagoareserve.com. We will stop processing it unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or it is required for legal claims.

You may also lodge a complaint with:

Comissão Nacional de Proteção de Dados — CNPD www.cnpd.pt

We use strictly necessary cookies or local storage for security, authentication and essential website functions. These technologies do not require consent where they are strictly necessary for a service requested by the user.

We currently do not use optional cookies or analytics on this website. If this changes in the future, we will provide cookie settings so you can manage your preferences.

We use appropriate technical and organisational measures to protect personal data. Access to the investor area and confidential materials is restricted to authorised users. However, no internet service can be guaranteed to be completely secure.

We may update this Privacy Policy when our services, providers or legal obligations change. The date at the top identifies the current version.