PRIVACY POLICY

1. IDENTITY AND CONTACT DETAILS

Your personal data will be processed by the Company, with registered office at Avenida D. João II, n.º 98 A, 1990-100 Lisbon, registered under the single registration and legal person number 515820636 with the Lisbon Commercial Registry Office, with a share capital of €2,000.00. For any question relating to the processing of your personal data, or to exercise your rights, you may contact the Company by email at: contact@expand-strategy.com or by post to the address indicated above.

2. PURPOSES AND LEGAL GROUNDS FOR THE PROCESSING OF YOUR PERSONAL DATA

The Company only collects and processes your personal data, directly or indirectly, where:

1. It has a legitimate interest in doing so, namely for maintaining the business relationship, providing its services, or ensuring access to the platform.

2. It has obtained your consent to process your personal data for specific, explicit and legitimate purposes; and/or.

3. It is necessary to comply with applicable legal obligations.

3. DATA COLLECTION

› Registration data: name, email, username, password

› Technical and browsing data: essential cookies and analytical cookies

5. DATA RETENTION PERIOD

The Company retains your personal data only for the period necessary to fulfil the purposes that motivated its collection. Data associated with the user account will be retained for as long as the account remains active.

Should the user exercise the right to object, to erasure, or withdraw consent, in cases where consent is the basis for collection, we will proceed to delete the personal data, except where its retention is legally required.

6. RIGHTS OF DATA SUBJECTS

At any time, and by contacting the email address: contact@expand-strategy.com, the data subject may:

› Request access to the data we hold about you;

› Request rectification of the data where it is inaccurate or incomplete;

› Request the erasure of your personal data, the Company being obliged to erase it without undue delay where applicable, namely for one of the following reasons:

a) The personal data is no longer necessary for the purpose that motivated its collection or processing;

b) You have withdrawn your consent to the processing of data (in cases where processing is based on consent) and there is no other legal ground for the processing in question;

c) You object to the processing and there are no overriding legitimate grounds for the processing;

› Request restriction of the processing of your personal data;

› Object to the processing of your personal data;

› Exercise the right to data portability. In this regard, the Company will provide the data subject, upon request, with the personal data stored in a structured, commonly used and machine-readable format, and the data subject shall have the right to transmit that data to other entities;

› Where processing is based on your consent, you have the right to withdraw it at any time.

All requests will be assessed in accordance with the General Data Protection Regulation (GDPR). The data subject also has the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (National Data Protection Authority): https://www.cnpd.pt/

7. DATA SHARING

For the purposes of providing services, technical management of the platform, payment processing, data hosting and institutional communications, personal data may be shared with external service providers, namely technology service providers, hosting providers, payment services and communications providers.

This sharing is necessary to ensure the operation of the platform, the performance of contracted services, and compliance with the Company’s legal and contractual obligations.

These providers act as sub-processors and are required to comply with the GDPR, ensuring the security and confidentiality of the data processed.

We do not sell or make your data commercially available to third parties, except as provided for in this Policy or as required by law.

8. SECURITY AND CONFIDENTIALITY MEASURES

The Company undertakes to protect the personal data of its users through appropriate technical and organisational measures, aimed at preventing unauthorised access, improper disclosure or loss of information. Our systems and security policies are reviewed regularly to ensure the effectiveness of the protections implemented.

The Company respects the confidentiality of personal data and undertakes not to sell, disclose or make it commercially available to third parties, except in the cases provided for in this Privacy Policy and under applicable legislation.

9. Cookies

We use cookies that are essential to the operation of the website, functional cookies to improve the user experience, and analytical cookies for statistical analysis purposes.

You may manage your preferences on the homepage or configure your browser to block or delete cookies.

10. AMENDMENTS TO THE PRIVACY POLICY

We reserve the right to update this Privacy Policy whenever necessary. Any amendments will be published on this page, indicating the date of update.

Last updated: August 2026