Privacy Policy

Introduction

This Privacy Policy (“Policy”) sets out and governs the collection, storage, processing and disclosure of personal data obtained by POWER PARITY, S.A., a public limited company (sociedade anónima) with registered office at Rua Filipe Folque, No. 2, 1st Floor, 1050-110 Lisbon, Portugal, holding taxpayer number (NIPC) 514 373 822, which operates the electronic platform under the Goparity brand (hereinafter, “Goparity”, “we” or “Power Parity”).

Goparity is a regulated crowdfunding platform that offers crowdlending and crowdequity services, following the acquisition of the Spanish entity Bolsa Social, S.L. (“Bolsa Social”), holder of the equity crowdfunding licence. For further information on the corporate and regulatory structure, please refer to the Platform's Terms and Conditions.

In this Policy, you will find information on how Goparity uses your personal data and on your rights as a User. We recommend that you read this document carefully before creating an account or using the Platform.

The controller responsible for the processing of your personal data is Power Parity, S.A. For the purposes of data processing carried out in connection with the crowdequity services provided under Bolsa Social's licence, Power Parity and Bolsa Social act as joint controllers, pursuant to Article 26 of Regulation (EU) 2016/679 (“GDPR”). For further information, please see Section 5 of this Policy.

Use of the Goparity Platform implies that the User has read and understood this Privacy Policy. Acceptance of the Terms and Conditions is required in order to use the Platform.

‍

Definitions

For the purposes of this Policy, the following definitions apply:

a. Promoters: entities (SMEs, companies, sole proprietorships, associations, public or private institutions, other organisations or legal persons) seeking funding from Investors, in the form of a loan or equity, that have created an account on the Goparity Platform, having accepted the Terms and Conditions and this Policy;

b. Investors: natural or legal persons who make collaborative investments, through loans (crowdlending) or equity participation (crowdequity), with Promoters, and who have created a Goparity Account, accepting the Terms and Conditions and this Policy;

c. User/Client: covers the universe of Promoters and Investors as defined above. It also includes registered users who, although they have not completed any investment or project, have created an account on the Platform;

d. Visitor: a natural person who accesses and freely browses the Website available at www.goparity.com without having registered an account, and who does not establish any contractual relationship with Power Parity. The Visitor interacts with the Website anonymously, and Power Parity may, in that context, collect browsing data through cookies and similar technologies, as described in this Policy. The Visitor may also subscribe to newsletters or other Goparity communications, in which case they will voluntarily provide their e-mail address and, where applicable, other contact details, the processing of which is based on the consent given at the time of subscription, pursuant to Article 6(1)(a) of the GDPR, which may be withdrawn at any time;

e. Goparity Platform/Electronic Platform/Platform: the collaborative investment platform (crowdlending and crowdequity) managed by Goparity, accessible through the website www.goparity.com or through a mobile application developed by Goparity;

f. Terms and Conditions: the Terms and Conditions of the Goparity Platform, acceptance of which is required in order to use it;

g. Crowdequity Services: the equity-based crowdfunding services provided through the Goparity Platform, facilitated by Bolsa Social, S.L. under its authorisation from the CNMV, through which Investors subscribe equity instruments, governed by Investment Agreements;

h. Crowdlending Services: the loan-based crowdfunding services provided through the Goparity Platform, authorised by the CMVM and governed by Loan Agreements, through which Investors provide funds to Promoters on a peer-to-peer basis;

i. Power Parity: Power Parity, S.A. means a public limited company incorporated and existing under Portuguese law, with registered office at Rua Filipe Folque, No. 2 – 1st Floor, 1050-110 Lisbon, Portugal, which owns, manages and operates the Goparity Platform and holds an authorisation issued by the Portuguese Securities Market Commission (Comissão do Mercado de Valores Mobiliários) for the provision of loan-based crowdfunding services;

j. Bolsa Social: Bolsa Social, S.L. means a limited liability company incorporated and existing under Spanish law, wholly owned by Power Parity, S.A., with registered office at Hermosilla 48, 28001 Madrid, Spain, which holds an authorisation issued by the Comisión Nacional del Mercado de Valores for the provision of equity-based crowdfunding services. Bolsa Social acts as a joint controller of data processing in connection with crowdequity services, pursuant to Section 5 of this Policy;

k. Mangopay: MANGOPAY, S.A., a company registered under number B173459 in the Luxembourg Trade and Companies Register, authorised and supervised by the CSSF (Luxembourg Financial Sector Supervisory Commission), with registered office at 110, route d'Arlon, L-1150 Luxembourg (www.mangopay.com) – a provider of electronic money payment services used by the Platform;

l. GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, as implemented into national law by Law No. 58/2019, of 8 August;

m. CNPD: the National Data Protection Commission (Comissão Nacional de Proteção de Dados), the competent supervisory authority in Portugal;

n. Personal Data: any information relating to an identified or identifiable natural person, within the meaning of Article 4(1) of the GDPR Terms defined in the singular or plural may be used interchangeably, with the corresponding adaptation of meaning.

‍

Personal data collected

Goparity collects the personal data that the User provides directly, data generated through use of the Platform and, in certain circumstances, personal data obtained from third-party sources, in the following categories:

‍

3.1. Data provided directly by the User

If a natural person (Investor):

a. First and last name; date of birth; nationality; tax identification number of the country of residence; Portuguese tax identification number (NIF); e-mail address; telephone contact; address;

b. Bank account identification numbers (IBAN; others); communications with Goparity;

c. Identification documentation (copy of identity document, passport or equivalent), for compliance with know-your-customer (KYC) obligations under anti-money laundering and counter-terrorist financing (AML/CFT) legislation;

d. Information on financial situation and investment experience, for compliance with the appropriateness requirements set out in Regulation (EU) 2020/1503 (ECSPR), where applicable;

e. Any other data relevant for compliance with legal, administrative or regulatory obligations.

If a legal person (company/Promoter):

a. Corporate name; legal person identification number (NIPC); identification and data of the legal representative(s) and shareholders holding more than 25% of the organisation; e-mail address; telephone contact; address;

b. Bank account identification number (IBAN); activity with Goparity; communications with Goparity;

c. Corporate documentation and identification of ultimate beneficial owners, for compliance with AML/CFT obligations;

d. Any other data relevant for compliance with legal, administrative or regulatory obligations.

‍

3.2.Automatically collected data

Goparity automatically collects certain technical data when the Platform is used, including: IP address; browser type and version; operating system; pages visited; access dates and times; cookie data and similar technologies (see Section 9 – Cookie Policy).

This data is used for statistical, security, Platform improvement and fraud detection purposes.

‍

3.3. Data obtained from third-party sources

In certain circumstances, Goparity may obtain personal data that is not collected directly from the data subject, namely:

a. Identification and tax data of legal representatives, shareholders and ultimate beneficial owners of Promoters or Investors that are legal persons, provided by the relevant legal representative in connection with registration on the Platform and compliance with AML/CFT obligations;

b. Data obtained from public databases or authorised third-party entities, in connection with identity verification, due diligence and anti-money laundering checks;

c. Data transmitted by Mangopay or other payment service providers in connection with transaction processing;

d. Data transmitted by Bolsa Social in connection with the provision of crowdequity services.

Pursuant to Article 14 of the GDPR, Goparity informs data subjects whose data is obtained indirectly from thirdparty sources about the processing of their personal data within a reasonable period after obtaining it and, in any event, within a maximum of one month or, if the data is intended for communication with the data subject, at the latest at the time of the first communication. The categories of data processed, the purposes, the legal bases, the recipients, the retention periods and the rights of data subjects are those described in Sections 3, 4, 6, 7 and 11 of this Policy, applicable with the necessary adaptations.

Goparity does not process special categories of personal data (Article 9 of the GDPR), except where strictly necessary for compliance with legal obligations and to the extent permitted by law.

‍

Purposes of processing

Pursuant to Article 6 of the GDPR, personal data is processed for the following purposes, with the respective legal bases:

a. Management of the contractual relationship: Performance of contracts entered into through the Platform (loan agreements, subscription agreements for equity participations), pursuant to Article 6(1)(b) of the GDPR.

b. Compliance with legal and regulatory obligations: Compliance with obligations arising from AML/CFT legislation (Law No. 83/2017 and Directive (EU) 2015/849, as subsequently amended), the ECSPR (Regulation (EU) 2020/1503), tax obligations and reporting to regulatory authorities (Banco de Portugal, the CNPD, the CMVM, the CNMV and the competent Spanish authorities), pursuant to Article 6(1)(c) of the GDPR.

c. Goparity's legitimate interest: Prevention and detection of fraud; Platform security; risk management; account-related communications, pursuant to Article 6(1)(f) of the GDPR (legitimate interest). The legitimate interests pursued are, in particular: (i) the protection of the Platform and its Users against fraudulent activity, unauthorised access and security threats; and (ii) the prudent management of the operational and financial risks inherent to crowdfunding activity. The User has the right to object to this processing, pursuant to Section 11 of this Policy.

d. Marketing communications and promotion of new services: Sending communications about the Platform's products, services and features, pursuant to Article 6(1)(a) of the GDPR, which requires the User's consent, which may be withdrawn at any time, or, in the case of Users who are already Goparity clients, on the basis of the legitimate interest set out in Article 6(1)(f) of the GDPR, in conjunction with Article 13-A(2) of Law No. 41/2004, of 18 August, which dispenses with the need for prior consent for sending marketing communications relating to products or services similar to those that gave rise to the business relationship, provided that the User is given a clear and explicit opportunity to object, free of charge and in a simple manner, to such processing, both at the time the data is collected and in each subsequent communication.

e. Management of defaults and debt recovery: Reporting of facts relating to late payment or default to entities authorised to process credit risk data, pursuant to Article 6(1)(f) and (c) of the GDPR. The legitimate interest pursued consists of protecting the credit rights of Goparity and of Investors, as well as maintaining the integrity and reliability of the credit system.

f. Statistics and Platform improvement: Collection and analysis of anonymised or pseudonymised statistical data, pursuant to Article 6(1)(f) of the GDPR. The legitimate interest pursued consists of the continuous improvement of the functionality, usability and security of the Platform, as well as understanding usage patterns in order to optimise the services provided.

g. Mandatory or optional nature of data provision: The provision of certain personal data is a necessary requirement for entering into and performing contracts through the Platform, as well as for compliance with legal obligations to which Goparity is subject. In particular: (i) identification, tax and documentary data required for compliance with AML/CFT obligations constitutes a legal obligation, without compliance with which Goparity cannot establish a business relationship with the User; (ii) the data necessary to open an account and perform investment or financing contracts constitutes a contractual requirement, without which the Platform's services cannot be provided; (iii) data relating to financial situation and investment experience, when required under the ECSPR, constitutes a regulatory obligation. Failure to provide the data referred to in the preceding sub-paragraphs makes it impossible to register on the Platform, enter into contracts or provide the requested services. The provision of data for marketing purposes is optional, and failure to provide it has no consequences for the use of the Platform.

h. Automated decision-making and profiling: Goparity does not make decisions based solely on automated processing, including profiling, that produce legal effects concerning the User or that similarly significantly affect the User, within the meaning of Article 22 of the GDPR. Should Goparity implement automated decision-making processes, Users will be informed in advance pursuant to Article 13(2)(f) of the GDPR, including information on the underlying logic, the significance and the envisaged consequences of such processing.

i. Further processing for other purposes: Should Goparity intend to process personal data for a purpose other than that for which the data was originally collected, it will inform the User, prior to carrying out such processing, of the new purpose and any other relevant information pursuant to Article 13(3) of the GDPR.

‍

Joint controllership – crowdequity services

‍

5.1. Background

Following Power Parity's acquisition of Bolsa Social, the crowdequity services made available on the Goparity Platform are provided under the licence held by Bolsa Social. The processing of personal data of Investors and Promoters who use these services is carried out jointly by Power Parity (Goparity) and Bolsa Social, which act as joint controllers pursuant to Article 26 of the GDPR.

‍

5.2. Joint controllership agreement

Power Parity and Bolsa Social have entered into a joint controllership agreement pursuant to Article 26 of the GDPR, which sets out the allocation of responsibilities for the processing of personal data. The essence of that agreement is reflected in Section 5.3 of this Policy and is made available to data subjects pursuant to Article 26(2) of the GDPR. The User may request further information on the content of the joint controllership agreement through the contact details set out in Section 13.

‍

5.3. Allocation of responsibilities

Under the joint controllership agreement:

a. Point of contact for Users: Power Parity (Goparity) is the single point of contact for Users exercising their rights (access, rectification, erasure, portability, etc.) and for lodging complaints relating to data processing. The User may always exercise their rights with Goparity, regardless of which joint controller processes the data.

b. Determination of the purposes and means of processing: Power Parity determines the purposes and means of data processing in connection with the operation of the Platform. Bolsa Social determines the purposes and means of processing to the extent strictly necessary for compliance with its regulatory obligations as holder of the equity crowdfunding licence.

c. Data processed: In connection with crowdequity services, identification data, financial data, appropriateness assessment data and transaction data of Investors and Promoters are processed, pursuant to Sections 3 and 4 of this Policy.

d. Information obligations: Power Parity ensures that this Privacy Policy is made available to Users.

With regard to data processing carried out by Bolsa Social in connection with its own regulatory obligations, the competent supervisory authority is the Agencia Española de Protección de Datos (AEPD, www.aepd.es), without prejudice to the User's right to exercise their rights with Power Parity (Goparity) as the single point of contact, as described above.

‍

Processors and data recipients

‍

6.1.Processors

Goparity engages third-party service providers (“processors”) who process personal data on behalf of and for the account of Goparity, pursuant to Article 28 of the GDPR. Goparity ensures that all processors offer sufficient guarantees of GDPR compliance and enters into the legally required agreements with them. The main processors include:

a. Mangopay, S.A. – electronic money payment service provider (Luxembourg). Mangopay processes Users' personal data for the purposes of payment processing, opening of electronic wallets and compliance with its own legal and regulatory obligations (including AML/CFT). Mangopay is an independent controller with respect to the data it processes under its own legal obligations, and the precise legal characterisation of the relationship between Goparity and Mangopay (processor vs. joint controller vs. independent controller) may depend on the specific analysis of the data flows involved;

b. Hosting, cloud infrastructure, electronic communication and statistical analysis service providers. An up-to-date list of processors can be obtained upon request to Goparity through the contact details set out in Section 13.

‍

6.2. Other recipients

Goparity may disclose personal data to the following categories of recipients:

a. Regulatory and supervisory authorities: Banco de Portugal, the CNPD, the CMVM, the CSSF (Luxembourg), the competent Spanish authorities (in connection with the provision of crowdequityservices) and any other national or European authorities to which Goparity is legally required to report;

b. Group entities: companies that are in a controlling or group relationship with Power Parity, to the extent necessary for pursuing the purposes described in this Policy, such as Bolsa Social, S.L..

‍

6.3. International data transfers

Some of the processors referred to above may process personal data outside the European Economic Area (EEA). Goparity ensures that such transfers are carried out on the basis of appropriate legal mechanisms, pursuant to Chapter V of the GDPR, including: (i) adequacy decisions adopted by the European Commission pursuant to Article 45 of the GDPR; or (ii) standard contractual clauses adopted by the European Commission pursuant to Article 46(2)(c) of the GDPR, namely those approved by Implementing Decision (EU) 2021/914; or (iii) other appropriate safeguards provided for in Article 46 of the GDPR.

‍

Data retention periods and erasure rules

‍

7.1. General principle

Goparity retains personal data for the period strictly necessary for the purposes that gave rise to its collection, pursuant to Article 5(1)(e) of the GDPR (storage limitation principle). Once the applicable period has elapsed, the data is securely deleted or genuinely and irreversibly anonymised, thereby ceasing to be subject to the GDPR.

The retention of data after the end of the relationship with the User may be necessary for compliance with legal obligations that subsist independently of the will of the parties. In such cases, the right to erasure provided for in Article 17 of the GDPR cannot be exercised, pursuant to paragraph 3 of that same article.

‍

7.2. Retention periods by category of data

Personal data processed by Goparity is retained for the following periods, depending on the category of data and the legal basis of the processing. In all cases, the storage limitation principle set out in Article 5(1)(e) of Regulation (EU) 2016/679 (GDPR) applies, and data is deleted or anonymised as soon as it is no longer necessary for the purpose that justified its processing. Goparity maintains internal processes for the periodic review and deletion of personal data.

a. Data collected in connection with anti-money laundering and counter-terrorist financing (AML/CFT) obligations: retained for a period of 5 years from the date the transaction was carried out or the end of the business relationship, depending on whether it concerns, respectively, documents and information relating to occasional transactions or to an ongoing business relationship, pursuant to Article 51(1)(a) and (b) of Law No. 83/2017, of 18 August. This period may be extended up to 10 years by a reasoned decision of the CMVM or Banco de Portugal, in connection with an ongoing investigation or proceeding, pursuant to Article 51(4) of that same Law;

b. Accounting, tax and regulatory reporting data: retained for a period of 10 years, pursuant to Article 40 of the Commercial Code. For tax purposes, this period also takes into account the limitation periods for the right to assess tax set out in Article 45 of the General Tax Law and the limitation periods for tax offences under Article 52(1) of the General Regime of Tax Offences. Data covered by this sub-paragraph is retained for the longer period resulting from the cumulative application of the rules referred to above, without prejudice to the data minimisation principle;

c. Data necessary for the performance of contracts (loan agreements, subscription agreements for equity participations): retained for the duration of the contract and for the additional period necessary to exercise or defend rights in the event of a dispute, taking into account the applicable limitation periods under the Civil Code. As a general rule, a period of 5 years applies to obligations involving periodic performance, including interest and rent (Article 310 of the Civil Code), and a period of 20 years applies to capital obligations or other obligations subject to the ordinary limitation period (Article 309 of the Civil Code), without prejudice to shorter special periods applicable depending on the specific nature of the obligation. After termination of the contract, the processing of data for the purposes of defending rights is based on legitimate interest or legal obligation, pursuant to Article 6(1)(c) and (f) of the GDPR;

d. Identification and account registration data: retained for the longer period resulting from the application of the preceding sub-paragraphs, depending on the legal obligations applicable to the User's activity profile (namely AML/CFT, tax or contractual). Once the relationship with Goparity has ended and the mandatory legal retention periods have elapsed, this data will be deleted, except to the extent strictly necessary for compliance with a legal obligation or the exercise of rights in pending judicial, arbitration or administrative proceedings;

e. Browsing, cookie and technical data: retained for the period indicated in Section 9 (Cookie Policy), generally not exceeding 13 months for the duration of cookies. Data collected through cookies may be retained for different periods, depending on the specific purpose of subsequent processing, as detailed in the Cookie Policy;

f. Data processed on the basis of consent (e.g., marketing communications): retained until the consent is withdrawn by the User, pursuant to Article 7(3) of the GDPR. The User may withdraw their consent at any time, without affecting the lawfulness of the processing carried out on the basis of consent previously given. After withdrawal, the data will be deleted or anonymised within the shortest possible period, without prejudice to the retention of the minimum records necessary to demonstrate that consent was given and subsequently withdrawn, in order to comply with the accountability obligation set out in Article 5(2) of the GDPR. Goparity adopts an internal data hygiene policy providing for periodic review of the currency of its marketing databases, and may contact Users to confirm their continued interest in receiving communications, without this implying the automatic lapse of consent due to the passage of time.

‍

7.3. Periods applicable by category of User

Goparity applies the following rules, taking into account the different User profiles:

a. Case 1 – Inactive User requesting erasure: A User who created an account on the Platform but never carried out any investment, financing or contractual activity, and who requests the deletion of their account, may have their account deactivated (“soft delete”) immediately, so that it is no longer visible in the Platform's administrative area. Notwithstanding, personal data will be retained in Goparity'sdatabase for the legally required period, depending on the retention obligations specifically applicable to the User's profile, namely: (i) 5 years from the end of the business relationship, for compliance with AML/CFT obligations, pursuant to Article 51(1) of Law No. 83/2017, of 18 August; or (ii) 10 years, where applicable, for compliance with accounting and tax document retention obligations, pursuant to Article 40 of the Commercial Code. The longer period resulting from the legal obligations specifically applicable to the User's profile shall apply.

b. Case 2 – Previously active User, with no active or defaulted contracts: A User who, having been active on the Platform, does not have any active contracts or ongoing payment plans, may request the deletion of their account. This request is handled in the same manner as the profile described in sub-paragraph (a):

i. Immediate deactivation of the account (“soft delete”);

ii. Retention of data in the database for the legally required period, depending on the retention obligations specifically applicable, namely AML/CFT (5 years, pursuant to Article 51(1) of Law No. 83/2017) and tax/accounting (10 years, pursuant to Article 40 of the Commercial Code), with the longer period resulting from the legal obligations specifically applicable to the User's profile applying;

iii. Data relating to contracts already closed is retained for the legally required period, which may exceed 7 years depending on the nature of the obligation.

c. Case 3 – User with active contracts: While the User has active loan agreements or equity subscription agreements on the Platform, it is not possible to permanently delete their data, since retention is necessary for the performance of those contracts and for compliance with the associated legal obligations. Alternatively, the User may, in accordance with the Platform's Terms and Conditions, sell their position on the secondary market, where available. Completion of the sale will allow the situation to be classified under Case 2 (sub-paragraph (b)).

d. Case 4 – User with active contracts with overdue payments: While there are contracts with overdue payments associated with the User's account, it is not possible to permanently delete the data, since retention is necessary for managing the default and any subsequent debt recovery. In this case, the User may:

i. Wait for the completion of the debt recovery process or the lapse of the rights concerned, after which the situation will be classified under Case 2 (sub-paragraph (b)) or Case 5 (subparagraph (e)), as applicable.

e. Case 5 – Users with insolvent contracts: Contracts whose Promoters are insolvent are, for the purposes of this Policy, treated as closed contracts to the extent that Goparity has no active recovery action available. In these circumstances, and following confirmation of the effective closure of the process (or the impossibility of recovery), the User may request the deletion of their account, which will be handled in accordance with the profile described in sub-paragraph (b).

‍

7.4. Right to erasure: conditions and limitations

The User has the right to request the erasure of their personal data pursuant to Article 17 of the GDPR. This right may be exercised, in particular, when the data is no longer necessary for the purpose that gave rise to its collection, when the User withdraws the consent on which the processing is based, when the User objects to processing based on legitimate interest or direct marketing, when the data has been unlawfully processed, or when erasure is necessary for compliance with a legal obligation.

The right to erasure is not absolute. Goparity may refuse or defer erasure, in whole or in part, where the retention of data is necessary for:

a. Compliance with a specific and identifiable legal obligation to which Goparity is subject (Article 17(3)(b) GDPR), namely AML/CFT, tax and regulatory reporting obligations;

b. Performance of a contract in force between the User and the Platform or management of a contract not yet closed, in which case the data remains necessary for the purpose that gave rise to its collection, and the right to erasure under Article 17(1)(a) of the GDPR, a contrario, does not arise;

c. The exercise or defence of rights in judicial, arbitration or administrative proceedings (Article 17(3)(e) GDPR).

With regard to personal data obtained from third-party sources, as described in Section 3.3 of this Policy (namely data of legal representatives, shareholders and ultimate beneficial owners of Promoters or Investors that are legal persons, provided by the relevant legal representative), the data subjects concerned may also exercise the right to erasure by contacting Goparity through the means set out in Section 13. The same conditions and limitations described above apply to this data, namely where retention is necessary for compliance with AML/CFT, tax or regulatory obligations, for the performance of contracts in force, or for the exercise or defence of rights. Goparity will respond to the request within one month, which period may be extended pursuant to Article 12(3) of the GDPR.

Where the right to erasure cannot be fully satisfied, Goparity will inform the User of the specific reasons within one month of receipt of the request, a period which may be extended by a further two months in cases of particular complexity, with prior notice to the User, and will indicate, whenever possible, the period after which the data will be deleted. A User whose request is not satisfied has the right to lodge a complaint with the National Data Protection Commission (CNPD) pursuant to Article 77 of the GDPR, as well as to bring judicial proceedings pursuant to Article 79 of the GDPR.

The erasure of personal data is independent of the deactivation of the account on the Platform. Deactivation of the account means that the account is no longer accessible to the User and that internal access to the data by Goparity staff is restricted to the legally required retention purposes, but the underlying personal data is retained for the periods indicated in point 7.2, to the extent required by law. Deactivation of the account also entails the immediate cessation of any processing for marketing or commercial communication purposes, unless the User expressly renews their consent. The User will be informed of this at the time they request cancellation of the account.

‍

7.5. Data processed by the payment service provider (Mangopay)

Part of Users' personal data is processed by Mangopay, S.A., the electronic money payment service provider used by the Platform, headquartered in Luxembourg and subject to supervision by the CSSF.

Mangopay has its own legal data retention obligations, arising from payment services regulation and Luxembourg and European AML/CFT legislation, which may differ from the periods indicated in point 7.2. To the extent that Mangopay retains data under its own legal obligations, Goparity is not able to instruct its early deletion.

To exercise their rights with respect to data processed by Mangopay in connection with its own regulated activity, the User may contact Mangopay directly at dpo@mangopay.com or consult Mangopay's privacy policy available at www.mangopay.com/privacy.

‍

Data security

The security of Clients'/Users' data is one of Goparity's main concerns. The Platform implements appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration or destruction, pursuant to Article 32 of the GDPR.

The security measures implemented include, among others: encryption of data in transit and at rest; access controls; two-factor authentication; periodic security audits and testing; incident response procedures.

In the event of a personal data breach likely to result in a risk to the rights and freedoms of Users, Goparity will notify the CNPD within a maximum of 72 hours after becoming aware of the breach, and will notify affected Users without undue delay, pursuant to Articles 33 and 34 of the GDPR. Goparity will document all facts relating to the breach, its effects and the remedial measures adopted.

However, Goparity cannot be held liable for breaches resulting from unlawful conduct by third parties that circumvents the security measures implemented, or arising from acts or omissions of the User themselves (e.g., sharing access credentials).

‍

Cookie policy

Goparity uses cookies and similar technologies to collect information about the use of the Platform, with the aim of improving the User experience and the security of the Platform.

Cookies are small text files stored on the User's device (computer, mobile phone or tablet) through the relevant browser.

Goparity uses the following categories of cookies:

a. Strictly necessary cookies: essential for the operation of the Platform (e.g., authentication, session security). These do not require consent.

b. Preference cookies: store the User's preferences to improve the user experience.

c. Analytics/statistical cookies: enable the collection of statistical data on the use of the Platform (e.g., Google Analytics). These require the User's prior consent.

d. Marketing/remarketing cookies: identify previous visits to the Platform in order to display relevant advertising on third-party websites. These require the User's prior consent.

Pursuant to Directive 2002/58/EC (the “ePrivacy Directive”) and Law No. 41/2004, of 18 August, as currently in force, cookies that are not strictly necessary require the User's prior and informed consent, which may be given or withdrawn at any time through the cookie management tool available on the Platform.

The User may also control the use of cookies through their browser settings. Disabling cookies may affect the functionality of the Platform.

‍

Third-party websites

The Platform may contain hyperlinks to third-party websites. This Privacy Policy applies exclusively to the Goparity Platform and not to third-party websites. Goparity is not responsible for the privacy practices of thirdparty websites and recommends that the User read their respective privacy policies before sharing any personal data.

‍

Users' rights

Pursuant to Articles 15 to 22 of the GDPR, Users have the following rights with respect to their personal data:

a. Right of access (Art. 15): to obtain confirmation as to whether their data is being processed and to access it;

b. Right to rectification (Art. 16): to request the correction of inaccurate or incomplete data;

c. Right to erasure / “right to be forgotten” (Art. 17): to request the deletion of their data, in accordance with the terms and limitations described in Section 7 of this Policy;

d. Right to restriction of processing (Art. 18): to request the suspension of processing in certain circumstances;

e. Right to data portability (Art. 20): to receive their data in a structured, machine-readable format, where the processing is based on consent or on a contract;

f. Right to object (Art. 21): to object to processing based on legitimate interest or for direct marketing purposes;

g. Right to withdraw consent (Art. 7(3)): where processing is based on the User's consent, the User has the right to withdraw their consent at any time, without affecting the lawfulness of the processing carried out on the basis of consent previously given. Consent may be withdrawn through the means indicated in Section 13 or, in the case of marketing communications, through the unsubscribe mechanism available in each communication.

To exercise any of these rights, the User may contact Goparity through the means indicated in Section 13. Goparity will respond to the request within one month of the date of receipt, pursuant to Article 12(3) of the GDPR. This period may be extended by up to two months where necessary, taking into account the complexity and number of requests, and Goparity must inform the User of the extension and the reasons for it within one month of receipt of the initial request.

The User also has the right to lodge a complaint with a supervisory authority, pursuant to Article 77(1) of the GDPR, namely with the supervisory authority of the Member State of their habitual residence, place of work, or the place where the alleged infringement of the GDPR occurred. For Users resident in Portugal, the competent supervisory authority is the National Data Protection Commission – CNPD (www.cnpd.pt). Where the User's personal data is processed by Bolsa Social in connection with crowdequity services under its own regulatory licence, the User may also lodge a complaint with the Agencia Española de Protección de Datos – AEPD (www.aepd.es), with respect to such specific processing. The exercise of the right to complain with any supervisory authority is without prejudice to recourse to any other administrative or judicial remedy, pursuant to Articles 78 and 79 of the GDPR. For all purposes, Power Parity (Goparity) remains the single point of contact for the exercise of rights, as described in Section 5.

‍

Changes to the privacy policy

Goparity reserves the right to amend this Privacy Policy. Any change will be communicated to Users at least 15 days in advance, by e-mail or through notification on the Platform. The updated version will always be made available on the Platform, indicating the date of the last update.

Continued use of the Platform after non-substantial changes take effect implies that the User has taken note of them. If the User does not agree with the changes, they may request the cancellation of their account pursuant to Section 7 and exercise their other rights set out in Section 11.

‍

Contacts, complaints and data protection officer

For questions, the exercise of rights or complaints relating to the processing of personal data, the User may contact Goparity by e-mail at support@goparity.com.

Goparity will respond to all requests within one month of the date of receipt, pursuant to Article 12(3) of the GDPR. This period may be extended by a further two months where the request is complex or in the event of a high number of requests, and Goparity must inform the User of the extension and the reasons for it within one month of receipt of the request.

If the User is not satisfied with Goparity's response, they may lodge a complaint with the CNPD (National Data Protection Commission), Av. D. Carlos I, 134 – 1st Floor, 1200-651 Lisbon, www.cnpd.pt. With regard to data processing carried out by Bolsa Social in connection with its own regulatory obligations as holder of the equity crowdfunding licence, the User may also lodge a complaint with the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan, 6, 28001 Madrid, www.aepd.es.

‍

General provisions

This Privacy Policy, originally drafted in Portuguese, and the relationship between Goparity and Users in data protection matters, are governed by the GDPR, Law No. 58/2019, of 8 August (the national law implementing the GDPR), Law No. 41/2004, of 18 August (the law on privacy in electronic communications), as currently in force, and other applicable national and European data protection legislation.

‍

Last updated: July 2026