Stone Capital Group’s Privacy Policy

This Privacy Policy (“Policy”) is governed by the legislation applicable to matters relating to data protection, specifically, those included in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (“GDPR”), applicable as of 25 May 2018.

1. Our Commitment to Protecting Personal Data

Bronzeventure, Lda, with registered offices at Avenida da Liberdade, no. 240, 5th floor, 1250-148 Lisbon, registered before the Commercial Registry with Tax Number 510892876 (hereinafter, the “Company” or “Data Controller”) is the entity responsible for the activities pertaining to the treatment of personal data carried out by the companies comprising the Stone Capital Group, namely, the Company and all companies directly or indirectly by it controlled (hereinafter “ Stone Capital Group”).

This Policy applies to the treatment of personal data carried out by the companies comprising the Stone Capital Group. The object of this treatment is the personal data made available voluntarily by the respective Data Owners - primarily Stone Capital Group clients, prospective clients, business partners, suppliers who are natural persons, or in the case of suppliers that are companies, representatives thereof, or persons acting on behalf of such companies, employees of competent administrative entities that interact with Stone Capital Group, and the users of the respective websites; or personal data made available to Stone Capital Group entities through subcontractors for third parties whose data owners are prospective clients or persons involved in the development of real estate operations carried out by Stone Capital Group (hereinafter referred to together as “Data Owners”).

In its capacity as data controller, the Company ensures the privacy and protection of the personal data object of treatment by all companies comprising the Stone Capital Group and in this context shall act in agreement with the applicable law, specifically, the new Regulation.

This Policy aims to provide Data Owners with the necessary information regarding the treatment of their personal data.

2. What Personal Data Do We Treat?

The companies comprising the Stone Capital Group treat the following categories of personal data,

(i) Client and prospective client data

Identification and contact data included in the property reservation form of properties, all data required for the purposes of entering into agreements in connection with their real estate projects in respect of clients that enter into such agreements with the companies comprising Stone Capital Group, as well as information regarding transactions already completed by clients with the companies comprising Stone Capital Group.

(ii) Business Partners

Identification data, including professional data, and contact data, specifically of real estate agents or representatives, employees and consultants who act on behalf of entities in the real estate sector, including real estate developers, real estate brokers, expert real estate valuers and investors.

(iii) Competent Administrative Entities

Identification data, including professional data and contact data, specifically of professionals with duties in public bodies directly or indirectly run by the State or in local councils or notary and corporate or civil registries, concessionaires of public services and other entities providing public services that are relevant to the development of the real estate projects developed by Stone Capital Group.

(iv) Suppliers

Identification data, including professional data and contact data, specifically of, technicians or service providers who provide goods and services to the companies comprising the Stone Capital Group, including engineers, architects or representatives, employees of entities who provide goods and services to the companies comprising the Stone Capital Group, including contractors, lawyers, valuers, planners and archaeologists.

(v) Stone Capital Website Users

The type of personal data we collect and treat from the use of our website comprises is a result of the information provided by the Data Owner when registering to the brochure receive in our website and in which consists of identification and contact data.

Additionally, the Stone Capital website uses function and analytic to collect information regarding its users, in order to improve and customize the browsing experience, as well as to track the use and efficiency of Stone Capital’s website. The activation of these features will be subject to explicit consent from the Data Owner.

Some cookies used by Stone Capital allow for the integration and flow of data to social media such as LinkedIn, Facebook and Instagram, redirecting website users to these social media webpages. Social media operators use their own cookies and may also use pixel, web and other storage tools to collect and/or receive information from the website and use such information to measure the service and direct advertisements.

Stone Capital hereby informs that we have no control whatsoever, nor exercise any influence over, social media operators or over the respective privacy and security policies, and users should inform themselves appropriately of those policies.

The Stone Capital website also contains content saved on external websites and the entities responsible for the provision of the content on the Stone Capital website may use cookies (“Third Party Cookies”). The interaction with such content may generate the inclusion of Third-Party Cookies from Stone Capital’s website and Stone Capital has no control over how such cookies are used. Therefore, we suggest that you confirm how such cookies are used and managed on the respective websites.

To learn more about cookies, please visit — https://www.allaboutcookies.org/.

(vi) Workers and Employees of Stone Capital Group companies and candidates who submit their CVs thereto.

We do not voluntarily or knowingly treat children’s personal data for marketing purposes. If we learn that we have collected children’s personal data for marketing purposes, we will immediately delete such data. If you know that we have collected or treated children’s personal data, we kindly ask that you contact us.

3. How do we collect and treat your personal data and for what purposes?

We collect personal data from Data Owners whenever:

(i) Data Owners contact us spontaneously and request information regarding products sold by Stone Capital Group companies, and to that end voluntarily complete a client form or provide us with their data so that one can be completed;

(ii) Contact is made with clients and prospective clients who seek to acquire any product we might have to offer; specifically by completing the required reservation form; when collecting the necessary information to enter into any agreements relating to their real estate projects, and through the information regularly provided by Stone Capital Group to its clients regarding the status of the projects in which they are involved;

(iii) Real estate brokers for which the Company is a subcontractor, provide data for the purposes of determining the source of Stone Capital Group’s client acquisition;

(iv) Contacts are established with competent administrative entities, including in particular, notary offices and registries, concessionaires or other entities providing public services such as EDP, EPAL, firefighters, etc. within the scope of the execution of the real estate projects developed by the Stone Capital Group, as well as for preparation of sales transactions or other forms of sales of the Group’s real estate projects;

(v) The Data Owners are business partners, real estate brokers or suppliers - personal data will be collected through the contact details provided, resulting from the contractual relationship under the scope of which the personal data will be treated by the Group;

(vi) The Data Owner registers to receive our newsletter to obtain news and information regarding the real estate products we sell. Upon registration we collect your email for the exclusive purpose of sending you information on the projects being developed by the Stone Capital Group;

(vii) The Data Owner explicitly authorizes their data to be collected in the context of the use of Stone Capital’s website;

(viii) We receive CVs via e-mail or any other medium from candidates interested in employment opportunities at any of Stone Group’s companies.

4. Why do we treat your data?

Data Owner’s personal data is treated by the Stone Group companies for the following purposes:

(i) To fulfil provisions in contractual relationships that the Stone Group entities establish with their clients, including, in particular, preparation of reservation documents for real estate products sold by the Stone Capital Group and documents evidencing the transactions of their real estate projects, invoicing and information regarding the status of the projects in which the clients are a party to;

(ii) Compliance with legal obligations to which we are bound and which require the treatment of Data Owner’s personal data, specifically for licensing and development of real estate projects sold by Stone Capital Group for tax and accounting purposes, for compliance with identification and diligence duties regarding the entities with whom we enter into transactions and which may involve, if legally required, transmitting Data Owners’ personal data to competent administrative entities;

(iii) To provide relevant information regarding its projects as well as for the purposes of marketing/sending promotional information for publicity and sales of development projects, the latter relating to Data Owners who have consented thereto;

(iv) For the management and execution of contractual relationships with business partners, real estate brokers and suppliers;

(v) To improve and customize the browsing experience on Stone Capital’s website, monitor the use and efficiency of content and analyse traffic;

(vi) To select employees in the context of professional recruitment procedures;

(vii) To verify client acquisition sources.

5. What are the grounds for the Data Controller to treat your personal data?

Stone Capital Group collects and subsequently treats Data Owners’ personal data on the grounds of

(i) Establishing a contractual relationship or performing pre-contractual tasks with Data Owners under the scope of established relationships with its clients, or prospective clients, in order to reserve real estate products as requested by them, or the arrangement and execution of sales operations or other forms of selling its real estate products;

(ii) Establishing a contractual relationship or performing pre-contractual tasks with business partners, real estate brokers or suppliers. Whenever such entities are companies, the Data Owners shall consist of representatives or the point of contact for such entities;

(iii) Pursuing a legitimate interest for treating data, safeguarding the rights and liberties of Data Owners, including treatment required for the purposes of contacting competent administration entities within the scope of Stone Capital’s real estate project development, and reviewing CVs in recruitment processes;

(iv) Complying with legal and regulatory obligations, in particular, complying with identification and diligence duties arising from the legislation on money laundering and terrorist financing; or

(v) Promoting and marketing the Company’s products, upon willing, explicit and knowledgeable consent by Data Owners, including publicity activities for products marketed by Stone Capital and sending its newsletter.

6. Who do we share your personal data with?

Data owners’ personal data may be transmitted by the Stone Capital Group to legal, tax and regulatory authorities in order to comply with legal or regulatory obligations in connection with the real estate development activities carried out by Stone Capital Group.

When carrying our real estate development activities, whenever so required under the scope of the projects, we also share Data Owners’ personal data with lawyers, notaries, public administration entities, financing entities, accountants, financial advisors, and valuers.

Whenever Stone Capital Group transmits personal data of a Data Owner to a third party, the transmission shall include a commitment for use of such data for specific purposes only.

7. The Security of Personal Data

Your personal data is secure with us as we shall always be committed to adopting appropriate technical and organizational measures to protect your data against possible abusive use or unauthorized access.

8. How long do we keep your data?

Stone Capital Group shall keep your personal data for the time required to carry out the purposes for which the data was collected, specifically:

(i) Personal data of Data Owners which is treated by the Stone Capital Group companies in the context of compliance with contractual obligations established with its clients, prospective clients, business partners, suppliers or points of contact of such suppliers when such suppliers are companies, shall be kept for the duration of the respective contractual relationships and until such contracts are extinct by any means, including expiration of the rights arising therefrom;

(ii) Personal data of Data Owners which is treated by the Stone Capital Group to fulfil legal obligations shall be kept for the duration of the legal obligations that determine the respective treatment thereof;

(iii) Personal data of Data Owners which is treated by the Stone Capital Group for the purposes of providing information regarding its projects, shall be kept for the duration of such communications to which shall accrue a prudential and reasonable period of conservation;

(iv) The personal data of Data Owners which are treated by the Stone Capital Group for marketing purposes shall be kept for a period of three years as of the date on which explicit consent was given by the Data Owner.

9. What are the rights of the Data Owner?

Data Owners may exercise their right to access, correct, or delete their personal data as well as transfer, limit or oppose treatment of data under applicable law, by sending an email to the following email address — proteçãodedados@stonecapital.pt — addressed to the point of contact for Data Protection in the Company.

In cases where the treatment of data by the Stone Capital Group is based on the consent of the respective Data Owner and consent is revoked, the treatment of such personal data must cease within the shortest period of time possible following receipt by the Data Controller of the notice sent by the Data Owner to the email address specified above, for such purpose.

The Company undertakes to take all the necessary security measures to safeguard users’ personal data against abusive or unauthorized use.

In the event of any violation of their personal data, data owners are entitled to be notified under the terms provided for in the Regulation.

Even if the Data Controller adopts all best practices for data protection, under the terms established in the applicable legislation, data owners are entitled to file a complaint regarding the treatment of data by Stone Capital before the Comissão Nacional de Proteção de Dados (National Commission on Data Protection), the contacts for which can be found at www.cnpd.pt

Contact details to exercise rights of Data Owners

Data Controller

Bronzeventure, Lda

Av. da Liberdade nº 240 5º

1250 – 148 Lisboa

Point of Contact for Data Protection – proteçãodedados@stonecapital.pt