Privacy Policy

Effective date: 24 August 2026

1. Controller and contact

The controller is Leblon Capital, Lda, NIPC 515 030 457, with registered address at Rua do Cibrão, 60, 2750-025 Cascais, Portugal. Privacy enquiries and requests concerning personal data may be sent to admin@lebloncapital.pt.

This policy is governed by Regulation (EU) 2016/679 (the General Data Protection Regulation or “GDPR”) and Portuguese Law no. 58/2019 of 8 August, together with other applicable Portuguese and European data-protection rules.

2. Personal data we process

Depending on the interaction, Leblon Capital may process name, email address, telephone number, company or professional information, information submitted in correspondence, portal-registration and access data, project or tender permissions, authentication events, IP addresses and security or document-access logs.

Portal passwords are not available to Leblon Capital in readable form. Authentication credentials are handled using WordPress security mechanisms.

3. Purposes and legal bases

Data may be processed to: respond to enquiries; assess and administer investor, supplier or contractor access; manage contractual or pre-contractual relationships; provide project or tender documentation; protect the website, portals and confidential information; maintain access and security records; comply with legal, regulatory, accounting, tax, anti-money-laundering or other compliance obligations; and establish, exercise or defend legal claims.

The applicable legal basis may include Article 6(1)(b) GDPR (contract or pre-contractual steps), Article 6(1)(c) GDPR (legal obligation), Article 6(1)(f) GDPR (legitimate interests, including business administration, information security, access control and protection of legal rights), and Article 6(1)(a) GDPR where consent is specifically requested for an optional purpose.

4. Recipients and processors

Personal data may be accessed by authorised persons acting for Leblon Capital and by service providers supporting hosting, email delivery, IT administration, security, professional advice or other systems required for the stated purposes. Access is limited according to need and, where required, providers act under appropriate contractual obligations.

Personal data may also be disclosed where required by law or to competent public, judicial, supervisory or regulatory authorities.

5. International transfers

If personal data are processed outside the European Economic Area, Leblon Capital will rely on an applicable lawful transfer mechanism, such as an adequacy decision or appropriate safeguards including standard contractual clauses, where required by the GDPR.

6. Retention

Personal data are retained only for the period necessary for the relevant purpose. The applicable period is determined by the duration of the business or portal relationship, the need to maintain security and access records, applicable statutory retention duties, limitation periods and the need to establish, exercise or defend legal claims. Data that are no longer required are deleted or anonymised, subject to lawful retention obligations.

7. Data-subject rights

Subject to the conditions of applicable law, individuals may request access, rectification, erasure, restriction of processing or portability of their personal data, and may object to processing based on legitimate interests. Where processing is based on consent, consent may be withdrawn at any time without affecting prior lawful processing.

Requests may be sent to admin@lebloncapital.pt. Individuals also have the right to lodge a complaint with the Portuguese supervisory authority, Comissão Nacional de Proteção de Dados (CNPD).

8. Security

Leblon Capital applies technical and organisational measures appropriate to the nature of the information processed. Private-portal measures include individual accounts, password-based authentication, email verification, project- or tender-specific permissions, protected document delivery and activity logging. No internet service can be guaranteed to be completely secure.

9. Automated decision-making

The website and private portals are not intended to make decisions producing legal or similarly significant effects solely by automated means.

10. Changes to this policy

This policy may be updated when the website, portals, service providers, legal requirements or processing activities change. The current version and effective date will be published on this page.