Privacy and data protection

Privacy & Data Protection

Since the procedure explicitly mentions the DPO (Data Protection Officer) and strict
adherence to GDPR, we need a dedicated document or popup text for this.

‍

Privacy Policy for Whistleblowing Channel

‍

1. Data Controller

The entity responsible for processing your personal data is MYRENEGADE, UNIPESSOAL LDA("Company"), with a registered office at Rua Joshua Benoliel No1, 6od 1250-273 Lisboa, Portugal.

‍

2. Purpose and Legal Basis

We process your personal data for the sole purpose of receiving, investigating, and managing reports of misconduct in accordance with our legal obligations under Law No. 93/2021 and EU Directive 2019/1937. The legal basis
for processing is compliance with a legal obligation and the legitimate interest of the Company in detecting and preventing illegal or unethical activities.

‍

3. Types of Data Collected

• Identification Data: Name, contact details, and position (unless you choose to report anonymously).
• Report Data: Information regarding the facts reported, including evidence and the identity of any persons involved.
  ‍

4. Confidentiality and Recipients t

Your data will be treated with the strictest confidentiality. Access is restricted to authorized personnel involved in the investigation, specifically the Chief Compliance Officer (CCO), the investigation team, and, if necessary, external legal counsel or the DPO. We do not share your data with third parties unless required by law (e.g., sharing with the Public Prosecutor's Office or Banco de Portugal).
‍

5. Data Retention

• Unfounded Reports: Personal data will be deleted immediately if the report is deemed to clearly lack any substance.
• Investigation Records: Reports and investigation files are kept for a period of 5 years (in accordance with Article 19 of Law No. 93/2021) or until the conclusion of any judicial proceedings.

‍

6. Security Measures

We implement advanced technological security measures, including encryption and secure servers, to protect your data from unauthorized access or leaks.

‍
7. Your Rights

Under the GDPR, you have the right to access, rectify, or erase your personal data, and to restrict or object to its processing. However, these rights may be limited if they jeopardize the confidentiality of the investigation or the protection of other
involved parties. To exercise these rights, please contact our Data Protection Officer (DPO) at: [email protected]
‍

8. Right to Complain

You have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD) if you believe your data rights have been violated.