1. Scope of application

This Privacy Policy applies to the personal data of interested parties, potential clients and real estate clients, processed by EDP Real Estate Global Solutions SA (hereinafter “EDP Real Estate”) in the context of real estate sales, which is provided to it through websites, email or postal boxes or any other communication and registration process.

The EDP Real Estate website, as well as the real estate websites with which it has collaboration protocols, aims to present the EDP properties on sale and facilitate communication with those interested in these properties, allowing interested parties to request additional information about the properties or visit them, and possible consequent real estate transaction.

2. Entity Responsible for the Processing of Personal Data and Commitment

The person responsible for processing the data for the Purpose of Trading Assets is:

• EDP Real Estate Global Solutions, SA, with the unique registration number at the Commercial Registry Office and legal person 503529524, headquartered at Avª José Malhoa, nº 25, 1070-157 Lisbon, PORTUGAL, with the share capital of 10.000.000,00 Euros.

EDP Real Estate is committed to respect the privacy of subjects' data and the protection and security of their personal data, and believes that the responsible use of collected personal information is fundamental to the pursuit of business and reputation goals.

As part of our commitment to privacy, we have adopted this Privacy Statement, which aims to inform data owners about how EDP Real Estate handles personal data provided to it through websites, contact mailboxes and/or through any communication and registration process.

EDP Real Estate follows the EDP Group's technological and operational security policies and procedures for data protection against loss, misuse, alteration or unintentional destruction. EDP employees with access to personal data were trained to maintain the confidentiality of such information.

3. Duties of data owners

The Data Holder or their legal representative should carefully read this privacy policy, which was written in a clear and simple way, to facilitate its understanding. 

The Data Holder or their respective legal representative guarantees that the communicated data is true, accurate, complete and current, being responsible for any direct or indirect damage or loss that may arise as a result of non-compliance with such obligation, also committing to rectify or update their personal data or communicate the necessary changes to EDP, whenever necessary. 

If the communicated data belongs to a third party, it is the responsibility of the person who communicates the data to ensure that they are legally entitled to provide such data, must also inform that third party about the conditions provided for in this document and ensure that they have obtained their authorization to provide their data to EDP under the conditions, and for the purposes, indicated in this Policy. 

4. Data processing purposes and legal basis

EDP will handle the data of the Holders, in a manual and/or automated fashion, with respect for the principles of lawfulness, loyalty and transparency.

Treatments for the following purposes are necessary as a result of the legitimate interest arising from a contractual or legal relationship:

• Asset Trading - Negotiation and Sale, based on the lawfulness of legitimate interest arising from a contractual or legal relationship;
• Law on Prevention and Fight Against Money Laundering.

EDP will process the personal data of the Holders, based on their consent, for the following processing purpose:

• Asset Marketing – Communication, Marketing and Advertising – Communication of available properties, directly or through real estate agents, to potential customers who are interested and use of a database of contacts collected by the various means to publicize EDP properties on sale. 

EDP will process the data of the holders, collected through websites, electronic or postal mailboxes or through any other communication and registration process, for the following purposes previously identified.

The data requested in the forms provided by EDP will be mandatory - except for those that may have a similar function - in order to fulfill the contractual or legally established purpose.

5. Categories of processed personal data

Within the scope of the Processing Purpose "Assets Marketing - Trading and Sale", all data provided by the holder will be processed, namely Telephone (mobile or landline), E-mail, Address, Tax Identification Number (NIF), Name, Number of Citizen Card, Identity Card and/or Passport, Date of Birth, District of Birth, NIB/IBAN, Marital Status and Contract Company, to carry out real estate operations in which the holder is an interested party.

Within the scope of carrying out the Due Diligence procedure, steps are taken to identify: i) the presence on international sanctions lists; ii) qualification as a Politically Exposed Person (hereinafter PEP) or possible association with persons classified as PEP; iii) existence of references in terms of adverse media with potential negative reputation impacts for the EDP Group; iv) involvement in ongoing legal proceedings and/or convictions and v) identification of possible conflicts of interest.

The processing of personal data within the scope of the performance of Due Diligence procedures is based on: i) the fulfillment of legal obligations, in cases where EDP is considered an obligated entity under the terms of Law No. 83/2017, dated August 18th, (Law to Fight Money Laundering and Terrorism Financing), which is carried out with the aim to prevent money laundering and terrorist financing. The Due Diligence procedure will not involve any decision taken solely on the basis of the automated processing of personal data, being always dependent on a decision and intervention humana.No within the scope of the Processing Purpose "Marketing of Assets - Communication, Marketing and Advertising", the identification and contact information data will be processed, such as Name, Telephone (mobile or landline) and E-mail of potential clients (interested in real estate), clients for marketing actions or direct advertising on the properties marketed by EDP - in order to make the investment opportunities known - until the opposition of the receiving of this information by the data holder.

6. Subcontracting and Recipients

EDP Real Estate does not share personal data with third parties, except at the request of the data holder or their legal representative or as required by law or other legal processes, and never sells personal data.

EDP Real Estate has a contract for the provision of development and maintenance services for the EDP Website, here, in which the provider is obliged to comply with current legislation on data protection.

Personal data from the portfolio of interested parties in EDP real estate, as well as potential customers or real estate customers, may be provided under the terms of an effective service provision contract, to the website maintenance company and to the companies of the EDP Group to perform accounting, financial and administrative operations, namely customer service, and when necessary to carry out agreed business or to carry out operations associated with the aforementioned purposes. These companies will act in accordance with the instructions of EDP Real Estate and for the described purposes.

Personal data may also be provided to other Entities under legal or contractual obligations.

7. Retention period

EDP Real Estate will keep the personal data of customers and suppliers for a period of 7 years in the case of data collected for the purposes of prevention of money laundering, and for 20 years after the contract is signed, the data relating to the negotiation and sale of real estate. All documents that prove ownership rights (i. e. contractual title or ownership title) should be discussed for as long as necessary. In the case of potential customers (interested in real estate), the data will be kept until the holder objects to being contacted or withdraws his consent, in cases where the holder requested the communications and/or was informed that the data will be used for this purpose.

8. International Data Transfer

EDP Real Estate does not intend to transfer personal data relating to these processing purposes to countries outside the European Economic Area. 

9. Consent and Revocation

EDP asks the Subjects of personal data for free, informed, specific and unambiguous explicit consent for the processing of data for purposes that require it.

The acceptance by the Holder that their data can be processed or transferred will always be revocable, without retroactive effect. 

To revoke said consent, Holders may contact EDP through the aforementioned channels for the Exercise of Rights.

10. Security and Integrity

Personal data will be processed by EDP in the context of the purposes identified in this Policy, in accordance with EDP's internal policies and rules, and using technical and organizational measures designed in accordance with the risks associated with the specific processing of personal data. 

The technical and organizational measures designed ensure, to the maximum possible extent, the security and integrity of personal data, namely in relation to unauthorized or unlawful processing of the Holders' personal data and the respective accidental loss, destruction or damage.

11. Confidentiality

EDP recognizes the confidential nature of the data shared by its Holder. 

EDP does not commercially or otherwise make personal data available to any third party, undertaking not to disclose, copy, reproduce or distribute any part of the Confidential information, without the prior written consent of the Data Holder.

EDP preserves the confidentiality and integrity of Data Owners and protects them in accordance with this Privacy Policy and laws in force.

12. User Rights

The Owner of the personal data processed by EDP, or its legal representative, has the right of access, rectification, limitation, portability, deletion and the right to object to the processing of personal data, in certain circumstances, which may be exercised in the terms of this chapter of the Privacy Policy:

• Right to provide information means that the Data Subject has the right to obtain clear, transparent and easily understandable information about how EDP uses their personal data and what their rights are. 
• Right of access means that the Data Subject has the right to obtain information about the personal data that EDP processes and certain information about the way in which this Data is processed. This right allows the Data Holder to know and confirm that EDP handles their Data in accordance with data protection laws. EDP may, however, refuse to provide the requested information whenever, in order to do so, it has to reveal the personal data of another person or the requested information violates the rights of another person.
• Right of rectification means that the Data Holder has the right to request EDP to take reasonable steps to correct their personal data that is incorrect or incomplete.
• Right to data deletion also known as the "right to be forgotten", means that the Data Subjects may request the deletion or elimination of their data, provided that there are no valid grounds for EDP to continue to use them or when its use is unlawful.
• Right to limit processing means that the Data Subject has the right to have their data processed, with the exception of their conservation, with their consent or for the purposes of declaration, exercise or defense of a right in a legal process, defense of the rights of another single or legal entity, or for substantial reasons of public interest of the Union or of a Member State, while EDP assesses a request for rectification or as an alternative to deletion.
• Right to data portability means that the Data Holder has the right to obtain and reuse certain personal data for their own purposes. This right only applies to personal data that have been provided by the Data Holder directly to EDP, based on a contract or consent and which EDP processes through automated means.
• Right of opposition means that the Data Subject has the right to object to certain types of processing, for reasons related to their particular situation, at any time that such Processing takes place.
• Right of complaint means that the Data Subject has the right to file a complaint with the competent supervisory authority, the National Data Protection Commission (CNPD), if they consider that the Processing carried out on personal data violates his/her rights and/or applicable data protection laws.

The Data Holder may exercise their rights through the channels made available for this purpose:

• Postal Mail: Av. José Malhoa, 25, 1070-157 Lisbon 
• easy4U Helpline: Through the telephone contact 800 100 113 or through the platform for data holders with duly authorized access.
• If the requests submitted by the Data Subject or their legal representative are manifestly unfounded or excessive, namely due to their repetitive nature, EDP may demand the payment of a reasonable fee taking into account the administrative costs of providing the information, communication and taking the requested measures or refusing to comply with the request.

In either case, the Holder will be informed that, if they consider that EDP has violated the rights they have under the applicable data protection legislation, they may file a complaint with the corresponding Supervisory Authority.

13. Changes to the Privacy Policy

EDP reserves the right, at any time and without prior notice and with immediate effect, but without prejudice to the legal rights granted to the Data Holders, to change, add or revoke, partially or totally, this Privacy Policy. Any changes will be immediately disclosed in the commonly used communication channels.

If EDP substantially changes the way it treats your personal data and, therefore, this Privacy Policy, it will notify the Data Holder of said changes through the contact means it has obtained.

For any question related to this privacy policy, the Data Holder, or their legal representative, may contact the EDP Data Protection Officer (DPO) dpo.pt@edp.com through the following email: EMAIL-0; in the case of EDP Distribuição, the email address dpo.edpdistribuicao@edp.com should be considered; in the case of SU Electricity, the email address dpo@sueletricidade.pt should be considered. 

This Privacy Statement was last updated on June 29, 2021.