TODOS & COMPANY Privacy Policy

1. About this Privacy Policy

We, the TODOS & COMPANY Group of companies, comprise the following companies:

and we are responsible for the protection of personal data. This Privacy Policy applies to all companies that are part of the Group.

Below, the name “Todos & Company” will be used to refer to all the companies in the group.

The purpose of this Privacy Policy is to explain, in a simple and transparent way, what types of personal data we collect about you, how we process it and how we store it. This policy applies to the following persons:

• All former, current and potential clients of Todos & Company who come into contact with one of the companies in the group or with the Group as a whole. We have a legal obligation to retain the data we collect about you, including for a certain period of time after the relationship has ended.

Personal data means any information that tells us something about you or that we can link to you. It includes your name, address, date of birth, account number, IP address or information about payments you have made from your bank account.

Processing means all the operations we may carry out on data, such as collecting, recording, storing, adjusting, organising, using, disclosing, transferring and erasing it. You give us personal information when you become a client, register for our online services, complete an online form, sign a contract, use our products and services or contact us through one of our channels.

We also use data that is lawfully available from public sources or the media, or that is legitimately provided by other companies or third parties.

2. The types of data we collect about you.

The personal data we collect includes:

• Identification data, such as your surname, first name, date and place of birth, personal numeric code, e-mail address and the IP address of your computer or mobile device, postal details and other information used to send a document, billing data, as well as where postal or courier services are provided through one of our partner carriers.
• Financial information, such as bank account numbers for transfers following transactions.
• Computer and connection information, such as page view statistics, traffic to and from sites, referring URL, IP address and browsing history.
• Video and audio information for promoting the company.

Personal information collected from other sources

• Social media. We allow you to share information on social networking sites (e.g. Facebook). These sites may give us automatic access to certain personal information they hold about you (e.g. your e-mail address). By linking an account managed by a social networking site to your account with us and authorising us to access this information, you agree that we may collect, use and retain the information provided in accordance with this privacy agreement.
• If you provide us with personal information about another individual, you must do so only with that person's consent. You must inform them how we collect, use, disclose and retain personal information in accordance with this privacy agreement.

Sensitive data

We do not record sensitive data about your health, ethnic origin, or religious or political beliefs, unless this is absolutely necessary.

Minors' data

The content of the website and of the information promoted by Todos & Company is not intended for minors, but it is not harmful to them. We do not collect information or data from minors under 16.

3. What do we do with your personal data?

We use your personal data only for legitimate business purposes. These purposes include:

• Administration. When we conclude a Service Provision contract between the Provider and the Beneficiary, we have a legal obligation to collect the personal data that verifies your identity (for example, a copy of your identity card or passport) and to assess whether we can accept you as a client. We also need to know your address and telephone number so that we can contact you.
• Provision of products and services. We use information about you in order to assess whether you are eligible for certain funding lines.
• Personalised marketing. We may send you letters, e-mails or text messages to offer or suggest that you purchase a product or service based on your personal circumstances.
• Provision of the most suitable products and services. When you visit our website, call our offices or visit one of our offices, we collect information about you. We analyse this information to identify your potential needs and to assess the suitability of products or services. For example, we may suggest investment opportunities suited to your profile.

We may use your data to send you personalised offers by post, e-mail or on our website. You have the right to object, at any time, to commercial or direct marketing activities, provided that this does not conflict with contractual clauses providing otherwise.

• Fraud prevention and detection and data security. We have a duty to protect your personal data and to prevent, detect and limit data security breaches. This includes information that we are required to collect about you, for example for the purpose of complying with regulations on combating EU funds fraud, the financing of terrorism or tax fraud.

For all types of data that we process for any purpose, we try to reduce, or even avoid as far as possible, the collection and processing of personal data.

4. With whom do we share your data, and why?

We may disclose information about you or your personal data to third parties.

This disclosure of data may be necessary so that we can give you access to our services, so that we can fulfil the subject matter of the contract, or where the input of a third party is absolutely necessary for the provision of the service. We may also disclose information or personal data in order to comply with national legal obligations, to optimise our marketing and advertising activities, or to prevent, detect, mitigate and investigate fraudulent or unlawful activities related to our services. We also try to limit the amount of personal information we disclose to what is directly relevant and necessary to achieve the specified purpose. We do not sell, rent or otherwise disclose your personal information to third parties for marketing and advertising purposes without first obtaining your consent.

Todos & Company partners and service providers as follows:

We transfer data within the offices or companies of the Todos & Company Group for operational, regulatory or reporting purposes. For example: to carry out checks on new clients or to provide certain services.

Where we use other service providers, we share only the personal data that is strictly necessary for carrying out a particular task or service.

Service providers support us with activities such as:

Courier services, debt recovery, certification services, transport services, internet services, e-mail messaging services, mobile telephony services, bank payment services, marketing services, IT maintenance, website administration, occupational health and safety services, or services for issuing value vouchers.

In all these cases, partners or service providers choose to comply with the European data protection regulation.

Sales representatives

We share information with independent agents acting on our behalf. These agents are registered in accordance with local legislation and operate under a collaboration contract, in compliance with the clauses of the Data Protection Regulation.

Whenever we share your personal data internally, or with third parties, collaborators or service providers, we take the necessary safeguards to protect it.

5. Your rights and how we respect them

We respect your rights as a client or business partner, and in order to set out transparently how your personal information is used, we inform you that your rights are as follows:

• The right to access information

You have the right to request a report of the personal data of yours that we process.

• The right to rectification

If your personal data is incorrect, you have the right to ask us to rectify it. If we have disclosed data to third parties that has subsequently been corrected, we will also inform those third parties accordingly.

• The right to object to the processing of your data

You may object to the use of your personal data by the companies in our group. You can exercise this right online or by telephone. We will take your objection into account even if the processing of your information has any unjustified impact on you that requires the processing of that data to cease.

You may also object to receiving personalised commercial messages from us. When you become a Todos & Company client, we ask whether you wish to receive personalised offers. If you change your mind later, you can opt out of receiving messages from us by using the "unsubscribe" link at the bottom of each commercial e-mail. You cannot object to the processing of your personal data by Todos & Company if we have a legal obligation to process it; if it is necessary for us to conclude a contract with you; or if, under a contract, we have undertaken to send you personalised information and you have undertaken to receive it, even if you have opted out of receiving personalised commercial messages.

• The right to restriction of processing

You have the right to ask us to restrict the use of your personal data where:

• you consider the information to be inaccurate;

• we are processing the data unlawfully;

• Todos & Company no longer needs the data but you want us to keep it for use in legal proceedings;

• you have objected to the use of your personal data by Todos & Company in the company's legitimate interests;

• The right to data portability

You have the right to ask us to transfer your personal data directly to you or to another company. This applies to personal data that we process by automated means and only with your consent or on the basis of a contract concluded with you. Where this is technically possible, we will transfer your personal data.

• The right to erasure

You may ask us to erase your personal data if:

• the data is no longer necessary for the purpose for which it was collected or processed;

• you withdraw the consent on which the processing is based;

• you object to the processing of your data by Todos & Company in the company's legitimate interests or for the purpose of sending personalised commercial messages;

• Todos & Company is processing your personal data unlawfully, or a regulation of the European Union or of a Member State of the European Union requires Todos & Company to erase your personal data.

• The right to complain

If you are not satisfied with the way we have responded to your requests, you have the right to lodge a complaint. If you remain dissatisfied with our response to the complaint you submitted, you may forward it to the Data Protection Officer at Todos & Company. Likewise, where the matter could not be resolved between the parties, you may contact the data protection authority.

• Exercising your rights

If you wish to exercise your rights, change the data we hold about you, or make a complaint, please contact us. You will find the contact details of the Todos & Company office at the end of this Privacy Policy. How you exercise your rights depends on the Todos & Company product you have purchased. You may exercise your rights (as applicable) through our website, by visiting our head office or by telephone. We aim to respond to your request as soon as possible. In some cases, the response time may be up to a maximum of 72 hours. If we need more time to resolve your request, we will inform you of the additional time required and explain the justified reasons for the delay. Depending on the case, we may refuse your request. Where permitted by law, we will inform you why we have refused your request.

6. Your duty to provide data

There is certain information we need to know about you so that we can begin performing our obligations as Service Provider and honour the related contractual obligations. We also have a legal obligation to collect certain information. Without this data, we may not be able to send an invoice or carry out certain activities, and without them we may be unable to fulfil the purpose of the contract.

7. How we protect your personal data

We apply an internal framework of policies and standards at all levels of our companies to keep your data safe. These policies and standards are updated periodically to reflect regulations and market developments. Specifically, and in accordance with the law, we take appropriate technical and organisational measures (policies and procedures, IT security, etc.) to ensure the confidentiality and integrity of your personal data and of the way your data is processed. In addition, Goodwil employees are obliged to maintain confidentiality and may not disclose your personal data unlawfully or unnecessarily without your prior consent.

8. How long do we keep your personal data?

We are entitled to keep your personal data only for as long as it is necessary for the purpose for which we originally requested it. After that period, we look for feasible solutions, either to obtain fresh consent from you or to archive the data.

9. Contact us

If you would like to find out more about Todos & Company's data policies and how we use your personal data, you can send us an e-mail, call us or visit us at our head office. You will find a list of contact details at the end of this Privacy Policy.

10. Scope of this Privacy Policy

This document is the Privacy Policy of each company in the Todos & Company Group. The Policy applies to all Todos & Company entities and offices to the extent that they process personal data. We may amend this Privacy Policy to remain compliant with changes in legislation and/or to reflect how Todos & Company processes personal data. This version was amended on 11 July 2019.