Privacy Policy

1. Intro

This Privacy Policy describes the guidelines and principles regarding the protection of personal data adopted by companies belonging to the economic group called "CASTRO GROUP," which includes all companies in a domain relationship with CASTRO GROUP, SGPS, S.A., and which are under dominant influence with it, in accordance with article 486 of the Commercial Companies Code (the"CASTRO GROUP").

This Privacy Policy thus applies to all personal data processing activities carried out by the companies that make up the CASTRO GROUP.

CASTRO GROUP is an economic group composed of several companies that operate, essentially, in the following sectors of activity:

• Asset management: management of investment funds, collective investment companies, etc.
• Real estate promotion and management: buying and selling real estate, leasing, coworking, construction and real estate projects, etc.;

On this date, with reference to the sectors of activity mentioned above, the CASTRO GROUP includes the following companies:

• Real estate promotion and management: CASTRO RED BUILD, LDA., CASTRO RED, S.A., SOLID CONDITION, LDA., FUSE VALLEY, LDA., 2GETHER SPACES, LDA.
• Asset Management: ICON SIC, S.A., CASTRO RED CAPITAL SIC, S.A., NEXA SGOIC, S.A., FUSE VALLEY — Private Subscription Closed Real Estate Investment Fund

CASTRO GROUP may also include non-majority shareholding in other companies, which may adhere to this Privacy Policy if the activities you pursue fall within the "real estate promotion and management" and/or "asset management" activity sectors. Membership always depends on a written agreement between CASTRO GROUP, SGPS, S.A. and the entity in question, whose essential conditions and terms, together with this Policy, must be made available to data subjects.

This Privacy Policy also applies to personal data processing activities carried out by entities that, in the future, will join the CASTRO GROUP in a domain relationship. It is up to these entities, as well as to the entities that currently make up the CASTRO GROUP, to ensure that data subjects are informed about the existence and content of this Privacy Policy.

Regarding companies' personal data processing activities regarding the "asset management" sector, this Privacy Policy also applies to data processing activities conducted by the entities under their management (funds and corporations).

In the course of their activities, CASTRO GROUP companies collect and process personal data from various owners, including:

• participants in investment funds ("Participants") and potential buyers of investment fund units ("Potential Participants");
• tenants and guarantors or potential tenants and guarantors under contracts for the rental or use of spaces ("Tenants and Guarantors" and"Potential Tenants and Guarantors");
• sellers and buyers or potential sellers and buyers under contracts for the purchase and sale of real estate ("Buyers and Sellers" and"Potential Buyers and Sellers");

(all hereinafter jointly referred to, for the purposes of this policy, as"data subjects").

2. Identification of the person responsible for the treatment

Depending on the processing activity in question, the CASTRO GROUP company is responsible for the treatment, which, in this processing activity, determines the purposes and means of processing the personal data of the data subjects (the"Responsible for the Relevant Treatment").

3. Personal Data Categories

Personal Data of Participants and Potential Participants

‍Regarding Potential Participants and Participants, the Relevant Data Controller may process personal data integrated into the following categories:

• Identification Data, such as gender, profession, name, age or date of birth, citizen card number, taxpayer number, foreign taxpayer number if applicable, social security identification number, nationality, profession, employer, marital status and identification of the spouse);
• Contact Data, such as address, email address, telephone and mobile phone contacts, among others;
• Bank account identification data and financial information, such as IBAN and individual income tax ("IRS") declarations.

Personal Data of Tenants, Guarantors and Potential Tenants and Guarantors, Buyers and Sellers, and Potential Buyers and Sellers
‍
‍With regard to Potential Tenants and Guarantors, Tenants and Guarantors, Buyers and Sellers, and Potential Buyers and Sellers, the Responsible for the Relevant Treatment may process personal data included in the following categories:

• Identification Data, such as gender, profession, name, age or date of birth, citizen card number, taxpayer number, foreign taxpayer number if applicable, social security identification number, nationality, data about academic education, among others;
• Contact Data, such as address, email address, telephone and mobile phone contacts, among others;
• Bank account identification data and financial information, such as IBAN and individual income tax ("IRS") declarations.

4. Origin of personal data

Data subjects mainly provide personal data upon first contact, and they maintain a contractual relationship with the relevant data controller.

Personal data can be collected at various times and through various communication channels, including telephone, email and in person.

5. Purposes of personal data processing, legal basis for processing and storage periods

Personal data are processed for various reasons, justified by the applicable data protection laws in the European Union and in Portugal.
‍
Personal Data of Participants and Potencial Participants
‍
The Responsible for the Relevant Treatment processes the personal data of Participants and Potential Participants for the following purposes and based on the following legal grounds:

Participants' personal data is kept for the duration of the contractually established relationship with the Relevant Data Controller, as applicable, and up to 10 (ten) years from the end of that relationship. In some situations, the retention period may be longer, in which case this extension will be legally justified and supported.

Personal Data of Tenants, Guarantors and Potential Tenants and Guarantors, Buyers and Sellers, and Potential Buyers and Sellers

The Relevant Data Controller processes the personal data of Potential Tenants and Guarantors, Tenants and Guarantors, Buyers and Sellers, and Potential Buyers and Sellers, for the following purposes and based on the following legal grounds:

The personal data of the Tenants, Guarantors, Buyers and Sellers are kept for the duration of the contractually established relationship with the Responsible for the Relevant Treatment and up to 10 (ten) years from the end of that relationship.

6. Marketing

The Responsible for the Relevant Treatment may process the personal data of the data subjects to send them institutional information or commercial communications.

This data processing will be carried out only with the consent of the data subject, provided at the time the personal data was collected. If you consent, the data subject may receive marketing communications via e-mail, postal letter and SMS.

Consent to the processing of personal data for direct marketing purposes can be revoked at any time.

7. Automatic Decisions ("Profiling")

CASTRO GROUP companies do not use technologies to make decisions solely based on the automated processing of the data of the data subjects.

Without prejudice, these entities may use technologies to define a profile about the data subject; however, never in a totally or exclusively automated way and without this implying any legally relevant (even if positive) consequences for the subject.

8. Categories of recipients of personal data

The personal data of the data subjects may be transmitted to companies in the same economic group, which are obliged to respect this Privacy Policy and, in particular, the purposes for which the personal data were initially collected.

The personal data of the data subjects may also be shared with entities that provide services to CASTRO GROUP companies and that, as part of the provision of these services, may process personal data on behalf of and upon instructions from one or more of these entities, as applicable, such as:

• companies specializing in the provision of accommodation services of Website and systems of Backups and other IT support and development services;
• companies providing digitization and documentary archiving services;
• companies specialized in providing programming and digital marketing services, in situations where the data subject has given their respective consent;
• companies providing communication, dissemination and marketing services, in situations where the data subject has given their respective consent;
• lawyers, financial auditors and other advisors who provide consulting services to CASTRO GROUP companies.

9. Transfer of personal data to other countries

Currently, CASTRO GROUP companies do not use subcontractors or transfer data to third entities based outside the European Union.

However, if and when this transfer occurs, for any reason, the transmitting entity will ensure that these third parties agree to protect the transmitted data against misuse or disclosure, in accordance with the legal regime for the protection of personal data.

10. Rights of the holders of personal data

As an expression of their commitment to guarantee the privacy of data subjects, CASTRO GROUP companies guarantee, in accordance with applicable national and community legislation, a wide range of rights that can be exercised under the following terms:

Right of Access
Data subjects may, at any time, contact the Relevant Data Controller and request confirmation that their personal data is being processed.

Right to Erasure
Also known as "the right to be forgotten", it allows the data subject to request the deletion or removal of their personal data when there is no compelling reason for the Relevant Data Controller to continue using them.

Right of Rectification
Whenever they verify that the personal data being processed is outdated, incomplete or incorrect, the data subjects may request its correction as soon as possible.

Portability Right
Data subjects also have the right to receive personal data concerning them from the Responsible for the Relevant Treatment, in a commonly used format.

Right to restrict treatment
In certain situations, the data subject has the right to "block" or suppress the continued use of their information.

Right to object
The Responsible for the Relevant Treatment ensures the necessary means for the data subject to object to certain personal data processing for certain purposes.

Right of Complaint
Finally, data subjects are granted the right to file a complaint with the National Data Protection Commission (https://www.cnpd.pt) regarding the processing of their data.

11. Contact us

The rights provided for and described in this Policy and, as well as other rights legally provided for in the relevant legislation in force, can be freely exercised by contacting the following address and email:

Address: Avenida 31 de Janeiro, 307, 4715-052 Braga

Email: geral@castro-group.pt

12. Changes to the privacy policy

This Privacy Policy may change due to new legal or regulatory requirements, improvements in the quality of services, and the development of CASTRO GROUP companies' commitment to protecting personal data. Any changes to this Privacy Policy will be duly publicised on the Relevant Data Controller's various communication channels.