Privacy Policy

In compliance with Decree-Law no. 7/2004, of 7 January, on legal aspects of information society services, and other applicable legislation, the following information is provided:

Company name: METABODY, UNIPESSOAL LDA Registered office: Rua Dom João V, 15C, 1250-089 Lisbon, Portugal NIPC / Tax Identification Number: 517861941 Registered with the Commercial Registry of [TODO: locality], under no. [TODO: number] Phone: +351 938 366 188 Email: info@metabody.pt Website: www.metabody.pt

The entity above is the controller of the personal data collected through this website, under this Privacy Policy.

For any matter relating to the processing of your personal data, you can contact us at privacy@metabody.pt or by post addressed to the registered office above.

Although Metabody is not legally required to appoint a Data Protection Officer, we provide a dedicated contact for privacy matters at privacy@metabody.pt.

This Privacy Policy applies to the personal data processing carried out in connection with the use of www.metabody.pt and the initial contact established through the form available on the website. Data processing carried out at a later stage, in the context of the assessment and neurofunctional training services, is the subject of separate information provided at the time of consultation.

We collect only the data you voluntarily provide through the contact form available on the website, namely:

· First and last name · Email address · Phone number · Free-text information about the reason for the consultation

We also collect browsing data through cookies, as described in our Cookie Policy.

Personal data is processed for the following purposes:

Response to the contact request submitted through the form Legal basis: pre-contractual steps at the request of the data subject (Article 6(1)(b) GDPR). Data used: name, email, phone, reason for the consultation.

Commercial communications (newsletter, news) Legal basis: express consent of the data subject (Article 6(1)(a) GDPR). Data used: email.

Statistical analysis of website use Legal basis: consent, expressed through cookie preferences. Data used: browsing data, anonymised wherever possible.

Compliance with legal obligations applicable to Metabody Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR). Data used: contact data and any others strictly necessary.

Personal data is retained only for the period strictly necessary to fulfil the purposes for which it was collected:

· Data collected through the contact form, where the user does not become a client: retained for a maximum of 24 months, after which it will be deleted or anonymised. · Data of users who become clients: retained for the duration of the contractual relationship and for the legal periods applicable after its termination. · Commercial communications: until the data subject withdraws consent.

Metabody does not sell, rent or transfer users' personal data to third parties. Data may be communicated to the following categories of recipients, exclusively for the purposes identified above:

· Sub-processors providing technical services to Metabody, namely web hosting, email-sending platform (Resend, provided by Resend, Inc.), statistical analysis tools, customer relationship management (CRM) system and cookie consent management platform (Cookiebot, provided by Cybot A/S), acting on behalf of Metabody and in accordance with its instructions. · Competent public authorities, when required by law.

An updated list of the main sub-processors can be requested at privacy@metabody.pt.

Some of our sub-processors are located outside the European Economic Area. Whenever this occurs, Metabody ensures that the transfer takes place under appropriate safeguards, namely standard contractual clauses approved by the European Commission or adequacy decisions, in accordance with Articles 44 et seq. of the GDPR.

Under the GDPR and Portuguese Law no. 58/2019, of 8 August, data subjects have the following rights:

· Right of access to personal data concerning them · Right to rectification of inaccurate or incomplete data · Right to erasure ("right to be forgotten"), in the cases provided for in Article 17 of the GDPR · Right to restriction of processing · Right to data portability · Right to object to processing · Right to withdraw consent at any time, without prejudice to the lawfulness of processing carried out on the basis of consent previously given · Right not to be subject to automated individual decisions

These rights can be exercised by emailing privacy@metabody.pt, including elements that allow us to verify the identity of the data subject.

Data subjects also have the right to lodge a complaint with the competent supervisory authority — in Portugal, the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, no. 134, 1.º, 1200-651 Lisboa, www.cnpd.pt.

Metabody adopts the technical and organisational measures appropriate to ensure a level of security appropriate to the risk of the processing, in accordance with Article 32 of the GDPR, including measures designed to prevent unauthorised access to, accidental destruction, loss, alteration, disclosure or dissemination of personal data.

This Privacy Policy may be updated. The version in force at any given time is the one published on www.metabody.pt, with the date of the last update indicated at the top of the document. Material changes will be communicated to the user by an appropriate means.

This Privacy Policy is governed by Portuguese law, in particular by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), and Portuguese Law no. 58/2019, of 8 August.