Privacy Policy

The data controller for your personal data is 50 BUY INVEST, Unipessoal Lda., NIPC 516574477, based in Portugal. For any privacy-related questions, contact our Data Protection Officer: Data Protection Officer — info@qdc-investors.com.

When you request access to the investor portal, we collect:

• Identity: full name, email address, phone number (optional), country
• Professional: company, investor type, indicative ticket size
• Legal: NDA acceptance timestamp, IP address, user agent, SHA-256 hash of accepted text
• Behavioral: document views and downloads, login timestamps, pages visited

We process your personal data on the following legal bases under GDPR Art. 6:

• Contract (Art. 6(1)(b)) — to provide the portal services you request
• Legitimate interest (Art. 6(1)(f)) — to protect confidential project data and document access
• Legal obligation (Art. 6(1)(c)) — to maintain NDA evidence and audit logs for compliance

NDA records and audit logs are retained for 10 years after your last interaction, as required for commercial and legal evidence. Account data is retained while your account is active and for 2 years afterwards. You may request earlier deletion (see Section 7).

Your data is shared only with the following processors, bound by contractual data protection obligations:

• Supabase (database + file storage) — EU region (Ireland)
• Resend (transactional email delivery)
• Vercel (hosting and content delivery)

We do not sell your data to third parties. We do not use your data for advertising.

All primary data processing occurs within the European Economic Area. Resend and Vercel may process data through US-based infrastructure under EU-approved Standard Contractual Clauses.

As a data subject, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Request deletion ("right to be forgotten"), subject to legal retention requirements
• Restrict or object to processing
• Export your data in a portable format
• Withdraw consent at any time (for consent-based processing)
• Lodge a complaint with the Portuguese supervisory authority (CNPD, cnpd.pt)

To exercise any of these rights, email info@qdc-investors.com. We will respond within 30 days.

We apply industry-standard security: encrypted connections (TLS 1.2+), hashed passwords, JWT session tokens, watermarked document downloads, row-level database security, and a comprehensive audit trail. Access to confidential project documents is restricted by role (PROSPECT / QUALIFIED / ADMIN).

We use strictly necessary cookies for authentication and session management. See our Cookie Policy for details.

We may update this policy to reflect changes in our practices or legal obligations. The "Effective" date at the top will be updated. Material changes will be communicated to registered users by email.

For questions about this policy or your personal data, contact info@qdc-investors.com.