Data controller
The data controller is REALCHAIN, S.A., NIPC 516852574, with registered office at Avenida da Liberdade 110, 1269-046 Lisboa, Portugal.
Impunent Capital is the trading name of Realchain, S.A. There is no other entity responsible for the processing described here.
Data protection officer: to be confirmed. Contact address for data protection matters: to be confirmed before publication.
Categories of data processed
Contact data. Name, organisation, email address, subject and message, when you use the contact form.
Identification data in the qualification request. Full name, type of applicant, NIF or NIPC, company name, email address, telephone number and country of tax residence.
Qualification data. The qualification route indicated, the statutory requirements declared and the written substantiation of each requirement declared.
Record of the process. Request reference, the answers given in full, the version and reference of the warning text presented, date and time, IP address and user agent.
Decision. The identity of the person who reviewed the request, the outcome of the decision, the date and the supporting documentation, where requested.
Restricted area. A record of access and of the expressions of interest submitted.
We do not request balances, account numbers or credentials. Applicants are instructed not to enter them in any field.
Purposes and legal basis
Response to enquiries. Steps taken prior to entering into a contract, and legitimate interest in managing the relationship. Article 6(1)(b) and (f) GDPR.
Assessment of the qualification request. Compliance with a legal obligation and steps taken prior to entering into a contract. Article 6(1)(c) and (b) GDPR.
Retention of the documentary evidence of the process. Compliance with a legal obligation and the exercise of rights in legal proceedings. Article 6(1)(c) and (f) GDPR.
Management of access to the restricted area. Performance of the relationship and compliance with a legal obligation.
We do not process data for advertising, commercial prospecting or profiling. There are no automated decisions: approval of each request requires human review.
Retention period
The data of the qualification process is kept for seven years, counted from the decision or from the end of the relationship, whichever occurs last.
The period follows from the duty to demonstrate the categorisation applied and from the applicable statutory retention periods.
The record of the process is kept in append-only mode, with no editing and no deletion. That characteristic forms part of the evidence.
Messages received through the contact form without follow-up are deleted after twelve months.
Hosting and processors
The site and the database are hosted in the European Union. The database is located in Frankfurt, Germany.
Data is encrypted at rest. Access is restricted by rules applied at the level of each record.
We use processors for hosting, authentication and message delivery. All act under written instructions and a data processing agreement.
Named list of processors: to be confirmed before publication.
We do not sell, assign or share data with third parties for commercial purposes. There is no transfer of data outside the European Economic Area.
International transfers
Personal data is processed in the European Union. The hosting of the site, the database and the backups are located in the territory of the European Union.
There is no transfer of personal data to third countries and no transfer to international organisations.
The processors provide the service from infrastructure located in the European Union. That condition is stated in the data processing agreement.
Should a transfer to a third country come to exist, it is subject to Chapter V of the GDPR. It is admitted only under an adequacy decision of the European Commission or, failing that, under standard contractual clauses, accompanied by an assessment of the regime of the country of destination and of the supplementary measures that apply.
The change is stated in this policy before it takes effect, with identification of the country of destination and of the basis relied on. The data subjects of the qualification process are informed by email.
Analytics and cookies
The analytics used on this site rely on no cookies and no persistent identifiers. No user profile is built.
As there is no cookie subject to consent, this site displays no cookie banner.
Aggregate usage data is recorded: pages viewed, source of the visit and type of device. Aggregate data does not identify individuals.
The typefaces are served from the site's own domain. The site loads no third party resources and embeds no external content.
The restricted area uses a technical session file. It serves authentication and has no measurement purpose.
Automated decisions and profiling
No automated decisions are taken, without human intervention, that produce legal effects concerning the data subject or that significantly affect the data subject, within the meaning of article 22 GDPR.
The assessment of a qualification request is always human. Each request is reviewed individually by a member of the management body (Direção), who decides and whose identity is recorded in the process.
There is no automatic approval. No automatic score is assigned to the applicant. A refusal is likewise decided by a person.
No profile is built. The data of the request is not cross-referenced with external sources to infer characteristics, preferences or behaviour.
The only automatic step is the exclusion of restricted jurisdictions, from the country of tax residence declared at Step 1. That step prevents submission and does not assess the qualification. The request is not recorded.
You may ask for clarification of the decision on your request, at the address given in the first section.
Rights of the data subject
You may request access to your data, rectification of inaccurate data and erasure in the cases provided for by law.
You may request restriction of processing, object to processing based on legitimate interest and request portability of the data you provided to us.
Right to object. You may object to processing based on legitimate interest, at any time and on grounds relating to your particular situation, under article 21 GDPR.
On receipt of the objection, the processing ceases. It continues only where there are compelling legitimate grounds which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of a right in legal proceedings.
The right to object does not apply to processing based on compliance with a legal obligation. The retention of the evidence of the qualification process has that basis.
The right to erasure does not extend to data whose retention is imposed on us by a legal duty of evidence. In those cases processing is limited to that purpose.
Requests are addressed to the address given in the first section and answered within one month. We may request proof of identity.
You may lodge a complaint with the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados).
The CNPD (Comissão Nacional de Proteção de Dados) is the competent supervisory authority in Portugal. A complaint may be lodged with the CNPD where you consider that the processing of your personal data infringes the GDPR. CNPD contacts: Avenida D. Carlos I, 134, 1.º, 1200-651 Lisboa, and institutional site at www.cnpd.pt.
A complaint to the CNPD does not depend on a prior complaint addressed to Realchain, S.A., and it is without prejudice to recourse to the courts.
Protection measures
Access to qualification data is restricted to the people who review requests and decide on them.
The restricted area uses no passwords. Access is by a personal link of limited validity, sent by email.
Personal data breaches presenting a risk to data subjects are notified in accordance with the GDPR.
Changes to this policy
This policy may be amended. The version in force is the one published on this page, with the date given at the top.
Changes that affect the processing of qualification data are notified by email to the data subjects concerned.