Taguspark, S.A. expresses its firm commitment to comply, at all times, with current legislation on the protection of personal data, treating Personal Data in accordance with this Privacy Policy.

Whenever you use the Taguspark website or interact with Taguspark in any other way, namely by registering on the website or submitting forms, the Personal Data you provide will be processed in accordance with the legal requirements applicable to each specific situation.

Taguspark reserves the right to modify this Privacy Policy whenever necessary due to changes in laws or regulations, for security reasons, or to bring it into line with the guidelines of data protection supervisory authorities.

1. Who is responsible for processing your data?

The entity responsible for processing your personal data is Taguspark – Sociedade de Promoção e Desenvolvimento do Parque de Ciência e Tecnologia da Área de Lisboa, S.A., a public limited company, with its registered office at Edifício Núcleo Central 100, 2740-122 Porto Salvo, and with the single registration and legal entity number 502857587, hereinafter referred to as “Taguspark”

Taguspark has assessed the criteria set forth in Article 37 of the General Data Protection Regulation and has concluded that it is not required to appoint a Data Protection Officer. Notwithstanding the foregoing, for any questions regarding the protection of your personal data, you may contact us at taguspark@taguspark.pt

2. What data do we collect, how do we use it, on what basis, and where do we store it?

Within the scope of its institutional activity and interactions established through its website and other digital channels, Taguspark collects and processes Personal Data that is strictly necessary for the pursuit of its respective purposes.

The Personal Data collected may include, in particular, name, email address, telephone number, entity, position, as well as other information voluntarily provided by data subjects through the forms available on the website.

Taguspark collects Personal Data through the following channels:

• Subscription to the Taguspark newsletter, for the purpose of publicizing cultural and institutional programming and events, based on the free, explicit, informed, and unambiguous consent of the data subject (Article 6(1)(a) of the General Data Protection Regulation). The consent provided is recorded and retained by Taguspark for evidentiary purposes, as required by law, and may be withdrawn at any time via the unsubscribe link provided in each newsletter or by contacting the address indicated in point 1.
• Submission of forms available on the website for the purpose of responding to requests for information, clarifying issues, and handling commercial or institutional inquiries, as well as for carrying out pre-contractual measures at the request of the data subject, based on the performance of such measures (Article 6(1)(b) of the General Data Protection Regulation) or on the basis of Taguspark’s legitimate interest in responding to the requests submitted (Article 6(1)(f) of the same regulation).

The Taguspark website also uses cookies and similar technologies; their purposes, legal bases, and management procedures are described in its own Cookie Policy, which is available on the website and supplements this Privacy Policy.

Personal Data is stored on systems and servers located in secure environments, protected against unauthorized access, misuse, or disclosure, and appropriate technical and organizational measures are in place to ensure its security and confidentiality.

In the forms available on the website, fields marked as required are necessary for us to review and process your request, carry out pre-contractual procedures, or perform the applicable contract. If this information is not provided, we may be unable to process your request or provide the requested service. The remaining fields are optional and are intended to help us better tailor our response to your needs.

3. What are the purposes of processing personal data?

The Personal Data collected by Taguspark is processed for the purposes listed below, with an indication of the respective legal basis in accordance with the General Data Protection Regulation:

1. Scheduling and managing visits related to business setup at Taguspark, based on the performance of pre-contractualat the request of the data subject (Article 6(1)(b) of the General Data Protection Regulation) and on the basis of Taguspark’s legitimate interest in carrying out its institutional activities (Article 6(1)(f) of the same regulation).
2. Scheduling and managing visits and events to be held at Taguspark, based on the performance of a contract or on pre-contractual measures taken at the request of the data subject (Article 6(1)(b) of the General Data Protection Regulation) and on Taguspark’s legitimate interest (Article 6(1)(f) of the same regulation).
3. Responses to requests for information submitted via forms available on the website, based on Taguspark’s legitimate interest in responding to requests addressed to it (Article 6(1)(f) of the General Data Protection Regulation).
4. Promotion of Taguspark’s cultural, institutional, and event programs through newsletters and other communications, subject to the data subject’s express, free, specific, and informed consent (Article 6(1)(a) of the General Data Protection Regulation).
5. Compliance with the legal obligations applicable to Taguspark, specifically in the areas of taxation, accounting, and regulation, based on compliance with a legal obligation to which the data controller is subject (Article 6(1)(c) of the General Data Protection Regulation).

4. Who are the recipients of your data?

Personal Data collected by Taguspark is processed within the scope of its institutional activity, exclusively for the purposes described in this Privacy Policy.

Whenever necessary to achieve these purposes, Personal Data may be processed by third parties that provide services to Taguspark, namely in terms of website hosting, digital platform management, electronic communications, or technological support. These entities act on behalf of Taguspark and according to documented instructions, in the capacity of subcontractors.

Taguspark ensures that any subcontracted entities fully comply with the General Data Protection Regulation and are required to adopt appropriate technical and organizational measures to protect Personal Data and guarantee its confidentiality.

As a general rule, Personal Data is not transferred internationally to third countries or international organizations outside the European Economic Area. Should this occur as a result of the use of certain technological tools, Taguspark will ensure compliance with all applicable legal obligations, including the adoption of appropriate safeguards provided for in Chapter V of the General Data Protection Regulation, namely standard contractual clauses approved by the European Commission or other legally permissible mechanisms.

Without prejudice to the provisions of the preceding paragraphs, Personal Data may be communicated to administrative, tax, or judicial authorities whenever required by law or in compliance with applicable legal obligations.

5. Where do we store your data?

Taguspark stores the Personal Data provided by users on servers located within the European Economic Area, in secure environments protected against unauthorized access, misuse, or disclosure.

To this end, it implements appropriate technical, electronic, and organizational measures to ensure data security and prevent data loss, misuse, or unauthorized access, including through access controls, encryption of communications, and periodic audit procedures.

Personal Data is processed exclusively for the purposes for which it was collected, in accordance with this Privacy Policy, and it is the user's responsibility to keep their personal information up to date.

6. Disclosure of Data to Third Parties

Taguspark may, whenever necessary and legally permissible, engage third parties to process Personal Data on its behalf, ensuring that such entities act in accordance with the General Data Protection Regulation.

In such cases, Taguspark ensures that subcontractors adopt appropriate technical and organizational measures to protect Personal Data, guaranteeing its confidentiality and security.

Where legally required, Personal Data may be disclosed to administrative, tax, or judicial authorities, in strict compliance with applicable legal obligations.

7. What are your rights as a data subject and how can you exercise them?

In accordance with applicable data protection legislation, Taguspark guarantees the data subject the exercise of the following rights:

1. Right to information.
2. Right of access.
3. Right of rectification.
4. Right to erasure, under the terms applicable by law.
5. The right to withdraw consent at any time, when the processing is based on consent, without this affecting the lawfulness of the processing carried out on the basis of the consent previously given.
6. Right to object to processing based on legitimate interest.
7. Right to data portability, where legally applicable.
8. Right to restriction of processing, in accordance with the law.

You may exercise these rights by contacting us at the following email address: taguspark@taguspark.pt.

Taguspark will respond to requests as quickly as possible.

The data subject also has the right to file a complaint with the National Data Protection Commission (CNPD | Rua de São Bento, No. 148, 3rd Floor, 1200-821 Lisbon | Tel: 351 213928400 | Fax: +351 213976832 | email: geral@cnpd.pt), without prejudice to contacting Taguspark first for any clarification or resolution of the situation.

Where requests are manifestly unfounded or excessive, Taguspark reserves the right to charge reasonable administrative costs or to refuse to process them, in accordance with the law.

Taguspark does not make decisions based solely on automated processing, including profiling, that produce legal effects concerning data subjects or that similarly significantly affect them.

8. How long do we store your data?

Personal Data is retained only for the period necessary to fulfill the purposes for which it was collected or processed, and this period may vary depending on the nature and purpose of the processing.

As a general guideline, and without prejudice to any legal obligations that may require different retention periods, the following criteria apply:

• Data related to newsletter subscriptions: This data is retained until the data subject withdraws consent or until prolonged inactivity is detected, without prejudice to the retention of the consent record for the period required by law for evidentiary purposes.
• Data related to requests for information submitted through the website: such data is retained for the period necessary to respond to the request and, thereafter, for a period appropriate to the possible continuation of the institutional interaction, unless such interaction gives rise to a contractual relationship.
• Data related to the scheduling and management of visits and events: This data is retained for the period necessary to carry out the visit or event and, thereafter, for a period appropriate for managing any subsequent institutional relationship.
• Data related to contractual relationships: This data is retained for the duration of the contractual relationship and, after its termination, for the periods required by law with respect to tax and accounting matters and the statute of limitations for any potential liabilities.
• Data retained in compliance with a legal obligation: This data is retained for the period required by the applicable law in each case.

Whenever there is a legal obligation, Personal Data will be retained for the period required by law. Once the applicable retention periods have expired, and in the absence of a specific legal obligation requiring its retention, Personal Data will be deleted or irreversibly anonymized.

9. How long do we store your data?

The right of access, rectification, erasure, and data portability, as well as the right to object and the right to lodge a complaint, may be exercised by the data subject by contacting Taguspark at the following email address: taguspark@taguspark.pt.

If you have any questions about this Privacy Policy, you can obtain additional information or clarify any doubts by sending your questions to the following email address: taguspark@taguspark.pt.

Taguspark will respond to the holder's request within a maximum period of one month from receipt of the request, except in cases of special complexity, where this period may be extended by up to two months.

If the requests submitted by the owner are manifestly unfounded or excessive, particularly due to their repetitive nature, Taguspark reserves the right to charge administrative costs or refuse to comply with the request.

Version: 2 – June 2026