Privacy Policy

Flippex ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our platform and services. This policy applies to all users of the Flippex platform, including visitors, registered users, and investors.

We collect the following categories of personal data: **Account Information** • Name, email address, phone number • Date of birth, nationality, country of residence • Username and password (encrypted) **Verification Data (KYC/AML)** • Government-issued ID documents • Proof of address • Tax identification numbers • Source of funds information **Financial Information** • Bank account details for distributions • Investment history and holdings • Transaction records **Usage Data** • IP address and device information • Browser type and settings • Pages visited and features used • Timestamps and session duration **Communications** • Support inquiries and responses • Email preferences and subscriptions

We process your personal data for the following purposes: **Service Provision** • Creating and managing your account • Processing investments and distributions • Providing access to project information **Compliance** • Identity verification (KYC/AML) • Regulatory reporting requirements • Fraud prevention and detection **Security** • Protecting your account and data • Monitoring for suspicious activity • Maintaining platform integrity **Communication** • Sending transaction confirmations • Project updates and notifications • Service announcements • Marketing (with your consent)

Under GDPR, we process your data based on: **Contract Performance** • Processing necessary to provide our services to you **Legal Obligations** • Compliance with KYC/AML regulations • Tax reporting requirements • Regulatory requests **Legitimate Interests** • Fraud prevention and security • Platform improvement and analytics • Business operations **Consent** • Marketing communications • Optional data processing activities

We may share your data with: **Service Providers** • Identity verification providers • Payment processors • Cloud hosting services • Customer support tools **Compliance Partners** • Regulatory authorities (when required by law) • Legal advisors • Auditors **Project Partners** • Project sponsors may receive limited investor information necessary for reporting and distributions We do NOT sell your personal data to third parties.

We retain your personal data for: • **Active accounts**: As long as your account remains active • **Compliance records**: As required by applicable laws (typically 5-10 years for financial records) • **Closed accounts**: Limited retention for legal and regulatory purposes You may request deletion of your data subject to our legal retention obligations.

We implement appropriate security measures including: • Encryption of data in transit and at rest • Secure authentication mechanisms • Access controls and audit logging • Regular security assessments • Employee training and access restrictions While we strive to protect your data, no system is completely secure. We encourage you to use strong passwords and protect your account credentials.

Under GDPR, you have the right to: • **Access**: Request a copy of your personal data • **Rectification**: Correct inaccurate or incomplete data • **Erasure**: Request deletion of your data (subject to legal obligations) • **Portability**: Receive your data in a structured format • **Restriction**: Limit how we process your data • **Objection**: Object to certain processing activities • **Withdraw Consent**: Revoke previously given consent To exercise these rights, contact us at privacy@flippex.com.

Your data may be transferred to and processed in countries outside the European Economic Area (EEA). When we transfer data internationally, we ensure appropriate safeguards through: • Standard Contractual Clauses (SCCs) • Adequacy decisions • Other approved transfer mechanisms

For privacy-related inquiries: **Data Protection Officer** Email: privacy@flippex.com **Supervisory Authority** You have the right to lodge a complaint with your local data protection authority. In Portugal, this is the Comissão Nacional de Proteção de Dados (CNPD).