PRIVACY POLICY

1. Who are we and how can you contact us?

Your personal data will be processed by the Company, registered office at Avenida D. João II, n.º 98 A, 1990-100 Lisboa, registered under the single registration number and legal entity 515820636, at the Commercial Registry Office of Lisbon, with a share capital of €2,000.00.

For any questions related to the processing of your personal data, or to exercise your rights, you can contact the Company by email: contact@expandstrategy.com or by mail to the address indicated above.

2. Purposes and legal grounds for the processing of your personal data

The Company only collects and processes, directly or indirectly, your personal data when:

1. It has a legitimate interest in doing so, namely to maintain the commercial relationship, to provide its services, and to ensure access to the platform.

2. It has obtained your consent to process your personal data for specific, explicit, and legitimate purposes; and/or

3. It is necessary to comply with legal obligations that apply to it.

3. What data do we collect?

· Registration data: Name, email, username, password

· Technical and browsing data: essential cookies and analytics.

4. How do we use your data?

· Creation and management of user accounts

· Provision and sale of photos and videos

· Communication with users

· Improvement and security of the platform

· Compliance with legal obligations

Payment processing is managed by the contracted payment provider.

5. How long do we keep your data?

The Company only keeps your personal data for as long as necessary to fulfil the purposes for which it was collected. Data associated with your user account will be kept for as long as the account is active.

If the user exercises their right to object, erasure, or withdraw consent, in cases where this is the basis for collection, we will delete the personal data, except where its retention is legally mandatory.

6. What are your rights as a data subject?

At any time, by contacting us at the email address: contact@expandstrategy.com, the data subject may:

· Request access to the personal data we hold about you;

· Request the rectification of personal data if it is inaccurate or incomplete;

· Request the erasure of your personal data, with the Company being obliged to erase it without undue delay where applicable, in particular when one of the following grounds applies:

a) The personal data is no longer necessary for the purposes for which it was collected or otherwise processed;

b) You have withdrawn your consent to the processing of the data, in cases where the processing is based on consent, and there is no other legal ground for such processing;

c) You object to the processing and there are no overriding legitimate interests justifying the processing;

· Request the restriction of the processing of your personal data;

· Object to the processing of your personal data;

· Exercise the right to the portability of your personal data. In this regard, the Company will provide the data subject, upon request, with the personal data stored in a commonly used and machine-readable format, and the data subject has the right to transmit such data to other entities;

· Where the processing is based on your consent, withdraw that consent at any time.

All requests will be reviewed in accordance with the General Data Protection Regulation (GDPR).

You also have the right to lodge a complaint with the National Data Protection Commission (CNPD) via the website: https://www.cnpd.pt/

7. Who do we share your data with?

For the purposes of service provision, technical management of the platform, payment processing, data hosting and institutional communications, personal data may be shared with external service providers, namely providers of technological services, hosting, payment solutions and communications.

Such sharing is necessary to ensure the proper functioning of the platform, the performance of the contracted services and the fulfilment of the Company’s legal and contractual obligations.

These providers act as subcontractors and are required to comply with the GDPR, ensuring the security and confidentiality of the data processed.

We do not sell or commercially make your data available to third parties, except as provided in this Policy or required by law.

8. Security and confidentiality measures

The Company is committed to protecting the personal data of its users through appropriate technical and organizational measures, which aim to prevent unauthorized access, improper disclosure, or loss of information. Our security systems and policies are reviewed regularly to ensure the effectiveness of the protections implemented.

The Company respects the confidentiality of personal data and undertakes not to sell, disclose, or make it commercially available to third parties, except as provided for in this Privacy Policy and applicable law.

9. Cookies

We use cookies that are essential to the functioning of the website, functional cookies to improve the user experience, and analytical cookies for statistical analysis purposes.

You can manage your preferences on the home page or configure your browser to block or delete cookies.

10. Changes to the Privacy Policy

We reserve the right to update this Privacy Policy whenever necessary. Any changes will be posted on this page with an indication of the date of the update.

Last update: February, 2026