Privacy Policy

Last updated: 28 August 2026

This Privacy Policy explains how personal data is processed in connection with the website www.lisboainvestments.com and the professional activities carried out under the Lisboa Investments brand, including preliminary enquiries, relationships with Clients, partners and other professional contacts, and the provision of advisory services.

Personal data is processed in accordance with Regulation (EU) 2016/679 of 27 April 2016 (the General Data Protection Regulation – GDPR), Portuguese Law No. 58/2019 of 8 August, and other applicable Portuguese and European data protection legislation.

1. Data Controller

The controller of personal data processed under this Privacy Policy is Lisboa Investments, a business name operated by Marlene Tinoco in Portugal.

For privacy-related questions or to exercise data protection rights, you may contact:
Lisboa Investments
Email: geral@lisboainvestments.com

Further legal information concerning the service provider is available in the Terms of Service on this website.

2. Scope of this Policy

This Policy applies to personal data processed in connection with:

• the use and operation of the website;
• enquiries, professional contacts and meeting requests;
• the preparation of proposals and pre-contractual steps;
• the provision and management of professional services;
• relationships with Clients, prospective Clients, partners, suppliers, investors, financing parties, public bodies and other professional contacts;
• professional communications and, where legally permitted, marketing communications; and
• compliance with applicable legal, tax, accounting, risk-management and compliance obligations.

3. Categories of Personal Data We Process

The data processed depends on how an individual interacts with Lisboa Investments and on the nature of the relevant project.

3.1. Identification and contact data

• name;
• email address;
• telephone number;
• job title or professional role;
• company or organisation;
• country and related professional information; and
• other contact information voluntarily provided.

3.2. Client, professional contact and project data

• business, corporate and professional information;
• information relating to projects, investments, transactions or business opportunities;
• financial, commercial and operational information relevant to the engagement;
• information relating to shareholders, directors, representatives, employees, partners or other relevant individuals;
• documents relating to public incentives, corporate finance, direct investment, market entry, procurement, partnerships, consortia or other advisory services;
• information required for conflicts, sanctions, risk or other compliance checks, where applicable; and
• professional correspondence and communication records.

3.3. Contractual, administrative and billing data

We may process information required to prepare and manage proposals, contracts, invoices, payments, records and applicable tax or administrative obligations.

3.4. Website and technical data

Depending on the technologies actually used and the choices made through the consent mechanism, we may process information such as IP address, device and browser information, pages visited, referring source, date and time of access, and identifiers associated with cookies or similar technologies.

Specific information about the cookies used, their purposes, providers and duration will be set out in the Cookie Policy and the website consent-management mechanism.

4. Sources of Personal Data

Personal data may be obtained:

• directly from the data subject;
• from the company or organisation represented by the data subject;
• from a Client or another participant in a project;
• through referrals, professional introductions or business partners;
• from public authorities, official databases, corporate websites, professional platforms or other lawfully accessible public sources; or
• during the provision of professional services.

Where personal data has not been obtained directly from the data subject, the information required by Article 14 GDPR will be provided within the legally applicable time limits unless an exemption under applicable law applies.

5. Purposes and Legal Bases for Processing

5.1. Responding to enquiries and assessing potential engagements

Contact and project information may be used to respond to enquiries, hold meetings, assess opportunities and prepare proposals. Depending on the circumstances, the legal basis will be taking steps at the request of the data subject prior to entering into a contract or our legitimate interest in managing professional contacts and opportunities, particularly where the individual acts on behalf of an organisation.

5.2. Providing and managing professional services

Personal data may be processed to perform an agreed engagement, manage a project, communicate with the Client and other stakeholders, prepare deliverables, coordinate activities and fulfil professional obligations. Depending on the circumstances, the legal basis will be performance of a contract, pre-contractual steps or our legitimate interest in performing and managing the professional relationship with the organisation represented by the data subject.

5.3. Managing professional relationships and developing our activities

We may process professional contact details of Clients, prospective Clients, partners, suppliers and other organisations to manage professional relationships, maintain contact history, develop opportunities and ensure continuity of business relationships. This processing is based on Lisboa Investments’ legitimate interest in managing and developing its professional activities, balanced against the rights and reasonable expectations of the individuals concerned.

5.4. Legal, tax and administrative obligations

We process and retain personal data to the extent necessary to comply with applicable legal, tax, accounting, invoicing or other statutory obligations. The legal basis is compliance with a legal obligation.

5.5. Risk management, conflicts, sanctions and compliance

Where appropriate to the nature of a project, reasonable checks may be carried out in relation to identity, conflicts of interest, sanctions, reputational risk or other compliance matters. The legal basis will be a legal obligation where a specific obligation applies or, otherwise, our legitimate interest in protecting the integrity, security and lawfulness of our activities and projects, subject to any additional requirements applicable to specific processing activities.

5.6. Security and the establishment or defence of legal rights

Personal data may be processed where necessary to protect systems, prevent misuse, maintain security records, manage disputes and establish, exercise or defend legal claims. Depending on the circumstances, the legal basis will be our legitimate interests or compliance with legal obligations.

5.7. Marketing and professional communications

Lisboa Investments may send newsletters, insights, invitations or other professional communications where permitted by applicable law. Where prior consent is required for electronic direct marketing to individuals, such communications will only be sent on the basis of valid consent unless a statutory exception applies, including where applicable the existing-customer exception for similar services. In all cases, recipients will be provided with a simple and free means of objecting to or unsubscribing from marketing communications.

6. Whether You Need to Provide Personal Data

Certain personal data may be required in order to respond to an enquiry, prepare a proposal, enter into or perform a contract, issue invoices or comply with legal obligations. Where such data is necessary and is not provided, it may not be possible to provide the relevant service or continue the process.

Where the provision of data is optional, this will be taken into account as far as reasonably possible at the point of collection.

7. Sharing of Personal Data and Recipients

Lisboa Investments does not sell personal data to advertisers or data brokers.

To the extent necessary for the purposes described in this Policy, personal data may be disclosed or made available to categories of recipients such as:

• hosting, email, cloud, document-management, CRM, scheduling, IT, cybersecurity and technology-support providers;
• administrative, accounting, tax and other professional service providers;
• lawyers, accountants and other specialist advisers;
• independent specialists whose involvement in a particular project has been agreed or is otherwise lawfully necessary;
• Clients, business or industrial partners, investors, financing parties, public bodies, funding organisations, contracting authorities or other stakeholders where disclosure is necessary for the engagement and an appropriate legal basis exists; and
• courts, tax, administrative, regulatory or other public authorities where disclosure is required or authorised by law.

Personal data disclosed will be limited to what is appropriate and necessary for the relevant purpose. Where a service provider processes personal data on behalf of Lisboa Investments, the contractual safeguards required by Article 28 GDPR will be used where applicable.

8. Lisboa Investments’ Role in Client Projects

In most situations, Lisboa Investments independently determines the essential purposes and means of the processing required to provide its professional services and therefore acts as a controller in respect of that processing.

If, in a specific project, Lisboa Investments processes personal data solely on behalf of and on the documented instructions of a Client and legally acts as a processor for GDPR purposes, appropriate data-processing terms or an agreement will be entered into in accordance with Article 28 GDPR.

9. International Data Transfers

Lisboa Investments operates in an international environment and may work with Clients, partners, specialists or service providers located outside the European Economic Area (EEA).

Where an international transfer of personal data is subject to Chapter V GDPR, legally recognised transfer mechanisms will be used as applicable, including European Commission adequacy decisions, Standard Contractual Clauses adopted by the European Commission or other safeguards available under applicable law.

Where necessary, appropriate supplementary measures may also be implemented having regard to the nature and risk of the transfer.

10. Special Categories of Data and Particularly Sensitive Information

Lisboa Investments does not generally seek to collect special categories of personal data, such as information concerning health, racial or ethnic origin, religious beliefs, political opinions, biometric data or sex life, or personal data relating to criminal convictions, unless this is genuinely necessary, an appropriate legal basis exists and the additional legal requirements are satisfied.

Users and Clients should not submit this type of information through general website forms unless specifically requested or agreed in advance.

11. Data Retention

Personal data is retained only for as long as necessary for the purposes for which it is processed and to comply with applicable legal obligations. In particular:

• enquiries and prospective-client contacts that do not result in an engagement may generally be retained for up to 24 months after the last relevant contact, unless there is a legitimate reason for a different period;
• Client and project data and documents will be retained throughout the engagement and, following its completion, for the period necessary to comply with contractual and legal obligations and to defend legal rights; as an internal management rule, core engagement records may be retained for up to 10 years, without prejudice to a longer period where required by law or necessary in connection with a dispute, claim, investigation or other properly justified legitimate need;
• invoices, accounting records and tax-relevant supporting documents will be retained for the legally required periods, which in Portugal are generally 10 years;
• personal data used for marketing will be processed until consent is withdrawn or an objection is made, without prejudice to retaining minimal suppression information needed to ensure that the individual’s preference continues to be respected; and
• cookie-related data will be retained for the periods specified in the Cookie Policy or consent-management mechanism.

At the end of the applicable period, personal data will be deleted, anonymised or retained on a restricted basis where continued retention remains legally necessary.

12. Security and Confidentiality

Lisboa Investments uses technical and organisational measures appropriate to the risk to protect personal data against unauthorised access, loss, alteration, disclosure, destruction or unlawful processing.

Access to Client and project information is limited according to professional need and, where service providers or external specialists are involved, appropriate confidentiality and data-protection obligations are applied according to their role.

No information system can guarantee absolute security, but reasonable measures are implemented to prevent, detect and respond to incidents.

13. Your Data Protection Rights

Subject to the conditions and limitations set out in applicable law, data subjects may have the following rights:

• the right of access to personal data;
• the right to rectify inaccurate or incomplete personal data;
• the right to erasure;
• the right to restriction of processing;
• the right to data portability, where applicable;
• the right to object to processing based on legitimate interests, on grounds relating to the individual’s particular situation;
• the right to object at any time to processing for direct-marketing purposes;
• the right to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal; and
• the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, where that right applies.

The exercise of these rights is subject to the conditions and exemptions set out in the GDPR and other applicable law.

14. How to Exercise Your Rights

Requests to exercise data protection rights, or other privacy-related questions, may be sent to geral@lisboainvestments.com.

Additional information strictly necessary to verify the identity of the requester and protect personal data from improper disclosure may be requested.

Requests will be handled within the time limits provided by the GDPR. Exercising data protection rights is generally free of charge, without prejudice to circumstances in which applicable law permits a reasonable fee or the refusal of manifestly unfounded or excessive requests.

15. Right to Lodge a Complaint

Without prejudice to any other administrative or judicial remedy, data subjects have the right to lodge a complaint with a competent supervisory authority.

In Portugal, the supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD).

16. Cookies and Similar Technologies

The website may use cookies and similar technologies for essential functionality, security, preferences, performance, analytics or other features.

Cookies or technologies that are not strictly necessary will only be used where there is a valid legal basis and valid consent as required by applicable law. Users may manage or withdraw consent through the mechanism made available on the website.

The Cookie Policy should identify the cookies actually used, their providers, purposes, duration and other information required by applicable law.

17. Third-Party Websites and Services

The website may contain links to websites, platforms or services operated by third parties. This Policy does not govern the privacy practices of those third parties, which are responsible for their own processing activities. Users should review the relevant third-party privacy notices.

18. Children

The Lisboa Investments website and services are primarily intended for adults and for business or professional contexts. Lisboa Investments does not intend to knowingly collect personal data from children through its general website forms.

If personal data relating to a child is identified as having been collected improperly, appropriate steps will be taken to delete the data or otherwise regularise the processing as applicable.

19. Automated Decision-Making and Profiling

Lisboa Investments does not generally use personal data collected through the website or in connection with its services to make decisions based solely on automated processing that produce legal or similarly significant effects on individuals.

If such processing is introduced in circumstances relevant under the GDPR, the additional information required by law will be provided before the relevant processing takes place.

20. Changes to this Privacy Policy

This Policy may be updated to reflect changes in our activities, website, technology providers, processing practices or applicable law.

The published version will state the date of the latest update. Where a change is material and the GDPR or other applicable law requires it, additional notice will be provided to affected individuals through appropriate means.

21. Contact

For privacy or data-protection questions:

Lisboa Investments
Email: geral@lisboainvestments.com