Privacy Policy
Last updated: 10 November 2026
1. Data controller
The controller of your personal data is Mosaic Mindset Unipessoal LDA, NIPC 519420861, Praça Marques das Minas n 2, 3 Dto, 2720-370, Amadora, Portugal (hereinafter "we"). You can contact us by phone at +351 938 875 183 or through the contact form on this website.
2. Legal framework
We process personal data in accordance with Regulation (EU) 2016/679 (GDPR), Portuguese Law No. 58/2019 implementing the GDPR, and Law No. 41/2004 on privacy in electronic communications.
3. Data we collect
Identification and contact data (name, email, phone, company), the content of your enquiries, contract and billing data, KYC/AML verification data (identity documents, beneficial ownership information), and technical data (IP address, browser type, cookies — see our Cookie Policy).
4. Purposes and legal bases
Answering enquiries and preparing offers (Art. 6(1)(b) GDPR); performing contracts (Art. 6(1)(b)); compliance with legal obligations, including accounting, tax and anti-money laundering law (Art. 6(1)(c)); our legitimate interests such as security and defending claims (Art. 6(1)(f)); analytics and marketing cookies only with your consent (Art. 6(1)(a)).
5. Retention
Enquiry data: up to 12 months after the last contact. Contract and billing data: 10 years as required by Portuguese tax law. KYC/AML records: 7 years after the end of the business relationship, as required by Law No. 83/2017. Consent-based data: until you withdraw consent.
6. Recipients
We share data only with trusted processors acting on our instructions (hosting, email, accounting, analytics providers), with public authorities where required by law, and with professional advisers bound by confidentiality. We never sell personal data.
7. International transfers
Data is stored primarily within the European Economic Area. Where a provider is located outside the EEA, transfers are protected by an adequacy decision or the European Commission's Standard Contractual Clauses.
8. Your rights
You have the right of access, rectification, erasure, restriction, data portability, objection and to withdraw consent at any time without affecting prior processing. You may also lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt).
9. Security
We apply appropriate technical and organisational measures, including encryption in transit, access control, and regular review of our providers.
10. Changes
We may update this policy. The current version is always available on this page with its date of last update.