Privacy Policy

The data controller responsible for processing your personal data under the General Data Protection Regulation (EU Regulation 2016/679 — “GDPR”) and Portuguese Law no. 58/2019 is RMC Hub (encompassing family office advisory, architectural design, and operational systems).

For any queries regarding your personal data, requests for clarification, or to exercise your data subject rights, please contact our Privacy Point of Contact:

• Dedicated Email: privacidade@rmchub.pt
• General Contact: ola@rmchub.pt
• Postal Address: RMC Hub — Data Protection, R. 5 de Outubro 4, 8900-239 Vila Real de Santo António, Portugal.

The processing of your personal data complies with European and national data protection principles:

• Lawfulness, fairness, and transparency: Data is collected fairly with clear legal grounds and accessible prior notice.
• Purpose limitation: Data is collected solely for specified, explicit, and legitimate purposes.
• Data minimisation: We collect only data that is strictly adequate, relevant, and necessary.
• Accuracy: Reasonable steps are taken to ensure inaccurate data is rectified without delay.
• Storage limitation: Data is retained only for the period necessary to fulfil the intended purposes or legal obligations.
• Integrity and confidentiality: Appropriate technical measures protect against unauthorised access, unlawful processing, loss, or damage.

Depending on your interaction with our website and services, we may collect and process:

• Identification & Contact Data: Name and email address submitted through the contact form. The interest area and message are optional and may contain information you choose to provide; please avoid sensitive or unnecessary details.
• Advisory & Contextual Data: Asset profile, areas of interest (Family Office, Investment, Financing, Interiors, Systems), goals, and voluntary details shared in messages.
• Newsletter Subscription Data: Email address, consent timestamp, source, language, consent-text version, and subscription status. Subscription requires a separate optional opt-in.
• Technical & Security Data: Anonymised IP address, technical telemetry, browser type, operating system, and bot protection validation tokens (Cloudflare Turnstile).
• Session & Admin Data: Encrypted authentication tokens and audit log records for authorised backoffice users.

Your personal data is processed strictly under the following lawful bases:

• Pre-contractual steps upon request (Art. 6(1)(b) GDPR): Responding to contact inquiries, assessing asset advisory needs, scheduling meetings, and drafting consulting proposals.
• Explicit consent (Art. 6(1)(a) GDPR): Sending newsletters, market notes, investment insights, and editorial articles. Consent may be withdrawn at any time.
• Compliance with legal obligations (Art. 6(1)(c) GDPR): Tax compliance, statutory bookkeeping, regulatory records, and official complaint book management.
• Legitimate interests (Art. 6(1)(f) GDPR): Ensuring web infrastructure cybersecurity, anti-spam form verification, bug fixing, and continuous user experience improvements.

Personal data is retained only for as long as necessary to achieve the stated purposes:

• Contact requests without a contract: Retained while the request is being handled. Once expressly marked as lost, data is deleted 24 months after the last actual contact. The “Closed” status is not removed by this routine. Different periods may apply where required by law or necessary to establish or defend legal claims.
• Newsletter Subscriptions: Retained while consent remains active. Unsubscribe must immediately stop sends; records without evidence of consent are suppressed until a fresh explicit subscription. Inactivity is not inferred from missing opens or clicks.
• Contractual and Accounting Records: Retained for 10 years as required by Portuguese commercial and tax legislation.
• Security Logs: Kept for short technical intervals (typically between 30 and 90 days).

RMC Hub does not sell, rent, or trade your personal data to third parties for commercial or marketing purposes.

Data is shared only in the following strictly defined circumstances:

• Technical Infrastructure Subprocessors: Cloud hosting providers (Vercel / Hetzner / Cloudflare), managed database infrastructure hosted within the European Union (Supabase), and transactional email delivery services, all operating under binding Data Processing Agreements (DPA) compliant with Art. 28 GDPR.
• Regulated Specialist Partners: When your project requires legally regulated acts (such as credit intermediation supervised by the Bank of Portugal, formal legal counsel, or licensed real estate transactions with AMI/IMPIC), your data is shared only after your explicit prior validation.
• Public Authorities: When required by statutory legal obligation or valid court order.

Personal data is primarily stored and processed within data centers located in the European Economic Area (EEA).

Where specialised technical service providers require data processing outside the EEA (such as the United States), RMC Hub ensures appropriate safeguards under European Commission standards, including:

• European Commission Adequacy Decisions (including the EU-US Data Privacy Framework);
• Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by technical encryption in transit and at rest.

Under the GDPR, you have the right to exercise the following rights at any time:

• Right of Access (Art. 15): Obtain confirmation and copy of your processed personal data.
• Right to Rectification (Art. 16): Correct inaccurate, incomplete, or outdated data.
• Right to Erasure / “Right to be Forgotten” (Art. 17): Request deletion when data is no longer necessary or consent is withdrawn.
• Right to Restriction of Processing (Art. 18): Suspend processing during verification of accuracy or lawfulness.
• Right to Data Portability (Art. 20): Receive your personal data in a structured, machine-readable format (e.g. CSV/JSON).
• Right to Object (Art. 21): Object to processing based on legitimate interests or direct marketing.
• Right to Withdraw Consent (Art. 7(3)): Revoke consent for newsletter or marketing communications at any time.
• No Automated Decision-Making or Profiling (Art. 22): RMC Hub does not engage in solely automated decision-making or profiling with legal or significant effects.

How to exercise your rights: Email your request to privacidade@rmchub.pt. We will respond within 30 days (1 month) in accordance with Art. 12(3) GDPR.

Supervisory Authority: You also have the right to lodge a complaint with the Portuguese Data Protection Authority:

• Authority: Comissão Nacional de Proteção de Dados (CNPD)
• Address: Av. D. Carlos I, 134 - 1.º, 1200-651 Lisboa, Portugal
• Website: www.cnpd.pt ↗

We implement risk-appropriate technical and organizational measures to safeguard personal data against unauthorized disclosure, loss, or alteration:

• End-to-end transport layer security (HTTPS / TLS 1.3);
• Encrypted credential storage and least-privilege role-based access controls (RBAC);
• Two-factor authentication (OTP) for backoffice administration;
• Incident response procedures committing to notify the CNPD within 72 hours (Art. 33 GDPR) and affected data subjects without undue delay when required by law (Art. 34 GDPR).

RMC Hub reserves the right to update this Privacy Policy periodically to reflect service improvements or regulatory changes. Any updates will be published here with the revised effective date.