Data Protection Policy

1. Purpose of this policy

This Data Protection Policy explains how Qredit Brokers, within the scope of the activity of Mortgage Brokers, Lda, collects, uses, retains and protects personal data of users, customers, prospective customers, partners and professional contacts.

Personal data is processed in accordance with the General Data Protection Regulation, applicable Portuguese law and the obligations specific to the activity of a credit intermediary.

2. Personal data that may be processed

Depending on the interaction with Qredit Brokers, the following data may be processed:

• Identification and contact data, such as name, telephone, email, address, tax identification number and identification document, where necessary.
• Professional, financial and asset data relevant to the analysis or preparation of credit applications.
• Data relating to the household, income, expenses, credit liabilities, properties or purpose of financing, where provided by the data subject.
• Data transmitted through forms, contact requests, simulations, calls, messages or meetings.
• Technical browsing data, such as IP address, cookie identifiers, pages visited, device, browser and consent preferences.

3. Purposes and legal bases for processing

4. Data sharing

Data may be shared only where necessary and under the applicable legal terms, namely with lenders, technology service providers, consultants, public entities, supervisory authorities, judicial entities or alternative dispute resolution centres.

As a tied credit intermediary, Mortgage Brokers, Lda may work with the following lenders or groups indicated in Banco de Portugal’s public register:

• NOVO BANCO, S.A.
• BANCO SANTANDER TOTTA, S.A.
• ABANCA CORPORACIÓN BANCARIA, S.A., SUCURSAL EM PORTUGAL
• CAIXA GERAL DE DEPÓSITOS
• BANKINTER, SUCURSAL EM PORTUGAL
• BANCO BPI S.A.
• BANCO BIC PORTUGUÊS S.A.
• UNION DE CRÉDITOS INMOBILIÁRIOS, S.A., ESTABLECIMIENTO FINANCIERO DE CRÉDITO (SOCIEDAD UNIPERSONAL) - SUCURSAL EM PORTUGAL
• BANCO CTT, S.A.
• COFIDIS

Financial institutions may carry out their own analyses, including checks against legally permitted databases, where necessary to assess credit applications.

Where necessary to comply with legal, regulatory, complaint-handling or dispute-resolution obligations, data may also be shared with:

• Banco de Portugal, as the supervisory authority for credit intermediation activity.
• The complaints book and the entity managing that channel, where a complaint is submitted through it.
• The alternative dispute resolution entities listed in the Prior Information: Centro Nacional de Informação e Arbitragem de Conflitos de Consumo and Centro de Informação de Consumo e Arbitragem do Porto.

5. Data retention

Personal data is retained only for the period necessary for the purposes for which it was collected, applicable legal and regulatory periods, process management, complaints or defence of rights.

Where processing depends on consent, data may be processed until that consent is withdrawn, without prejudice to the lawfulness of processing carried out beforehand.

6. Data subject rights

Under the legal terms, the data subject may request access, rectification, erasure, restriction, objection, portability and withdrawal of consent, where applicable.

Requests should be sent to . Qredit Brokers may request additional information to confirm the data subject’s identity before responding. src@mbrokers.pt.

The data subject may also lodge a complaint with the Portuguese Data Protection Authority.

Complaints about credit intermediation activity follow the channels indicated in the Prior Information.

7. Security

Qredit Brokers adopts appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, improper disclosure or destruction. Even so, no system is completely immune to risk, so users should avoid sending unnecessary information through unsolicited channels.

8. International transfers

Whenever service providers are used that involve processing data outside the European Economic Area, appropriate safeguards will be adopted, such as adequacy decisions, standard contractual clauses or other legally provided mechanisms.

9. Updates

This policy may be updated to reflect legal, technical or operational changes. The version published on the website is the applicable version at any given time.