NOVO BANCO, S.A., with its registered office at Campus do novobanco, Avenida Doutor Mário Soares, Taguspark, Building 1, 2740‑119 Porto Salvo, Portugal, registered under the single corporate and commercial registration number 513 204 016 at the Lisbon Commercial Registry Office, with a share capital of EUR 2,245,000,000.00 and SWIFT address BESCPTPL, is responsible for the processing of your personal data.

novobanco only collects and processes the personal data necessary to provide you with a high‑quality and as personalised a service as possible, in its capacity as a credit institution, financial intermediary and insurance intermediary. novobanco does not process personal data that is not required for the legitimate purposes it pursues.

In providing its services and offering its products, novobanco processes, or may process, various categories of personal data, including:

• Demographic data (e.g. name, gender, place of birth, date of birth, nationality);
• Contractual data (e.g. account number, IBAN, contract reference and other information relating to contracted products/services);
• Contact details (e.g. address, telephone number, mobile number, email address);
• Government-issued identification data (e.g. citizen card or identity card number, tax identification number, passport number);
• Digital identification data (e.g. IP address, digital signature, cookies);
• Personal activity data (e.g. academic qualifications, social media or internet data that the data subject has made public or authorised novobanco to access);
• Professional activity data (e.g. occupation, remuneration, employer, previously held positions);
• Financial position and transaction data (e.g. assets and their value, other income earned, liabilities within the financial sector, propensity to purchase financial products);
• Family data (e.g. marital status, number of children, household information);
• Voice recording data (e.g. call recordings – video and/or audio);
• Image recording data (e.g. video recordings (videoconferences, video calls), photographs, images captured through CCTV systems);
• Biometric data (e.g. data obtained through technical tools using biometrics to verify identity and authentication in client relationships with novobanco (e.g. facial patterns, voice biometrics, fingerprint)).

Under anti-money laundering and counter-terrorist financing legislation, novobanco complies with the identification and due diligence procedures set out in the applicable regulatory framework.

novobanco also processes personal data generated from the analysis of your use of our products and services, your transactions and your preferences, such as your customer profile.

novobanco only processes, or may process, your personal data in the following situations:

• For the performance of a contract entered into with you or to take steps at your request prior to entering into a contract;
• To comply with legal obligations to which novobanco is subject;
• For the purposes of the legitimate interests pursued by novobanco;
• Where you have given your prior consent.

To enable novobanco to fulfil all its obligations and provide you with the best possible services and products, it may need to disclose or grant access to your personal data to other entities.

novobanco will only share your personal data with the following categories of recipients:

• Other entities within the novobanco Group;
• Service providers to novobanco (e.g. IT services, telecommunications services, credit management and recovery services, archiving services, payment services, credit intermediation services);
• Organisations within and outside the European Union (e.g. other financial institutions, for example for the execution of transfer/payment operations, or regulatory authorities based outside the European Union, life insurers, non-life insurers, asset management companies, real estate fund management companies and pension fund management companies); and
• Supervisory authorities and other public/official bodies (e.g. Tax Authorities, Banco de Portugal, the European Central Bank, the Portuguese Securities Market Commission, and judicial or administrative courts).

novobanco only retains and processes your personal data for the purposes indicated above for the period of time that is necessary or required to fulfil those purposes. It applies appropriate data retention criteria to each processing activity, in line with applicable contractual, legal and regulatory obligations, or for the defence of the legitimate interests of novobanco or third parties.

In relation to the processing of your personal data, you have the following rights:

• Right of access;
• Right to rectification;
• Right to erasure;
• Right to restriction of processing;
• Right to data portability;
• Right to object;
• Right not to be subject to decisions based solely on automated processing;
• Right to withdraw your consent;
• Right to lodge a complaint with the supervisory authority.

You may exercise your rights through the following channels:

• Branch: you may exercise your rights by visiting your nearest branch;
• Email: you may exercise your rights by sending an email to dpo@novobanco.pt;
• Digital Channels: you may exercise your rights by accessing novobanco Online at www.novobanco.pt or via the App;
• Post: you may exercise your rights by writing to novobanco, addressed to the Data Protection Officer, at Campus do novobanco, Av. Dr. Mário Soares, Taguspark, Building 1, 2740‑119 Porto Salvo.

novobanco has appointed a Data Protection Officer, whose responsibilities include, among other duties, ensuring that the data processing activities carried out by novobanco comply with applicable legislation.

If you have any questions regarding the processing and protection of your personal data by novobanco, or about the information provided to you, you may contact the Data Protection Officer through the following channels:

• Email: dpo@novobanco.pt;
• Address: Campus do novobanco, Av. Dr. Mário Soares, Taguspark, Building 1, 2740‑119 Porto Salvo.