Privacy Policy

You are reading the English-language version of this document. This translation is provided for informational purposes only. The legally binding version, which takes precedence in the event of any dispute, is the original Portuguese version.

THEPREPLAN, LDA thepreplan.com

Last updated: 31 March 2026

This Privacy Policy explains how THEPREPLAN, LDA processes your personal data when you use the thepreplan.com website and platform (the “Platform”).

In summary:

THEPREPLAN, LDA is the controller responsible for processing the personal data you provide when using our services.

We use your data primarily to provide the services you have contracted for or to manage your account on the Platform.

We may send you communications about services similar to those you have already contracted for, based on our legitimate interest, and other communications based on your consent, which you may withdraw at any time.

We may share your data with partner service providers or subcontractors/processors, under conditions of security and confidentiality.

You have, among others, rights of access, rectification, erasure, objection, restriction, and portability of your data.

We recommend that you read this Privacy Policy in full to understand in detail how we use your data and for how long we retain it.

THEPREPLAN, LDA, with registered office at Praça Alexandre Herculano, 22, 4B, 8000-160, Faro, Tax ID (NIF) 519232828, registered with the Faro Commercial Registry Office, and website thepreplan.com (hereinafter “THEPREPLAN” or “Company”), is the entity responsible for processing the personal data you send us through our Platform, website, and applications (hereinafter, together, the “Platform”).

If you have any questions regarding the processing of your personal data, you may contact us at the following email address: support@thepreplan.com

You may also contact our Data Protection Officer (DPO) at: support@thepreplan.com

When you use our Platform, we may process the following categories of personal data:

Identification data: name and surname, tax identification number (NIF), identity document details, profile photo, signature (including, where applicable, an advanced electronic signature), access credentials (username and password).

Contact data: telephone number, email address, postal address.

Economic and financial data: card or bank account details (typically tokenized through payment providers), billing address, other data strictly necessary for invoicing and compliance with legal obligations.

Interaction and browsing information: IP address, online identifiers, technical logs, browsing behavior on the Platform, audience data and usage preferences. For more information, please see our Cookie Policy.

Commercial information or information related to contracted services: information about the services you use on our Platform, transaction history, communications, support requests, and relevant interactions.

Biometric data (where applicable): stroke, pressure, and speed data from an advanced electronic signature, used exclusively for signature validation and enhanced identification purposes, where you have expressly accepted this method.

We do not systematically collect or process special categories of personal data (for example, health data, religious or political beliefs), except where strictly necessary and on an appropriate legal basis (such as your explicit consent or a legal obligation).

THEPREPLAN will process your personal data for the purposes set out below, on the corresponding legal bases.

Certain data is requested as mandatory because it is necessary to:

create and manage your user account on the Platform;

provide the services you have contracted for;

manage the contractual relationship.

In these cases, the legal basis is the performance of a contract or the taking of pre-contractual steps at your request.

This includes, in particular:

Registration and management of your user account on the Platform.

Provision of the contracted services and related support.

Issuing invoices and managing payments.

Identity verification processes (“Know Your Customer” or KYC), where applicable.

Sending transactional communications related to the operation of the services, changes to terms, security notices, or management of technical incidents.

Monitoring compliance with the Platform’s terms and conditions, including managing incidents of misuse.

If you do not provide the data marked as mandatory, we may be unable to create your account, enter into the contract, or provide the requested services.

We will process your identification, contact, financial, and service-related data where necessary to comply with legal obligations to which THEPREPLAN is subject, in particular:

Tax and accounting obligations (issuing and retaining invoices and supporting documents).

Obligations relating to the prevention of fraud, money laundering, and other applicable sectoral rules, where relevant.

Responding to requests or orders from courts, law-enforcement authorities, or other competent public authorities.

THEPREPLAN may process your data on the basis of its legitimate interest, after weighing that interest against your fundamental rights and freedoms and applying appropriate safeguards.

This includes, for example:

Managing relationships with representatives of legal entities (corporate clients), to formalize and maintain communications necessary for the provision of services.

Verifying users’ identity (KYC) to prevent fraud, ensure the security of the Platform, and guarantee service quality.

Managing the collection of amounts owed for services rendered.

Analyzing usage patterns and building usage profiles based on browsing behavior (where you have accepted analytics/personalization cookies) to personalize your experience on the Platform.

Preventing misconduct, fraud, abuse, or use contrary to the terms of use, including the occasional review of internal messages on the Platform, where strictly necessary.

Sending promotional communications about THEPREPLAN products and services related to those you initially contracted for (marketing of similar products/services). You may object to this type of communication at any time.

You may request further information about the legitimate interest assessments we have carried out via support@thepreplan.com.

Where processing is not strictly necessary for the performance of the contract, for compliance with a legal obligation, or for a duly weighed legitimate interest, we may process your data on the basis of your express, free, specific, informed, and unambiguous consent.

This includes, for example:

Sharing your identification and contact data with partner service providers, when you request specific services requiring their involvement.

Handling certain requests, complaints, or contacts submitted outside an active contractual relationship, where no other suitable legal basis exists.

Use of an advanced electronic signature of a biometric nature, where you specifically accept this method.

Sending commercial communications about THEPREPLAN products and services, or those of partner companies, that are not strictly similar to services you have already contracted for.

Participation in webinars, surveys, and market studies involving the processing of personal data for statistical analysis and service improvement purposes.

Recording of telephone calls for quality-of-service purposes, subject to prior notice and your consent at the start of the call.

You may withdraw your consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.

We may disclose your personal data to third parties, always in a manner limited and proportionate to the purposes set out in this Policy:

Partner service providers, when you request specific services requiring their involvement (for example, consultants, professionals, or external entities). As a general rule, these partners act as independent controllers for their own processing and will inform you of their respective privacy policies.

Subcontractors/processors that provide services to THEPREPLAN (for example, hosting and cloud services, storage, communication tools, email delivery, payment platforms, technical support, analytics tools). These act only on our instructions and are bound by a written contract ensuring compliance with data protection and security rules.

Third parties for commercial communications, where you have given your express consent for this purpose (for example, partners with whom we co-organize campaigns or events).

Courts, administrative authorities, or law-enforcement authorities, when we are legally required to do so, or where necessary for the exercise or defense of rights in judicial or administrative proceedings.

You may request more detailed information about specific categories of recipients via support@thepreplan.com.

Some of our service providers may process your data in countries located outside the European Economic Area (EEA).

Whenever this occurs, we will ensure that:

the data transfer is carried out in accordance with applicable legislation; and

your data maintains a level of protection essentially equivalent to that existing within the EEA.

For this purpose, we will only use providers:

located in countries or territories recognized by the European Commission as offering an adequate level of protection; or

that provide appropriate safeguards, such as standard contractual clauses approved by the European Commission, binding corporate rules, or another equivalent legal instrument.

Where necessary, we may also apply additional technical measures, such as encryption and pseudonymization, to reinforce the protection of transferred data.

We retain your personal data only for as long as strictly necessary to fulfil the purposes for which it was collected, or for the period required by law.

By way of guidance:

During the contractual relationship: for as long as you remain an active user of the Platform or maintain a contractual relationship with THEPREPLAN (processing referred to in section 3.1).

Processing based on legitimate interest (section 3.3): until the purpose in question ceases to apply, or until you object, unless there are compelling grounds justifying continued processing (for example, fraud prevention for a reasonable period, or applicable statutory limitation periods).

Processing based on consent (section 3.4): until consent is withdrawn or, in the case of call recordings, for up to 1 year after the recording, unless a legal obligation requires a longer period.

Retention for legal obligations: for the periods provided for by law (for example, tax and accounting retention periods).

Once the active processing periods have ended, your data may be kept blocked during the statutory limitation periods applicable to the relevant obligations, solely for the purposes of compliance with legal obligations or the exercise/defense of rights in judicial or administrative proceedings.

The Platform’s forms include mandatory fields, without which we may be unable to provide our services or respond to certain requests. By submitting any form, you declare that the information provided is accurate, complete, and truthful.

To keep your information up to date, you should notify us, as soon as possible, of any changes or corrections to your personal data via: support@thepreplan.com.

Where available, you may also update some of your data directly in your private area on the Platform.

You may exercise, at any time and free of charge, the following rights in relation to your personal data:

Right of access: to know whether we process personal data concerning you and, if so, to access that data and obtain information about the processing.

Right of rectification: to correct inaccurate personal data or complete incomplete data.

Right to erasure (“right to be forgotten”): to request erasure of your personal data where one of the grounds provided for by law applies (for example, where the data is no longer necessary for the purposes for which it was processed, where you withdraw consent and no other legal basis applies, or where you object to processing for direct marketing purposes).

Right to restriction of processing: to request that processing be restricted in certain situations, for example, where you contest the accuracy of the data, where processing is unlawful but you do not want the data erased, or while an objection to processing is being assessed.

Right to object:

To object, at any time, to the processing of your data based on legitimate interest, for reasons related to your particular situation; to object, at any time and without justification, to the processing of your data for direct marketing purposes, including profiling related to such marketing. In this case, we will stop processing your data for that purpose.

Right to data portability: to receive the personal data you provided to us in a structured, commonly used, machine-readable format, and to transmit it to another controller, where processing is based on your consent or on the performance of a contract and is carried out by automated means.

Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out on the basis of consent prior to its withdrawal.

Right not to be subject to a decision based solely on automated processing: you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except in cases provided for by law. In those cases, we will ensure your right to obtain human intervention, to express your point of view, and to contest the decision.

How can you exercise your rights?

You may exercise your rights through:

Your private area on the Platform (where this feature is available), to manage certain preferences, in particular regarding commercial communications;

Sending an email to support@thepreplan.com, indicating the right you wish to exercise and providing sufficient information for us to securely identify you.

We may request additional information to confirm your identity, if necessary. We will endeavor to respond within the applicable legal deadline.

You also have the right to lodge a complaint with the National Data Protection Commission (CNPD) if you consider that the processing of your personal data infringes data protection legislation.

THEPREPLAN adopts appropriate technical and organizational measures to ensure the security of personal data and to reduce the risk of unauthorized, accidental, or unlawful destruction, loss, alteration, disclosure of, or access to such data.

Among other measures, we may implement:

encryption of communications (for example, HTTPS/TLS);

role-based and need-to-know access controls;

logs of relevant access and actions;

internal procedures for managing security incidents and data breaches.

Despite these efforts, we cannot be held responsible for your use of your access credentials (username and password) outside our Platform. It is essential that you keep your password confidential and do not share it with third parties.

In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will notify the competent supervisory authority and, where required by law, will inform you without undue delay.

a) Contact Forms and Internal Messaging Service

THEPREPLAN provides contact forms and, where applicable, an internal messaging service so that users can communicate with each other and with the Company.

Messages sent through these channels may be reviewed occasionally and proportionately, where strictly necessary, to:

ensure compliance with our terms of service;

prevent fraud, abuse, spam, or malicious content;

improve and ensure the security of the Platform.

We may block access to the messaging service if we detect communications that pose a risk to users or seriously breach the terms of use.

b) Two-Step Verification (Enhanced Authentication)

To enhance the security of your account, we may provide a two-step verification system. When you enable this feature, whenever we detect access from an unfamiliar device, we will send a code to your mobile phone or another designated channel, which you must enter together with your password.

c) Online Identifiers and Cookies

In providing our services, we may use third-party software and services to collect information as you browse or interact with our Platform’s content. The main purposes are to:

improve your user experience;

personalize content;

measure performance and identify technical errors.

For more information about the cookies used and their purposes, please see our Cookie Policy, available on the Platform, which supplements this Privacy Policy.

d) Artificial Intelligence and Automated Features

Certain features of the Platform may use artificial intelligence or machine learning mechanisms (for example, content recommendations, assisted form-filling, or abuse detection).

Under no circumstances will decisions based solely on automated processing that produce legal effects or similarly significant effects concerning you be made without:

a legal basis for doing so; and

you being clearly informed and, where applicable, your consent being obtained.

In such cases, we will always ensure your right to obtain human intervention, to express your point of view, and to contest the decision.

This Privacy Policy has been prepared in accordance with Regulation (EU) 2016/679 (GDPR), Law No. 58/2019, of 8 August, and other applicable national legislation on the protection of personal data.

THEPREPLAN reserves the right to update this Policy at any time, in particular to reflect legislative changes or changes to the Platform or the services provided.

Any change will be published on the Platform, indicating the relevant revision date. We recommend that you review this Policy regularly.

© 2026 THEPREPLAN, LDA — thepreplan.com thepreplan.com | support@thepreplan.com