Privacy Policy
Last Updated: August 2026
CONTEXT
Introduction
EXO Global (“EXO Global”, “we”, “us”, or “our”) is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you visit our website, request a consultation, or engage our services. It also sets out your rights under the applicable data protection legislation, including the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and Portuguese data protection law (Law No. 58/2019). Please read this Policy carefully. By using our website or services, you acknowledge that you have read and understood this Policy.1. Who We Are?
EXO Global is the “data controller” responsible for your personal data — meaning we determine how and why your data is processed. If you have any questions about this Policy or how we handle your data, you can contact us using the details in Section 17. Where required, our appointed data protection contact can be reached at the same address.2. Scope of this Policy
This Policy applies to personal data we process about prospective clients, clients, their family members and dependants included in an application, website visitors, and other individuals who interact with us. It applies to information collected through our website, consultations, email and phone communications, application forms, and any documentation you provide in the course of our services.
3. Personal Data We Collect
Depending on your relationship with us, we may collect and process the following categories of personal data:
- Identity data: full name, date and place of birth, nationality, passport and national ID details, photographs;
- Contact data: email address, telephone number, postal and residential address;
- Family data: information about your spouse, children, or dependants included in an application;
- Financial and source-of-funds data: proof of funds, bank statements, investment records, tax information;
- Professional and background data: employment history, qualifications, and information required for due diligence.
- Application data: details of the residency, citizenship, or immigration programme you are pursuing.
- Technical data: IP address, browser type, device information, and website usage data collected via cookies.
- Communications data: records of your correspondence and consultations with us.
4. How We Collect Your Data
We collect personal data directly from you when you complete forms on our website, book or attend a consultation, engage our services, or communicate with us. We may also receive data from third parties acting on your behalf or supporting your application, such as immigration lawyers, financial advisers, banks, due diligence providers, and government-authorised agents, as well as automatically through cookies and similar technologies when you use our website
5. Purposes & Legal Bases for Processing
We only process your personal data where we have a lawful basis to do so under the GDPR. The purposes and corresponding legal bases include:
- Providing consultations and advisory services, and preparing applications — performance of a contract, or steps taken at your request prior to entering a contract;
- Coordinating with third-party professionals and submitting applications to authorities — performance of a contract;
- Conducting due diligence and meeting anti-money-laundering and know-your-client obligations — compliance with a legal obligation;
- Responding to enquiries and managing our client relationship — legitimate interests;
- Improving our website and services — legitimate interests;
- Sending marketing communications — your consent, which you may withdraw at any time.
6. Special Category & Sensitive Data
Some data we process, such as information contained in official documents, may be considered sensitive. We only process such data where necessary for the establishment, exercise, or defence of legal claims, to comply with a legal obligation, or with your explicit consent, and we apply additional safeguards to protect it.
7. Sharing Your Data
We do not sell your personal data. We may share it, only as necessary, with:
- Independent third-party professionals supporting your application (immigration lawyers, financial and investment advisers, accountants);
- Banks, due diligence providers, and government-authorised agents;
- Relevant government authorities and immigration bodies for the purpose of your application;
- Service providers who process data on our behalf (for example IT and hosting providers), under written data processing agreements;
- Regulators, law enforcement, or other authorities where required by law.
8. International Data Transfers
Because we provide global mobility services, your personal data may be transferred to, and processed in, countries outside the European Economic Area (EEA), including the jurisdictions in which the relevant residency or citizenship programme operates. Where we transfer data outside the EEA, we ensure appropriate safeguards are in place, such as an adequacy decision by the European Commission or the use of Standard Contractual Clauses, or the transfer is necessary for the performance of your contract or the establishment of legal claims.
9. Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to provide our services, comply with our legal, regulatory, tax, and anti-money-laundering obligations, and resolve disputes. When data is no longer required, we securely delete or anonymise it. Retention periods vary according to the nature of the data and applicable legal requirements.
10. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse, alteration, or disclosure. These include access controls, secure storage, and confidentiality obligations on our staff and providers. While we take reasonable steps to safeguard your data, please note that no method of transmission over the internet is completely secure.
11. Your Rights
Subject to applicable law, you have the following rights in relation to your personal data:
- The right to be informed about how we use your data;
- The right of access to a copy of the data we hold about you;
- The right to rectification of inaccurate or incomplete data;
- The right to erasure (“right to be forgotten”) in certain circumstances;
- The right to data portability;
- The right to withdraw consent at any time, where processing is based on consent.
12. Cookies & Tracking Technologies
Our website uses cookies and similar technologies to enable core functionality, analyse traffic, and improve your experience. You can manage or disable cookies through your browser settings or our cookie banner, where available. Some cookies are essential and cannot be disabled without affecting website functionality.
13. Marketing Communications
Where you have consented, we may send you information about our services, programme updates, and events. You can opt out at any time by using the unsubscribe link in our communications or by contacting us. Withdrawing consent will not affect the lawfulness of processing carried out before withdrawal.
14. Children's Privacy
Our services are directed at adults. We only process data relating to children where they are included as dependants in a client application, and always on the basis of the consent and authority of a parent or legal guardian.
15. Third-Party Links
Our website may contain links to third-party websites. This Privacy Policy does not apply to those websites, and we are not responsible for their privacy practices. We encourage you to review the privacy policy of any third-party website you visit.
16. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal obligations. The updated version will become effective upon publication on this page, together with the revised Last Updated date. We encourage you to review this Policy periodically.
17. How to Contact Us & Complaints
If you have any questions regarding This Policy, please contact us:EMAIL ADDRESS
hello@exoglobal.com
PHONE LINE
+351 918 445 899
OFFICIAL WEBSITE
www.exoglobal.com
You also have the right to lodge a complaint with the supervisory authority. In Portugal, this is the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt. We would, however, appreciate the opportunity to address your concerns before you approach the CNPD, so please contact us first.
Ready to explore Portugal investment funds?
Compare regulated Portugal Golden Visa funds, review fees and investment strategies, and understand eligibility requirements, all in one place.