This Cookie Policy explains how BTG Pactual Portugal – Empresa de Investimento, S.A. ("we", "us", "our", "the Firm"), as the controller, uses cookies and equivalent tracking technologies on the public website btgmarket.com, the BTG MARKET secure Client Portal (client.btgmarket.com), the BTG MARKET WebTrader (trading.btgmarket.com), and the BTG MARKET iOS / Android mobile apps (collectively, the "Services"). It should be read together with our Privacy Policy and, where applicable, with the Terms of Service.
Cookies
Small text files, typically 32 bytes – 4 KB, composed of a Name, Value, Domain, Path, Expires, Secure, HttpOnly and SameSite attribute, stored by your browser or web-view on your device's local storage, pursuant to the HTTP Cookie specification (RFC 6265bis draft 14). Cookies are set either by our domain ("first-party cookies") or by a different domain such as an analytics vendor, CDN or widget provider ("third-party cookies").
Equivalent Identifiers
Technologies which, alone or in combination, enable the identification of a device, browser, app-install or pseudonymous user profile, including but not limited to: HTML5 Local Storage & SessionStorage, IndexedDB, WebSQL, service worker cache, ETags / Entity Tags, canvas / webgl / audio-context fingerprinting, entropy-based device fingerprint scripts, IDFA (Apple) / AAID (Google) advertising identifiers, AppSetId, push notification tokens, SDK-level telemetry, pixel tags / web beacons / 1×1 clear gifs, UTM parameters.
Wherever the word "Cookie" is used in this Policy, it includes both traditional RFC 6265 cookies and equivalent identifiers listed above.
The deployment of cookies and equivalent identifiers is governed in Portugal by:
- Lei 59/2021, of 18 August (Lei da Cibersegurança e Privacidade Eletrónica, LCP) — the Portuguese transposition of the ePrivacy Directive 2002/58/EC, as codified in 2025; Art. 6 governs the storage of and access to information on terminal equipment.
- Regulation (EU) 2016/679 (GDPR); CNPD Recommendation 02/2023 on cookies and consent (repealing 01/2019 and 01/2021).
- ESMA Opinion 2022 ESMA34-383-1986 on digital engagement practices under MiFID II / IDD (no "sludge" or dark patterns in consent collection).
- Commission Guidelines 05/2022 on consent under the GDPR (Art. 4(11) + 7 — freely given, specific, informed, unambiguous, evidence-backed, revocable, no detriment).
Golden rule: Save for the narrow, exhaustively-defined exception of "strictly necessary" cookies under Art. 6(1)(a) Lei 59/2021, no cookie or equivalent identifier may be set or read from a user's terminal equipment unless the user has given his or her explicit, informed, specific, revocable and freely-given opt-in consent, through a genuine and unambiguous affirmative act (click of a clearly-labelled "Accept" or granular "Save preferences" button; pre-ticked boxes, scrolling, continued navigation, hover actions do not constitute valid consent under CNPD 02/2023 recitals 46–58).
Lawful basis under GDPR: Art. 6(1)(c) (strictly necessary — legal obligation) for the Strictly-Necessary category; Art. 6(1)(a) (consent of the data subject) for all other categories (Analytics, Marketing, Personalisation, Social).
| Cookie Category | Lawful Basis (GDPR / LCP 59/2021) | User Control |
|---|---|---|
| 🟦 Strictly Necessary / Essential | Art. 6(1)(c) GDPR (legal obligation) + Art. 6(1)(a) LCP 59/2021 (exhaustive statutory exception) | Cannot be disabled; you can delete them via your browser, but core functions (authentication, security, ordering, payments, form state retention, fraud detection, load-balancing, cookie-banner consent state) will break. |
| 🟩 Analytics / Performance | Art. 6(1)(a) GDPR (explicit opt-in consent) | Toggle OFF by default. Granular per-vendor opt-in / opt-out via the Preference Centre. Consent can be revoked any time with one click. |
| 🟧 Marketing / Advertising | Art. 6(1)(a) GDPR (explicit opt-in consent) | Toggle OFF by default. Granular per-vendor opt-in / opt-out. |
| 🟪 Personalisation | Art. 6(1)(a) GDPR (explicit opt-in consent) | Toggle OFF by default. |
| 🟫 Social Widgets & External Content | Art. 6(1)(a) GDPR (explicit opt-in consent) | Disabled until you explicitly click to load (YouTube, Vimeo, X/Twitter, LinkedIn embeds). 2-click solution per CNPD 02/2023 §7.4. |
The following first-party cookies are always set, without consent, because they are strictly necessary for the provision of the Services explicitly requested by the user (Art. 6(1)(a)(i) LCP 59/2021):
| Cookie Name | Domain / Partitioned | TTL | Secure / HttpOnly / SameSite | Purpose & Technical Description |
|---|---|---|---|---|
btg_session | .btgmarket.com · Partitioned (CHIPS) | Session (max 4 h idle) | Secure · HttpOnly · SameSite=Lax | Principal HTTP-only authenticated session token for Client Portal & WebTrader. Bound to user_id, device_fingerprint, IP prefix /24, user-agent, rotated every 15 min via key-wrapping (AES-GCM). Provides authentication, RBAC, CSRF binding. No personal data in cleartext; payload is signed JWT + opaque opaque-session reference in Redis. |
btg_csrf_token | .btgmarket.com | 12 h | Secure · HttpOnly · SameSite=Strict | Cryptographically random CSRF double-submit token bound to session, prevents cross-site request forgery on form submissions, deposit / withdrawal POSTs, 2FA / security changes. |
btg_cookie_consent_v1 | btgmarket.com (1st-party, host-only) | 12 months | Secure · HttpOnly:No · SameSite=Lax | Stores anonymised user consent decision: timestamp (RFC 3339), consent_id UUID, per-category true/false, per-purpose per-vendor list, anonymised geolocation (country/region only), signature SHA-256 of payload. Used by the Consent Management Platform (CMP) to enforce consent in real-time. |
btg_consent_signature_v1 | btgmarket.com · Partitioned | 12 months | Secure · HttpOnly · SameSite=Lax | HMAC-SHA256 signature of the btg_cookie_consent_v1 payload signed with an asymmetric ES256 key rotated quarterly, allows non-repudiation of consent evidence (GDPR Art. 7(1)) and forensics in case of complaint / audit. |
btg_device_id | .btgmarket.com | 13 months | Secure · HttpOnly · SameSite=Lax | Cryptographically random device identifier (UUID v4) for fraud-detection & account-protection purposes (login anomaly, velocity rules, impossible travel, credential-stuffing mitigation). Strictly necessary under MiFID II Art. 25 (IT security obligations). Does not contain personal data; not used for advertising / analytics. |
btg_form_state_* | Host-only | Browser session | Secure · SameSite=Lax | Transient session cookies (no identifier, only form payload) to preserve multi-step onboarding / contact-form state across redirects, back-button, failed validation, lost connectivity events. |
AWSALB / AWSALBCORS | .btgmarket.com | 7 days | Secure · HttpOnly · SameSite=None / Lax | AWS Application Load Balancer (ALB) sticky-session affinity cookies; route a given client session to the correct backend target group within the same AZ for the duration of a trading session, without which live order / chat / WebSocket connections would intermittently drop. Set by AWS infrastructure; no personal data. |
btg_ab_* | Host-only | ≤ 48 hours | Secure · SameSite=Lax | Short-lived A/B-test and UX-improvement cookies, deployed strictly for the functioning of bug fixes, critical error resolution, WCAG accessibility improvement, critical security patching, strictly necessary platform stability (RUM error rate optimisation < 1% budget per user per month). No tracking, no cross-site sharing, no advertising. |
If and only if you click "Accept All" in the cookie banner, or explicitly enable the "Analytics" toggle inside the Preference Centre and click "Save preferences", the following cookies are set, for the sole purpose of measuring aggregated, pseudonymised (IP truncated to /26, client-side hashing of identifiers, no cross-device stitching without consent) website and Platform usage — we use the following vendors:
| Vendor | Cookies / SDKs | Retention | Data transmitted to Vendor | CCPA / GDPR Mechanism |
|---|---|---|---|---|
| Plausible Analytics AG (EU privacy-friendly, CH hosted) | 1st-party server-side ingestion · No cookies | 12 months raw; 24 months aggregate | Truncated IP, User-Agent, Referrer, Country, page-path, screen size (no PII, GA4-free, cookieless by design) | EU-Swiss adequacy decision · DPA · No Schrems-II transfer; available at plausible.io/privacy. |
| Hotjar Ltd. (Malta) | _hj* userAttributes / session recording / heatmaps | 365 days user, 13 months session | Anonymised DOM interaction (not keystrokes, not passwords), truncated IP, user agent, region-level geolocation, device spec. Excluded domains: client portal & WebTrader; only used on public marketing website. | EU Standard Contractual Clauses 2021/914 + DPA + TIA on file with the DPO. |
| New Relic / Datadog RUM (APM) | NRUM=*, DD_sdk | 8 days, then aggregated only | Platform performance metrics: error stack traces, resource timings, Core Web Vitals (LCP, FID, CLS). Strictly used for performance troubleshooting; no marketing; personal-data fields redacted client-side before transmission. | EU SCC 2021 + BCR of vendor; data residency: AWS eu-west-1 (Ireland). |
Default state: all disabled. The following cookies / pixels are only set if the user has explicitly granted opt-in consent for the Marketing & Personalisation categories:
- LinkedIn Ads (LinkedIn Ireland Ltd.) —
li_gc, li_sugr, AnalyticsSyncHistory, lidc, UserMatchHistory: conversion-tracking attribution for paid campaigns on the BTG MARKET LinkedIn page; TTL between session and 390 days; legal basis consent; EU SCC 2021 + LinkedIn DPA; users can opt out of LinkedIn advertising personalisation via linkedin.com/psettings/guest-controls. - Meta / Facebook Ads (Meta Platforms Ireland Ltd.) —
_fbp, fr, tr, sb, wd: Meta Pixel conversion attribution & Custom Audiences (Advanced Matching is disabled); EU SCC 2021 + Meta DPA; TTL up to 13 months; opt out via Your Online Choices (EDAA) & facebook.com/settings?tab=ads. - Google Ads Conversion Tracking (Google Ireland Ltd.) —
_gcl_au, _gac_gtm-*: conversion tracking only; no remarketing list building in the default state (remarketing is a separate vendor toggle); Consent Mode v2 Advanced deployed (ads_storage = denied by default, gtag consent API signalled in real-time). EU SCC 2021 + Google Ads Data Processing Terms + TIA on file.
BTG Pactual Portugal does not currently participate in any Real-Time-Bidding (RTB) open-exchange advertising. Third-party cookies are never used on the authenticated Client Portal or the WebTrader — only on the public marketing website, and only with explicit opt-in. The Firm's Preference Centre maintains a per-vendor list as required by CNPD 02/2023 §6.2, with 100% of vendors listed, legal basis declared, retention period specified, DPA reference linked.
The following equivalent identifiers (non-cookie) are used on the Services — governed by the same consent rules of §2–6:
HTML5 LocalStorage (Host-Only)
Category: Strictly Necessary. Stored keys: btg_ui_theme, btg_notification_dismissed_*, btg_last_selected_account, btg_twofactor_method. Encrypted with AES-128-GCM with device-bound key when sensitive. No cross-site access, no advertising use. You can clear localStorage in Chrome DevTools / Safari Privacy Inspector.
Mobile App SDK (iOS / Android)
Strictly Necessary SDKs: Firebase Cloud Messaging (secure push for 2FA login alerts, withdrawal confirmations, platform updates — not marketing); Sentry SDK for crash & performance monitoring; Apple IDFA or Google AAID are never accessed unless the end-user grants the separate, OS-level App Tracking Transparency (ATT) pop-up permission; marketing campaigns require OS ATT opt-in plus cookie-banner Marketing opt-in (double-gated).
Device Fingerprinting for Fraud
Category: Strictly Necessary (legal obligation: AML / NIS2 / MiFID Art. 25(2) security). Vendor: Signifyd / ThreatMetrix with CNPD registration number 12045/2023. Entropy-based canvas fingerprint, WebGL renderer, fonts, audio-context resonance, TCP/IP stack quirks — combined into pseudonymous device-risk-score; the output of this fingerprint is used solely for anti-fraud, anti-bot, login-protection, sanctions-screening, AML CIP risk-scoring functions; it is never used for advertising, analytics, personalisation, cross-site tracking, or user profiling outside the scope of Article 23 Lei 58/2019 (legitimate interest, fraud prevention, fundamental rights & freedoms balance test documented in the DPIA, registered with CNPD).
We deploy a CNPD 02/2023-compliant Consent Management Platform (CMP), certified with IAB Europe Transparency & Consent Framework v2.2 (TCF v2.2) with a Portuguese-language vendor list (GVL) and a custom proprietary cookie-script block:
- Banner appears on the user's first page visit, below the fold (no full-page overlays), with a minimum height of 210 px on mobile, 160 px on desktop, high contrast ratio (≥ 7:1) per WCAG 2.2 AA; no scroll-lock; no close-× button (consent is an opt-in affirmative action).
- Three equally prominent, equally-styled buttons (CNPD 02/2023 §7.11): (1) "Accept All" → all categories opt-in; (2) "Essential only" → rejects all optional categories & vendors; (3) "Manage / Preference Centre" → opens a second layer with a per-category on/off toggle (default OFF) and a collapsible per-vendor list with vendor purposes, legitimate interest claims, DPA/SCC links.
- Cookie Deprecation & Runtime Enforcement: every script, img src, iframe, SDK tag that reads/writes optional cookies is wrapped in a CMP conditional gating script and physically blocked from executing prior to affirmative opt-in consent for the corresponding purpose — no "cookie pong", no fallback tracking, no A/B testing of consent rates on the user (ESMA 2022 sludge prohibition).
- Consent evidence: immutable record stored in WORM storage (S3 Glacier Compliant Mode) per GDPR Art. 7(1), containing: full anonymised user identifier hash, consent_id, UNIX timestamp, user-agent hash, geo-country, CMP version, exact set of purposes & vendors accepted, HMAC signature of the payload, IP (truncated /26), browser language. Retention: 5 years + extended for ongoing dispute / CNPD investigation.
- Withdrawal at any time, one click, no detriment: a small semi-transparent floating "🍪 Cookie Settings" widget is permanently displayed in the bottom-left corner of every page (on both public site and secure authenticated platform), which opens the same Preference Centre and allows toggling, rejection, re-acceptance, full "Withdraw All" action — which fires an immediate vendor purge script and deletes all optional cookies / SDK identifiers from the device within 5 seconds.
In addition to the CMP widget, you can configure your browser or mobile OS at any time to:
- Block cookies entirely for a specific site, or globally (Safari "Block All Cookies", Chrome "Block third-party cookies", Firefox "Total Cookie Protection / dFPI");
- Delete all cookies, or cookies for a specific domain (chrome://settings/siteData, about:preferences#privacy in Firefox, Settings → Safari → Advanced → Website Data in iOS, Settings → Privacy → Cookies in Android Chrome);
- Send a Do Not Track (DNT: 1) signal (GNOME Web, Brave, DuckDuckGo Privacy Browser). Although there is no uniform industry standard for DNT handling, BTG MARKET — as a matter of principle — treats any DNT:1 signal as an automatic rejection of all Marketing / Analytics / Social cookies & SDKs, independent of any other consent state, and logs that fact in the evidence store.
Important caveat: if you choose to block strictly-necessary cookies, some parts of the platform will not be accessible (e.g., secure login to the Client Portal, two-factor authentication, fund-upload forms, live trading sessions). You will still be able to read the public marketing website in an anonymous mode.
This Cookie Policy is updated whenever we: (a) introduce new cookies or equivalent technologies; (b) replace a vendor; (c) are required to do so by a change in law, regulation, CMVM, Banco de Portugal or CNPD binding guidance, DPC/ICO/CNPD decision, EU adequacy decision update, or EDPB opinion; (d) change the legal basis, purpose or retention of any identifier. Material changes are notified via the cookie banner ("This policy has been updated — please re-consent") and, for authenticated clients, a secure Platform in-app banner 14 days prior to the effective date. The "Last updated" date at the top of this Policy is always the effective date of the current version.
For questions on cookies, CMP configuration, consent evidence (Art. 15 GDPR right of access), or to exercise any of your data-protection rights (rectification, erasure, restriction, portability, objection) in relation to cookies or equivalent identifiers, please contact our Data Protection Officer at privacy@btgmarket.com with subject line "COOKIE REQUEST – [Your Full Name]". Response times: acknowledgment 2 business days, substantive response within 30 calendar days (Art. 12 GDPR).
As a last resort, you have the right to lodge a complaint with the national supervisory authority — the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I nº 134, 1200-651 Lisboa — or the equivalent DPA in your habitual residence, place of work, or place of the alleged infringement (Art. 77 GDPR).