The data controller responsible for the processing of your personal data within the scope of the services offered through btgmarket.com (the "Website") and the BTG MARKET investment platform (the "Platform") is BTG Pactual Portugal – Empresa de Investimento, S.A. ("BTG Pactual Portugal", "we", "us", "our"), a Portuguese investment company authorised and supervised by the Comissão do Mercado de Valores Mobiliários (CMVM) under licence nº 414/21, with registered office at Av. da Liberdade 180, 1250-146 Lisboa, Portugal, tax identification number (NIPC) 516345591.
For privacy-related matters, you may contact our dedicated Data Protection Officer (DPO) at:
· Email: privacy@btgmarket.com
· Postal: DPO — BTG Pactual Portugal, Av. da Liberdade 180, 1250-146 Lisboa, Portugal.
For residents of EU member states other than Portugal, BTG Pactual Portugal designates its local EU regulatory contact via the CMVM passporting register, as required under Art. 27 of Regulation (EU) 2016/679 (the "GDPR").
We only collect personal data that is strictly necessary for the performance of our regulated investment services, the fulfilment of legal and regulatory obligations, and the legitimate and proportionate operation of our business. Specifically we process:
Account Onboarding & KYC
- Full name, date and place of birth, gender, nationality
- Government-issued ID, passport or residence permit
- Proof of residential address (utility bill, bank statement)
- Fiscal identification number (NIF / TIN / SSN)
- Occupation, employer, source of wealth / funds
- PEP, sanctions, adverse-media screening data
- Signature specimens, live selfie / biometric verification
- Investment experience, risk tolerance, objectives
Platform Usage & Interaction
- Login credentials, 2FA security tokens
- Device fingerprint, IP address, browser language
- Trading activity, orders, positions, P&L history
- Deposits, withdrawals, payment account identifiers
- Correspondence with client care & relationship managers
- Call recordings, chat transcripts, email thread content
- Marketing consents and preference centre choices
In accordance with Articles 6, 9 and 10 of the GDPR, we rely on the following lawful bases for each processing purpose:
| Purpose | Lawful Basis (GDPR Art. 6) | Storage Trigger |
|---|---|---|
| Execution of client agreement, order routing & execution | (b) Contract necessity | Duration of relationship |
| Client identification & verification (KYC / CDD / EDD) | (c) Legal obligation (AMLD5/6, Lei 83/2017) | + 5 years after closure |
| Monitoring sanctions, PEP & adverse media | (c) Legal obligation + (f) legitimate interest (fraud prevention) | + 7 years after closure |
| Regulatory reporting to CMVM, BdP, OAM, tax authorities | (c) Legal obligation (DSI 4/2015, CIRC) | As required by law |
| Client suitability & appropriateness assessments | (c) Legal obligation (MiFID II, RTS 16) | + 5 years after service end |
| Fraud detection, cybersecurity & anti-abuse controls | (f) Legitimate interest (Art. 23 LPD) | + 3 years after last incident |
| Direct marketing (newsletter, product updates) | (a) Consent (revocable any time) | Until withdrawal |
| Website analytics & anonymised UX improvement | (a) Consent via cookie banner | 26 months |
Processing of special categories of personal data (criminal convictions, political opinions, health data revealed during onboarding) is only carried out when strictly required by Portuguese or EU anti-money-laundering law, and only under the safeguards provided by Art. 10 GDPR and Art. 21 of the Portuguese Data Protection Act (Lei 58/2019).
Within BTG Pactual Group, personal data may be shared with affiliated entities that act as processors or joint controllers solely for the performance of investment services, treasury, custody, research or group compliance. Group entities are located in Brazil, Chile, Colombia, Peru, Mexico, the United Kingdom, Singapore and Switzerland.
External recipients strictly limited to categories of persons bound by professional secrecy or equivalent contractual/NDA safeguards include:
- Supervisory and tax authorities (CMVM, Banco de Portugal, AT, OAM, FIU, EIOPA, ESMA, foreign equivalents)
- Liquidity providers, prime brokers, CSDs and CCPs (for order & trade settlement)
- AML/KYC/biometric identity verification vendors (KYC-Chain, Onfido, Veriff) — EU-based or SCC-bound
- Auditors, external legal counsel, compliance consultants
- Payment institutions, card issuers, correspondent banks
- Cloud & hosting providers (AWS EU/Ireland, OVHcloud France) — under Standard Contractual Clauses 2021/914 + TIA.
For any transfer to third countries outside the EU/EEA, we verify an adequacy decision by the European Commission or implement appropriate safeguards (Standard Contractual Clauses — Decision (EU) 2021/914, Binding Corporate Rules, or an equivalence finding by the CNPD/CMVM).
Personal data is not kept longer than strictly necessary for the purposes for which it was collected, or as required by mandatory law. Default retention schedule:
- Trading records & execution tickets → 5 years from last transaction (MiFID II — Art. 25(3))
- Client file / KYC dossier → 5 years from account closure (Lei 83/2017, Art. 29; CMVM Regulation) extended to 7 years when litigation or investigation is pending
- Client classification / appropriateness → 5 years after the last service or recommendation
- Tax records (DMR, 2326, RCIV) → 10 years (Art. 117 CIRC / Art. 18 LGT)
- Call recordings (mandatory under MiFID II) → 5 years from the recorded call
- Complaints register → 5 years after closure (DSI 4/2015)
- Marketing consents → Until withdrawal; then erased within 30 days
- Security / fraud log data → 3 years from the event logged.
After retention deadlines, data is either permanently anonymised (for statistical use without attribution to a natural person) or securely deleted through NIST SP 800-88 Rev.1 certified overwriting / crypto-shredding procedures.
As a data subject, you may exercise the following rights, free of charge, by writing to privacy@btgmarket.com (identity verification required).
Right of Access (Art. 15)
Obtain a transparent and complete copy of the personal data we hold about you, including the processing purposes, categories, recipients and retention periods.
Rectification (Art. 16)
Request immediate correction of inaccurate or incomplete personal data (e.g. new address, updated ID document).
Erasure (Art. 17)
Request deletion of personal data, to the extent its processing is no longer necessary for the purposes it was collected, and subject to overriding retention obligations under financial services law.
Restriction (Art. 18)
Temporarily suspend processing accuracy disputes, legal claims, or illegality challenges.
Portability (Art. 20)
Receive, in a structured, commonly-used and machine-readable format (JSON or CSV), any personal data processed by automated means based on consent or contract.
Objection (Art. 21) + Withdrawal of Consent (Art. 7(3))
Object at any time to processing based on legitimate interests, including direct marketing profiling. Consent for analytics & marketing can be withdrawn with one click, at any time, without affecting the lawfulness of processing already carried out.
BTG Pactual Portugal will respond within 30 calendar days of receipt of a valid request, extendable by a further 60 days in complex cases, per Art. 12(3) GDPR. If you are unsatisfied with our response or believe that processing infringes the GDPR or Portuguese Law 58/2019, you have the right to lodge a complaint with the national supervisory authority, the CNPD – Comissão Nacional de Proteção de Dados, Av. D. Carlos I, nº 134, 1200-651 Lisboa, within 12 months.
Our use of cookies and similar tracking technologies (pixels, localStorage, SDKs, fingerprinting scripts) is detailed in full in our Cookie Policy. In summary: strictly-necessary cookies are deployed without consent (legal basis Art. 6(1)(c) GDPR + Art. 6 of Law 59/2021); analytics, advertising, personalisation and social cookies are only deployed following explicit, granular, revocable opt-in consent collected through our cookie banner on first page visit.
We implement and maintain technical and organisational security measures required under Art. 32 GDPR, Art. 26 LPD and CMVM Instruction DSI 4/2015 (IT Security), including:
- End-to-end encryption of personal data at rest (AES-256-GCM) and in transit (TLS 1.3 with HSTS preload and Perfect Forward Secrecy)
- ISO/IEC 27001:2022 + NIST CSF-aligned information security management system (ISMS)
- Role-based access control (RBAC) + zero-trust MFA (WebAuthn / FIDO2) for all internal users
- Immutable SIEM event log retention, 24/7 SOC monitoring, quarterly vulnerability scanning, annual penetration testing
- Dedicated data breach response plan, DR/BCP tested twice yearly with RPO ≤ 4 h and RTO ≤ 8 h.
Any personal data breach that is reasonably likely to result in a risk to the rights and freedoms of natural persons shall be notified to the CNPD and, when applicable, the CMVM within 72 hours of awareness, in accordance with Art. 33 GDPR. If the breach is likely to result in a high risk to you, we shall communicate the incident to you without undue delay, with details of the incident, its effects, and the mitigation measures undertaken.
The Platform and the services offered are reserved for natural persons of legal age (≥ 18 years old). We do not knowingly solicit or collect personal data of minors (under 18) or otherwise vulnerable persons. If you become aware that a minor has submitted personal data to us, please notify privacy@btgmarket.com so that we can immediately erase such data and close any account opened in contravention of this policy.
BTG Pactual Portugal may update this Privacy Policy from time to time to reflect changes in law, regulatory practice, CMVM guidance, technology or the scope of services. Material changes will be notified by prominent notice on the Website homepage for a minimum period of 30 calendar days before they enter into force, and — where technically feasible — by Platform message or email to registered clients. The "Last updated" date at the top of this document is the effective date of the current version.
For all privacy-related questions, data-subject requests, or DPO correspondence, please contact us at privacy@btgmarket.com with the subject line "Privacy Request – [Your Full Name] – [Nature of Request]". Response KPI: acknowledgement within 2 business days, substantive response within 30 calendar days.