Version of 6 October 2026 · Informative translation — the binding contractual version is the Spanish one.

Provider. SIMBIOSE CARBONO SILÍCIO, SOCIEDADE UNIPESSOAL LDA, NIPC 519567625, with registered office at Rua do Sobreiro, 16, 4705-333 Braga (Portugal), share capital of 5,000 euros and registered with the Conservatória do Registo Comercial de Vila Nova de Gaia (hereinafter, “Synapse”). Contact: filipe.freitas@projectsynapse.ai; privacy: privacy@projectsynapse.ai.

Platform. The Project Synapse B2B SaaS real estate analysis service, available at nexus.projectsynapse.ai, which makes it possible to read supported documentation, extract information and generate professional support dossiers (the “Platform”).

Professional User. The real estate agency, agent or natural or legal person that contracts the Platform for its business or professional activity (the “Professional” or “Client”). Authorised users shall act on behalf of the identified entity.

B2B Scope. These terms are addressed exclusively to professionals. The contracting party declares that it is of legal age, is acting for the purposes of its professional activity and has sufficient authority to bind its organisation; this declaration does not remove mandatory rights should the relationship be of a different nature.

Entry into force: from the express acceptance of this version, without retroactive effect on prior rights or obligations.

1. ACCEPTANCE, CONTRACTUAL DOCUMENTATION AND TERM

1.1. Before activating the service, the Professional must identify the entity and expressly accept these terms and the Data Processing Agreement (“DPA”). The texts shall be available to be read, downloaded and stored. Mere access, silence or signing in with Google does not replace such acceptance.

1.2. The relationship comprises these terms, the order or the accepted particular terms and the DPA under which Synapse acts as processor. The Privacy Policy provides information on Synapse’s own processing operations. The particular terms prevail within their scope and the DPA in matters of data protection, always in compliance with mandatory rules.

1.3. The contract is concluded with the company identified in the heading. Synapse shall keep evidence of the version and text accepted, the date, user, entity and act of acceptance, and shall provide confirmation on a durable medium. The Professional may correct its data before confirming an order.

1.4. This version replaces the previous terms from its acceptance. Any assignment of contracts or assumption of obligations of the previous operator shall require the applicable instrument and consent; this clause does not, in itself, extinguish or transfer prior liabilities or acquired balances.

2. SUBJECT MATTER AND POSITION OF SYNAPSE

2.1. Synapse makes it possible to analyse properties in Spain and Portugal and to generate valuation dossiers, investment audits and corporate dossiers as contracted. The calculation combines official sources and legitimately provided sales; the AI extracts, drafts and adjusts the value within a band limited by rules. The comparables test the result. Extracted encumbrances are shown separately; the declared situation and free text may have a bearing on complementary analyses. Bare ownership is calculated on the basis of market value.

2.2. Synapse provides a technological tool. Dossiers are not officially approved valuations, land registry certifications or legal, financial or tax advice; they do not guarantee sale prices, returns or the absence of encumbrances. The Professional shall review results, dates, sources and possible AI errors before using or communicating them.

2.3. The Professional is responsible for its activity and its relationship with its clients, for the legal basis and the authority to provide each document and for the decision to share results. Synapse is responsible for its own commitments and may not transfer to the Professional the fulfilment of its obligations as provider or processor.

2.4. Unless expressly agreed, there is no exclusivity, agency, mandate, partnership, franchise, employment relationship or representation between the parties.

3. ACCOUNT, AUTHORISED USERS AND SECURITY

3.1. The Professional shall provide truthful and up-to-date data regarding its entity, representative, contact and billing. Use shall be limited to the authorised users and contracted capabilities, without sharing credentials or using third-party accounts.

3.2. The Professional shall assign permissions on a least-access basis, safeguard credentials and be responsible for its authorised users. It shall report without delay any loss, improper access or suspected incident.

3.3. Synapse may apply strong authentication, session limits and other reasonable measures. The Professional shall keep its devices, browsers, systems and connections up to date.

3.4. The Professional shall not attempt to access third-party data, circumvent controls, introduce malware, test vulnerabilities without authorisation, carry out reverse engineering beyond legal limits or overload the Platform.

4. LAWFUL USE, CONTENT AND PROFESSIONAL SERVICES

4.1. The Professional shall only provide lawful and necessary data. Sales executed by public deed that are legitimately known shall be limited to price, floor area, date and the necessary location: the report shall show the street or area, without number, floor, door, postcode or the identity of the parties. The Professional shall declare its entitlement before use; Synapse shall record the user and date outside the dossier. They shall be used only in the Professional’s own file, without shared databases. The Professional shall not copy third-party services without authorisation; the declaration does not replace the necessary rights.

4.2. The enabled types of property, land registry, cadastral and energy documentation from Spain and Portugal are accepted. Private contracts of sale or promissory contracts (CPCV), records on individuals, health data, criminal convictions or other excessive information must not be uploaded. Redaction by means of black boxes does not guarantee the removal of the text layer.

4.3. It is prohibited to create solvency files or individualised profiles of persons, to reuse land registry information on a massive scale, to disseminate restricted documentation, to resell databases or comparables, to remove warnings or to use the service for unlawful purposes. Each dossier and its sharing must be limited to authorised recipients and purposes.

4.4. Synapse may remove or restrict content and suspend functionalities where there are reasonable indications of unlawfulness, risk to persons or systems, breach of contract or a request from an authority. Save in cases of urgency or legal prohibition, it shall communicate the reason and allow the matter to be remedied or representations to be made.

5. SUBSCRIPTION, DOSSIERS, BILLING AND PAYMENTS

5.1. Nexus Inversor is offered in two plans, defined by the market of the properties analysed and not by the Client’s country: Nexus Inversor · Portugal, for properties located in Portugal, with an allowance of 20 dossiers per month; and Nexus Inversor · Portugal + Spain, for properties located in Portugal and in Spain, with an allowance of 30 dossiers per month. Allowances are replenished at the start of each monthly cycle and are not cumulative. The ordinary rate of both plans is €59.90 per month (VAT included). Sign-ups until 31 December 2026 benefit, during their first twelve months, from €19.90 per month (VAT included) on the Portugal plan and €29.90 per month (VAT included) on the Portugal + Spain plan; thereafter the ordinary rate notified applies. Both plans may also be paid yearly, with the same monthly allowance: €199 (VAT included) for the Portugal plan and €299 (VAT included) for the Portugal + Spain plan; the yearly price is guaranteed for the year paid and its renewal shall be at the rate then in force, notified in accordance with clause 5.4. A pack of three dossiers is also offered for €9.90 (VAT included), as a promotional launch price until 31 December 2026, without a subscription, which also serves as a top-up when the monthly allowance runs out and, with the Portugal plan, for properties located in Spain; and one free dossier upon registration, without a card. Before payment, the features, taxes and total price shall be set out in detail. No overages or additional services shall be charged without acceptance.

5.2. Each dossier is reserved when requested and deducted when it becomes available. If delivery fails, it is automatically restored; defects attributable to the service are corrected without further consumption. If they cannot be remedied within a reasonable period, the Client shall choose between restoration or a refund of the corresponding amount. Synapse offers a refund of the first month if the service does not prove useful, on request to support during that first period; for yearly payment, if requested within the first thirty days, the full yearly fee is refunded. This guarantee is independent of the remedies for breach.

5.3. Payments are processed through Stripe; Synapse does not receive full card details. Non-payment shall entitle Synapse to claim the principal, interest and collection costs in accordance with Decreto-Lei n.º 62/2013, de 10 de maio, and to apply a proportionate suspension following prior notice, save in cases of fraud or urgency.

5.4. The subscription renews automatically at the end of each contracted period, monthly or yearly. The Client may cancel it at any time, without thirty days’ notice, with effect at the end of the paid period and without a pro rata refund, save for the guarantee in clause 5.2 or in the event of breach. Changes in price or terms shall be notified thirty calendar days in advance, allowing cancellation before they apply; they shall not reduce a promotion already contracted nor alter prior transactions.

5.5. Previous promotional dossiers are maintained until used up and are not redeemable for cash. The monthly plan does not generate a cumulative paid balance. If there is a previous balance of paid credits, upon termination —including voluntary cancellation— the unused portion shall be refunded within fourteen calendar days, at its effective purchase price and by the original means, save for justified impossibility, with tax adjustment. Credits correctly consumed are not refunded, without prejudice to the remedies for breach.

6. AVAILABILITY, MAINTENANCE, SUPPORT AND SECURITY

6.1. Unless the particular terms include a service level, the Platform is provided without a guaranteed availability percentage. Synapse shall use commercially reasonable efforts to keep it operational and secure.

6.2. Scheduled maintenance, updates, migrations or urgent interventions may be carried out. Synapse shall endeavour to communicate relevant scheduled interruptions and to minimise their duration. Urgent interventions may be carried out without prior notice in order to protect the service or comply with the law.

6.3. Generation depends on infrastructure, AI and external sources. Synapse shall act diligently in their selection and management and shall report relevant limitations. Missing data or an outdated source must not be presented as certainty; where it prevents delivery of the contracted service, clause 5.2 shall apply.

6.4. Support: filipe.freitas@projectsynapse.ai and the Concierge AI assistant, which discloses its automated nature and allows human assistance to be requested. In the absence of a particular agreement, no fixed hours or response time are guaranteed; Synapse shall respond diligently according to severity. Unnecessary data shall not be included. Legal, breach and export deadlines are governed by their specific clauses.

7. BACKUPS, DATA LOSS AND RESTORATION

7.1. The app processes originals in memory and discards the text after generation. In Synapse’s storage, WhatsApp PDFs expire after seven days and temporary download files after one day; deletion is asynchronous and the recycle bin adds seven days from its execution. DB backups rotate over fourteen days, with point-in-time recovery of seven days. No archiving of originals is offered. Retention periods across the entire chain, including Twilio/Meta and AI, are subject to the DPA and the Privacy Policy.

7.2. In the event of an incident, Synapse shall use commercially reasonable efforts to restore the information to the latest technically available and consistent copy. Full, immediate recovery or recovery to a specific date is not guaranteed.

7.3. The Professional shall safeguard its originals. Dossiers are private until shared by means of a link, valid for ninety days from its creation and renewable by the author for a further ninety; the author may revoke it. Anyone holding the link may open it without verification of their email: the Professional shall limit it to entitled recipients and avoid forwarding. Expiry or revocation does not delete downloaded copies. The service delivers the dossier without showing the internal path of the file.

7.4. Synapse shall not be liable for losses arising from deletions or instructions of the Professional or its users, data never sent or synchronised, credentials compromised for reasons attributable to the Professional, external systems or events that are unavoidable despite reasonable measures. Liability for a loss directly attributable to Synapse shall be governed by clause 11.

7.5. The exceptions in clause 11.3 apply to the exclusions in this clause. The absence of a copy kept by the Professional does not release Synapse from the fulfilment of its own backup, security and data protection obligations.

8. INTELLECTUAL PROPERTY, CONTENT AND DOSSIERS

8.1. The Platform and its protectable elements belong to Synapse or its licensors. A limited, non-exclusive and non-transferable licence is granted for the duration of the contract. Dossiers may be used in the professional activity and shared with authorised recipients, subject to the restrictions on data, sources and third-party rights.

8.2. The Professional retains its rights over the materials provided and grants exclusively the technical permissions necessary to extract information and to generate, host and transmit the dossiers in accordance with its instructions. This authorisation does not grant Synapse a licence for other purposes nor remove the territorial limitations of the DPA.

8.3. It is not permitted to train models, advertise, resell or create shared databases with documents, encumbrances or sales provided by the Client. Indicators from public sources may be reused in per-property caches in accordance with their licences, time limits and legal basis, as set out in the Privacy Policy; removing the name or applying a hash does not make them anonymous. Technical assistance shall be limited to the case reported by the Client.

8.4. Only comparables and content whose consultation, extraction, storage and communication are authorised shall be incorporated. Public access, live consultation or the absence of storage do not replace such coverage. The attribution and limits of each source shall be respected. Receiving a dossier does not transfer rights over third-party listings, photographs, software or databases.

8.5. The parties shall comply with the authorisations applicable to their respective materials and sources. Information on encumbrances requires professional review; it shall not be disseminated to recipients without a legal basis nor reused as a file of owners or debtors. Commercial collaboration agreements shall be formalised separately.

9. DATA PROTECTION

9.1. The parties shall comply with the GDPR and Lei n.º 58/2019, de 8 de agosto, without prejudice to the mandatory rules applicable to their respective processing operations. Synapse is the controller of the data processed for its own account, billing, security, support and commercial relationship purposes, in accordance with its Privacy Policy.

9.2. The Professional determines the lawfulness, purpose, information and recipients of the documentation provided and acts as controller. Synapse processes it as processor in accordance with the DPA, which must be accepted before uploading it. If the Professional in turn acts on behalf of another controller, it must evidence the authorisation and the corresponding sub-processing chain must be formalised.

9.3. Addresses, references and encumbrances may identify individuals. Synapse shall minimise documents locally before sending them to the Vertex AI models and shall block the transmission if the filter fails; this does not guarantee anonymisation. The Client shall limit documents to those that are necessary. The report and the encumbrance drafter shall exclude amounts and creditors; the extractor shall only process the necessary filtered text, in accordance with the DPA.

9.4. A legal basis shall not be presumed valid merely by generically invoking a brokerage contract or legitimate interest: it must exist in respect of the specific data subject and processing operation, with the information required by Articles 13 or 14 GDPR. Synapse shall assist with data subject rights, security and data protection impact assessments and shall notify personal data breaches to the Client without undue delay in accordance with the DPA.

9.5. Dossiers are hosted in Belgium and Firestore in the Europe multi-region. Vertex AI uses Gemini and Claude in the global location, with specific terms for Anthropic models; Firebase Authentication and Resend involve processing in the US. WhatsApp uses Twilio/Meta. Processing entirely within the EU is not guaranteed. The safeguards of Chapter V and the sub-processing obligations of the DPA apply. Information and a copy of the safeguards: privacy@projectsynapse.ai.

10. CONFIDENTIALITY

10.1. Each party shall protect the technical, commercial, strategic or business information of the other that is confidential by its nature or designation, using it only to perform the contract and limiting access to those who need it and are subject to equivalent duties.

10.2. Information shall not be confidential if it is public without breach, was already legitimately known, is lawfully received from a third party or is independently developed. A disclosure required by an authority shall be limited to what is necessary and, where possible, notified in advance.

10.3. The duty shall continue for five years after termination and, in respect of trade secrets and personal data, for as long as they retain that character or as required by law.

11. LIABILITY AND INDEMNITY

11.1. Each party is liable for damage attributable to its breach. Synapse does not guarantee the economic outcome of the Professional’s decisions, but maintains its obligations of diligence, security and provision of the service and its liability for its suppliers under the terms of the law and the DPA.

11.2. For limitable contractual financial loss caused by ordinary negligence, Synapse’s aggregate liability is limited to the amounts paid by the Client in the twelve months preceding the event. Within that scope, loss of profits and indirect losses are excluded. If there are no payments in that period, no contractual financial cap shall apply. All of the foregoing is subject to the exceptions in the following clause.

11.3. No limitation or exclusion, in these Terms or their annexes, extends to wilful misconduct or gross negligence, including that of representatives and auxiliaries; damage to life, bodily integrity or health; non-contractual financial loss; attributable breaches of confidentiality or intellectual property; rights under Article 82 GDPR; or legally non-waivable obligations or liabilities. Mandatory remedies for breach and the prohibitions of Decreto-Lei n.º 446/85 are preserved.

11.4. Compensation shall be determined according to the damage and the actual liability of each party. Both shall cooperate reasonably to mitigate the consequences of the incident. There shall be no double recovery for the same damage nor automatic transfer of penalties or of a party’s own breaches; any recourse shall respect Article 82 GDPR and mandatory rules.

11.5. The Professional shall hold Synapse harmless against claims by its clients or third parties arising from its services, content, charges, infringements of rights or breaches of law, to the extent that they are attributable to the Professional. Synapse shall give notice without reasonable delay, allow participation in the defence and shall not accept settlements imposing obligations on the Professional without its consent.

12. TERM, SUSPENSION, TERMINATION AND PORTABILITY

12.1. The contract remains in force for as long as there is an active account or service. Cancelling renewal does not amount to deleting the account. Reports shall be deleted after twenty-four months without sign-in or new dossiers, with notice at least thirty days in advance and an option to recover them; an earlier cancellation or deletion prevails. Cancellation is requested from support. Synapse may terminate for material breach not remedied within ten days of a formal notice, save in cases of urgency in accordance with the following clause.

12.2. Synapse may suspend proportionately in the event of a serious security risk, fraud, unlawful use, non-payment or a request from an authority. It shall report the reason and the possibility of remedy where legally possible. Suspension shall not permit Client data to be retained as security for payment nor to be deleted hastily.

12.3. Synapse shall carry out the ordinary export free of charge, through a secure channel and within ten business days of the request to support and verification of the authorised account. It includes PDF dossiers, fields, account data, transactions, usage logs and Client metadata in JSON or CSV. It excludes discarded originals, third-party data, code, credentials and protected models, without preventing the export of Client data. Synapse shall provide the register of formats and structures and the required open interfaces.

12.4. In order to switch provider or transfer the data to its own infrastructure, Synapse shall provide assistance by email, without switching charges. Where Chapter VI of Regulation (EU) 2023/2854 applies, a maximum notice period of two months and a maximum transition period of thirty calendar days shall apply; technical unfeasibility shall be justified within fourteen business days with an alternative of up to seven months. The Client may extend the transition once. Synapse shall maintain continuity and security and shall notify termination upon its completion; for deletion only, upon expiry of the applicable notice period. This does not extend the monthly cancellation period in clause 5.4.

12.5. There shall be thirty calendar days for recovery from the effective cancellation or the end of the transition, save for earlier lawful deletion. Upon expiry, active data shall be deleted and links revoked. Database backups have a fourteen-day cycle; residual copies relating to the processing shall be isolated and deleted within a further maximum of thirty days, in accordance with Article 25(2)(h) of Regulation (EU) 2023/2854. An extension of the recovery period shall require written agreement. Synapse shall certify the deletion and require it of sub-processors. Legal retention shall be limited to the data, purpose and period required, without retaining dossiers indefinitely.

12.6. Termination does not affect amounts accrued or the clauses which by their nature must survive, including intellectual property, confidentiality, data protection, liability and governing law.

13. MODIFICATION OF THE PLATFORM AND OF THE TERMS

13.1. Synapse may modify the Platform or these terms for legal, security, technical, operational or commercial reasons. Material changes shall be notified individually on a durable medium at least thirty calendar days in advance, explaining their scope and date.

13.2. The Professional may terminate before the entry into force if it does not accept a material change. Where the nature of the change —including a substitution of a contracting party— requires express consent, it shall be requested by electronic means.

13.3. The period may be shortened where necessary to comply with an urgent legal obligation, prevent fraud, respond to a security threat or remedy a vulnerability, with notice being given as soon as possible.

14. FORCE MAJEURE, ASSIGNMENT, SUBCONTRACTING AND COMMUNICATIONS

14.1. Neither party shall be liable for delays or failures to perform due to unforeseeable or unavoidable causes beyond its reasonable control, provided that it adopts mitigation measures and resumes performance when possible.

14.2. Synapse shall use the identified providers for the service, retaining the liability incumbent upon it. Sub-processing of data is subject to the authorisation, information and objection provisions of the DPA. Any other subcontracting requiring the Professional’s agreement must obtain it before taking effect.

14.3. The assignment of the contractual position by either party shall require the consent of the other, save for succession imposed by law. A reorganisation or transfer of business of Synapse does not replace that consent where it is required. The identity of the new party shall be notified and rights already acquired shall not be reduced.

14.4. Contractual communications shall be sent to the account, email address or channel designated by the Professional. The Professional shall keep its details up to date. Electronic records of acceptance, access, orders and communications shall constitute admissible means of evidence, without prejudice to evidence to the contrary.

15. GOVERNING LAW, JURISDICTION, LANGUAGE AND GENERAL PROVISIONS

15.1. The contract is governed by Portuguese law, in accordance with Regulation (EC) 593/2008. The parties agree to the jurisdiction of the courts of the judicial district (comarca) of Braga (Portugal), under the terms of Article 25 of Regulation (EU) 1215/2012, without prejudice to mandatory venues and rules and to the Portuguese regime on general contractual terms. The right of data subjects to lodge a complaint with their competent authority or court is not limited.

15.2. Spanish is the binding contractual version, of which notice shall be given before contracting in each language. Translations shall be identified and shall not be misleading. The invalidity of a clause does not affect the remainder where the contract can subsist; the supplementary statutory regime shall apply. Failure to exercise a right does not constitute a waiver.

15.3. These terms and their integrated documents constitute the agreement on their subject matter and replace previous versions from their entry into force, without affecting rights or obligations already arisen.

Version of 6 October 2026 · Informative translation — the binding contractual version is the Spanish one.

Privacy Policy

1.- Who is the controller of the processing of your data?

The controller of its own processing activities described in this policy is SIMBIOSE CARBONO SILÍCIO, SOCIEDADE UNIPESSOAL LDA (“SYNAPSE”), with NIPC 519567625 and registered office at Rua do Sobreiro, 16, 4705-333 Braga (Portugal).

We inform you that ownership of the Platform belongs to SYNAPSE.

This policy governs the data of professional users, representatives, contacts and visitors processed by SYNAPSE to manage accounts, invoicing, support and security. Where an agency or professional provides third-party data to generate dossiers, it determines the purposes as controller and SYNAPSE acts as processor under the DPA; requests relating to such data will be channelled to that client.

The User may contact SYNAPSE on data protection matters at the following email address: privacy@projectsynapse.ai

2.- Recommendations

Please read carefully and follow the recommendations below:

Keep your device equipped with duly updated antivirus software against malicious software and spyware applications that may endanger your Internet browsing and the information stored on your device.

Read and review this Privacy Policy and all the legal texts made available by SYNAPSE on the Platform.

3.- Information on the data SYNAPSE collects through the Platform

For the proper operation of the Platform, SYNAPSE may process the following data provided, where applicable, by the User:

• Account data: name, email, credentials managed through Firebase or Google OAuth identifiers, language and authentication data.
• Service and contracting data: entity and professional contact, NIF/NIPC and invoicing, subscription, orders, dossier quota and prior balance, payments and acceptance of the legal texts.
• Technical data: IP, session, security and usage; version, date, language and method of acceptance. With consent, browsing identifiers are processed for analytics and advertising measurement. Enhanced conversions with contact data are disabled. The absence of an email address does not exclude other personal identifiers.
• Enquiries include contact details, message and follow-up; Concierge uses AI and allows human assistance. Documents are minimised locally before Vertex AI and are not sent if the filter fails, without guaranteeing anonymisation. The app processes the originals in memory; WhatsApp and its providers are subject to the periods in section 7. Excessive data or unsupported documents must not be provided.

4.- Why is SYNAPSE entitled to process your data?

The lawful basis for the processing of Users' personal data through the Platform may rest on different legal grounds, depending on the purpose of the processing:

• Performance of the contract or pre-contractual measures (Art. 6.1.b GDPR) for clients who are natural persons; legitimate interest (Art. 6.1.f) to manage the contacts and users of clients that are legal persons, prevent fraud, maintain security and defend claims, subject to prior balancing.
• Compliance with legal obligations, where the processing is necessary to meet tax, accounting, commercial or administrative obligations, requests from authorities or the retention of legally required documentation.
• Consent (Art. 6.1.a GDPR) for optional promotional communications, analytics and advertising measurement. These are choices separate from contracting and refusing them does not prevent the service. Enhanced conversions are disabled and any introduction will be notified in advance with the corresponding consent.

You may withdraw consent in the cookie preferences panel or request to unsubscribe from commercial communications by replying to the message or writing to privacy@projectsynapse.ai, without affecting the lawfulness of prior processing. You may also object to legitimate interest under the terms of Article 21 GDPR.

5.- What are the purposes of the processing of your personal data?

SYNAPSE will process its Users' personal data lawfully, fairly and transparently. The purposes of the processing include:

• Managing registration, authentication and access to the User account.
• Managing subscriptions, orders, quotas and prior balances, access to the B2B service, contractual evidence and invoicing.
• Handling enquiries, rights requests and incidents by email and through Concierge, an AI assistant identified as such, with the option of human assistance; free text is filtered before processing and storage.
• Sending news to those who consent to it and, with separate choices, measuring usage through Analytics and advertising effectiveness through Ads. Enhanced conversions are disabled.
• Complying with legal obligations applicable to SYNAPSE.
• Maintaining security and operation, correcting errors in the reported case and reusing public indicators per property to avoid repeated queries, on the basis of a balanced legitimate interest and respecting licences. Postcodes are aggregated to select statistical queries. Internal dossier notifications include user, address and value, with restricted access. No solely automated decisions producing legal effects on users are made, nor personal creditworthiness profiles.

6.- Accuracy of the data provided by Users

The User warrants the accuracy of the personal data provided and undertakes to notify SYNAPSE of any changes to them.

SYNAPSE reserves the right to exclude, block or suspend access to the Platform and/or the User account where the User has provided false, inaccurate, incomplete or unauthorised data, without prejudice to any other actions available at law.

It is recommended to protect credentials and to report any unauthorised access. SYNAPSE retains its security and liability obligations under the GDPR, and this recommendation does not transfer them to the User.

7.- Data retention

Account and business relationship data will be retained for as long as necessary for the service. Enquiries will be retained until resolved and, where necessary, to deal with claims. Accounting and tax documentation will be retained, as a general rule, for ten years in accordance with Article 123 of the Código do IRC and other applicable legislation.

Marketing: until unsubscription, afterwards retaining only the necessary evidence and a minimal exclusion list. Ordinary logs: thirty days; Google administrative audit: four hundred. Caches: area and geocoding thirty days, Catastro ninety, valuation fourteen and KPIs seven. The address fingerprint does not anonymise. Upon expiry, use stops and automatic asynchronous deletion is executed; its completion is monitored.

Reports: active account or erasure; the limit of twenty-four months without access or new dossiers, with thirty days' notice, will apply from 30 November 2026. Codes: valid for 120 seconds. In Synapse, WhatsApp expires at seven days; temporary files, after one day (deletion observed between 27 and 42 hours); the trash retains them for a further seven days. DB backups: fourteen days; point-in-time recovery: seven. Twilio currently retains messages for four hundred days and media for thirteen months; Meta, up to thirty days. Vertex: abuse monitoring for up to ninety days when triggered by suspicious activity; Search, up to three days. Closure and copies: DPA and clause 12 of the B2B Terms; legal exceptions, only those necessary.

8.- Users' rights

Users have the right to:

• Access their personal data;
• Request the rectification of any inaccurate data;
• Request the erasure of their data;
• Request the restriction of the processing of their data;
• Object to the processing of their data;
• Request the portability of their data;
• They likewise have the right not to be subject to decisions based solely on automated processing which produce legal effects or significantly affect them, in the cases provided for in Article 22 GDPR.

You may exercise your rights at privacy@projectsynapse.ai or by post to SIMBIOSE CARBONO SILÍCIO, SOCIEDADE UNIPESSOAL LDA, Rua do Sobreiro, 16, 4705-333 Braga (Portugal). Additional, proportionate information will only be requested if there are reasonable doubts as to your identity. A response will be given within one month, extendable by a further two months due to the complexity or number of requests, with notice given within the first month.

Without prejudice to any other administrative remedy or judicial action, the User shall have the right to lodge a complaint with a Supervisory Authority, in particular in the Member State of their habitual residence, place of work or place of the alleged infringement, where they consider that the processing of their personal data does not comply with the regulations, or where they do not see the exercise of their rights satisfied. The supervisory authority with which the complaint has been lodged will inform the complainant of the progress and outcome of the complaint.

9.- Data security

SYNAPSE will apply technical and organisational measures proportionate to the nature of the data and the risks of the processing, in accordance with Article 32 of the GDPR, and will limit access to the authorised persons who need it for their duties.

These measures will include encryption, access control, separation between clients, credential protection and incident management. SYNAPSE will periodically assess their effectiveness and update them when the risks change. No measure can guarantee the absolute absence of incidents.

SYNAPSE undertakes to comply with the duty of secrecy and confidentiality regarding personal data in accordance with the applicable legislation.

The User must keep their credentials confidential. This does not limit SYNAPSE's own obligations or the rights of the persons concerned.

10.- Data recipients, service providers and international transfers

Data may be disclosed to authorities under a legal obligation, to Stripe for payment management and to recipients authorised by the client when it shares dossiers, always with the applicable basis and safeguards.

The following providers are involved in delivering the service, with access limited to the data necessary for each function:

Google Cloud EMEA Ltd: Cloud Run and Storage in Belgium and Firestore in the Europe multi-region; Firebase Authentication processes in the USA. Google Workspace provides corporate email.

Vertex AI: Gemini under the Google Cloud terms and Claude as an Anthropic offering with specific terms. Global location, with no exclusively European residency. Minimised text and the enabled images are processed; training is not authorised. Contextual search with Google Search receives the address, coordinates and necessary characteristics. Disabling request logs does not remove all technical retentions.

Plus Five Five, Inc. (Resend): transactional email from the USA, with the email address and necessary content. The service declares a period of up to ninety days for deletion after account closure.

Twilio Ireland Limited and WhatsApp Ireland Limited: WhatsApp channel. Apify Technologies s.r.o.: listing queries with street/area, via US infrastructure. Google Maps geocodes addresses as an independent controller; KEPTAGO LTD (Geoapify) generates maps with coordinates, via European infrastructure and Cloudflare access at the endpoint used.

Google Ireland Limited: Analytics and Ads, according to their function, and Tag Manager for tags. Enzuzo Inc. (Canada) manages consent, with possible US access. An external accountant accesses invoicing; support is internal. Stripe Payments Europe, Limited is involved in payments, with processor or controller functions depending on the purpose.

Each provider will access only the data necessary for its function and will act in accordance with its contract and role. Processing on behalf of SYNAPSE will be subject to a DPA; the provider's own purposes will be governed by the corresponding information and legal basis. Documents under the processing engagement will not be used for advertising analytics.

Likewise, the Platform gives access to certain services provided directly by third parties, with which the User interacts directly and which process their data under their own responsibility:

If you sign in with your Google account, it is Google Ireland Limited that processes your sign-in data in accordance with its own privacy policy: https://policies.google.com/privacy

If you make a payment, Stripe collects and processes the full card details without disclosing them to SYNAPSE. Stripe acts as controller for its own payment and fraud prevention functions, depending on the applicable entity and service: https://stripe.com/es/privacy.

There are global flows and flows to the USA, including Vertex, Firebase, Resend, Apify, Twilio/Meta and Stripe, and to Canada through Enzuzo. Transfers must be covered by adequacy applicable to the recipient and service or by standard contractual clauses and additional measures where appropriate. Google's DPA does not by itself cover Claude's own terms. You may request the specific destinations and a copy of the safeguards at privacy@projectsynapse.ai.

No data is sold and no models are trained with client documents. Sales provided are limited to the client's own file, with no common database, showing street/area and excluding identification of the parties. Shared caches reuse public indicators per property, not documents, charges or dossiers. Photograph processing removes metadata and pixelates detected faces before the AI; this does not guarantee anonymisation nor replace image rights.

11.- Changes

SYNAPSE reserves the right to revise its Privacy Policy at any time it deems appropriate. For this reason, please check this Privacy Policy regularly to read its most recent version.

Nevertheless, any change made to this Privacy Policy will be communicated to the User.

12.- Links to third-party websites and services

The Platform may include links to third-party services. The processing they carry out for their own purposes is governed by their privacy information. SYNAPSE retains the liability attributable to it for its own actions and for the providers processing data on its behalf.

For this reason, we recommend that the User carefully review the privacy policies and terms of use of any external page. The inclusion of these links on the Platform does not necessarily imply SYNAPSE's approval, supervision or responsibility for the contents, services or privacy policies of the linked pages.

Where data are processed on platforms or forms in which SYNAPSE acts as data controller, the processing will be governed by the specific information provided in each case.

13.- Questions

If you have any questions about our Privacy Policy, please contact us by sending an email to: privacy@projectsynapse.ai

You may lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), through www.cnpd.pt, or with the authority of the Member State of your habitual residence, place of work or place of the alleged infringement, in accordance with Article 77 GDPR.

Legal notice

1.- Right to information

The Website belongs to SIMBIOSE CARBONO SILÍCIO, SOCIEDADE UNIPESSOAL LDA (“SYNAPSE”), NIPC 519567625, with registered office at Rua do Sobreiro, 16, 4705-333 Braga (Portugal), share capital of 5.000 euros, registered with the Conservatória do Registo Comercial de Vila Nova de Gaia.

Access to and/or use of the Website confers the status of User. These browsing rules do not replace the express acceptance of the B2B Terms and the DPA required to contract and use the professional service.

The User may contact SYNAPSE at the following email address: filipe.freitas@projectsynapse.ai.

2.- Use of the Website

The Website allows properties in Spain and Portugal to be analysed through the enabled documents and sources. The calculation combines deterministic rules, official sources and lawfully provided sales; the AI extracts, drafts and adjusts the value within a band limited by rules. Comparables serve as a cross-check. Extracted charges are shown separately; declared circumstances and free text may influence supplementary analyses. The results require professional review.

The User assumes responsibility for the lawful use of the Website and for reviewing the results. The Platform provides access to dossiers, property data, texts, graphics and documentation (the “Contents”), subject to the rights of SYNAPSE, the client or third parties.

The User undertakes to make appropriate use of the Contents and services offered through the Website and, by way of illustration but not limitation, not to use them to:

• Engage in unlawful or illegal activities or activities contrary to good faith and public order.
• Cause damage to the physical and logical systems of SYNAPSE, its providers or third parties.
• Introduce or spread on the network computer viruses or any other physical or logical systems capable of causing the damage referred to above.
• Attempt to access, use and/or manipulate the data of SYNAPSE, third-party providers and other Users.
• Reproduce, distribute or exploit the Contents beyond the rights granted by the B2B Terms or by the authorisations and licences of the corresponding holders.
• Remove, conceal or manipulate the Contents subject to intellectual or industrial property rights, as well as the technical protection mechanisms or any information mechanisms in the Contents.
• Attempt to circumvent, remove or manipulate the technical restrictions implemented by SYNAPSE.

Registration, contracting, subscriptions, dossiers, payments, refunds, use of dossiers and processing on behalf of the client are governed by the B2B Terms and the DPA, available on the Legal page of nexus.projectsynapse.ai.

The general information published on the Website may be modified, replaced or updated by SYNAPSE at any time, without prejudice to the contractual, commercial or technical documentation applicable in each case.

SYNAPSE may temporarily suspend, without prior notice, the accessibility of the Website for maintenance, repair, update or improvement operations. However, whenever circumstances allow, SYNAPSE will inform the User, sufficiently in advance, of the planned date for the suspension of services. SYNAPSE is not responsible for the use that Users may make of the Contents included on the Website.

3.- Intellectual and Industrial Property

The contents of the Website, including texts, photographs, designs, software and databases, are subject to the rights of SYNAPSE or of their respective holders. Their presence or accessibility does not confer on the User any exploitation rights other than those legally permitted or expressly granted.

The software, the calculation methods, the designs and the structure of the Platform are protected to the extent legally applicable. Live consultation of comparables does not mean that SYNAPSE owns the listings or the third-party databases, nor does it confer on the User any reuse rights outside their licences.

The trade marks, trade names, logos and signs included on the Website belong to their respective holders. Their mention does not imply any general authorisation of use, association or endorsement of the service by the holder.

The Código do Direito de Autor e dos Direitos Conexos, approved by Decreto-Lei n.º 63/85, the computer program regime of Decreto-Lei n.º 252/94, the database regime of Decreto-Lei n.º 122/2000 and the Código da Propriedade Industrial approved by Decreto-Lei n.º 110/2018 are applicable, in their versions in force, together with European legislation and any third-party rights that may apply.

The client may download and share the dossiers for its professional activity under the terms of the contract, without acquiring rights over the software, the sources or third-party contents. It must respect confidentiality, data protection and the access and reuse restrictions of the source documentation.

The User undertakes to respect the Intellectual and Industrial Property rights held by SYNAPSE. In this regard, the temporary reproduction and storage of the contents of the Website is permitted insofar as strictly necessary for the use and display of the Website from a personal device.

4.- Data protection

Use of this Website may require the processing of the User's personal data. SYNAPSE will process such data in accordance with the applicable data protection regulations and as set out in its Privacy Policy, which details the purposes of the processing, legal bases, recipients, international transfers, retention periods and Users' rights.

For further information, the User may consult the Privacy Policy available in the legal section of the Platform.

5.- Liability and Warranties

SYNAPSE will apply technical and organisational measures appropriate to the risk and will maintain the required diligence in the operation and security of the service. No system can guarantee the absolute absence of incidents.

The Platform may be affected by the following circumstances, without this list excluding the liability legally attributable to SYNAPSE:

• the lack of continuity and availability of the Contents and Services;
• errors, outdated information or coverage limitations in official sources, registers and market comparables;
• the accuracy, completeness or currency of the data provided by Users;
• the interruption of the operation of the Website or computer failures, telephone faults, disconnections, delays or blockages caused by deficiencies or overloads in telephone lines, data centres, the Internet system or other electronic systems, occurring in the course of their operation;
• the presence of viruses or other harmful components;
• any damage caused by third parties infringing or breaching SYNAPSE's security systems.

SYNAPSE provides a support tool for the professional. The dossiers are not officially approved valuations or registry certifications and do not replace legal, tax or financial advice. The User shall verify the currency of the sources, the charges and the suitability of the result before taking decisions or communicating it to third parties.

SYNAPSE does not warrant that the general information published on the Website is permanently up to date, and it may be modified, replaced or removed at any time, without prejudice to the contractual, commercial or technical documentation applicable in each case.

The provision of the SaaS, generation incidents, the restitution of dossiers and liability are regulated in the B2B Terms. Non-waivable liabilities, personal or non-contractual damage, wilful misconduct, gross negligence and data subjects' rights under the GDPR are not excluded.

6.- Duration and amendment

This Legal Notice will remain in force for as long as it is published. Changes will be communicated where appropriate and will not retroactively alter contracts, orders, balances or rights already acquired.

SYNAPSE may update contents and functionalities while respecting its contractual commitments. Material changes to the service and to the B2B Terms will be governed by their notification and acceptance procedure.

Browsing does not constitute acceptance of future amendments to the B2B contract or consent to optional processing of personal data.

7.- Hyperlinks

Links to third-party sources or services provide access to environments outside SYNAPSE's control. This circumstance does not exclude its own obligations or the liability legally attributable to it for its actions.

The inclusion of links to other websites does not imply SYNAPSE's approval of their contents or the existence of any kind of association between SYNAPSE and their owners. Accordingly, the User accesses the content at their own sole responsibility and under the terms of use governing those websites.

SYNAPSE shall at no time be liable for any domain name similar to the domains owned by SYNAPSE that has been created without its prior authorisation. Likewise, SYNAPSE shall not be liable for the content hosted on such domains, nor may the existence of any kind of association between SYNAPSE and their owners be assumed.

8.- Severability and interpretation

This Legal Notice constitutes an agreement between each of the Users of the website and SYNAPSE.

If the competent authority declares a provision to be illegal, invalid or unenforceable, such declaration in respect of one or more clauses shall be without prejudice to the validity of the remaining clauses.

The fact that SYNAPSE does not demand strict compliance with any of the provisions of this Legal Notice does not constitute and may not in any way be interpreted as a waiver on its part of the right to demand strict compliance in the future.

9.- General Information

SYNAPSE will pursue any breach of this Legal Notice, as well as any improper use of its portal, by exercising all civil and criminal actions available to it at law.

10.- Notices

SYNAPSE may send the appropriate communications to the email address provided by Users in the registration forms or through any other means provided in the User's contact details.

The User may address communications to SYNAPSE through the channels indicated in this Legal Notice, without prejudice to certain commercial, technical, contractual, support or data protection matters being more suitably handled through the specific channels enabled at any given time.

Cookie policy

1.- What are cookies?

Cookies are small text files that are downloaded and stored on the User's device (computer, smartphone or tablet) when accessing certain web pages or digital platforms.

Their purpose is to enable the operation of certain features of the Platform, to remember preferences or settings and, where applicable, to personalise and facilitate the User's experience.

Similar technologies may also be used, such as pixels, SDKs, device identifiers, local storage or other equivalent technologies that allow information to be stored on or retrieved from the User's device.

SYNAPSE uses necessary session, authentication and preference technologies. Google Analytics measures usage and Google Ads measures advertising conversions, with prior consent for each purpose. Tag Manager manages tags and Enzuzo manages the User's choices; these tools do not replace the required consent.

The User may manage, block or delete cookies at any time through their browser settings. However, disabling certain cookies could affect the proper operation of the Platform.

2.- What does SYNAPSE use cookies for?

The use of cookies and equivalent technologies is governed by Article 5 of Lei n.º 41/2004 and, where personal data are processed, by the GDPR. Consent is not required for what is strictly necessary to transmit a communication or to provide a service expressly requested.

Necessary technologies make it possible to authenticate the User and maintain the session of the requested service.

SYNAPSE uses cookies to:

• Enable secure access and the essential technical functions of the requested service.
• Maintain authentication and session continuity.
• Remember privacy preferences when the User uses a settings feature.
• Measure usage through Google Analytics when the User consents to the analytics purpose.
• Measure conversions through Google Ads only with specific consent. Enhanced conversions with contact data are disabled.

The technologies are distinguished by their function and their necessity for the requested service:

• Technical or necessary: they allow the session to be started and maintained, access to be protected and the requested operations to be carried out. Only the technologies strictly necessary for those functions are exempt from consent.

Technology	Name	Purpose	Expiry	Provider
SYNAPSE session	__session	Authentication and continuity of the requested session (encrypted cookie; Secure, SameSite=Lax)	7 days or end of session	SYNAPSE
Anti-CSRF protection	_streamlit_xsrf	Technical security of the application forms	Session	SYNAPSE (Streamlit)
Server session affinity	GAESA	Keeping the request on the same service instance (infrastructure)	30 days	Google Cloud Run
Firebase / Google authentication	— (no own cookie on this domain)	Identification of the user when using Google sign-in; the Google session lives on accounts.google.com	According to the Google session	Google / Firebase
Enzuzo preferences	cookies-functional, cookies-preferences, cookies-analytics, cookies-marketing	Keeping the User's choice in the cookie notice	12 months	Enzuzo
Requested payment	— (on checkout.stripe.com, not on this domain)	Technical functions necessary to process the payment	According to Stripe	Stripe

• Analytics or statistics: Google Analytics makes it possible to measure the use of the Platform. Technologies for this purpose will remain disabled until consent is obtained. The User may refuse it or withdraw their choice in the panel.

Name	Purpose	Expiry	Provider
_ga	Google Analytics 4: distinguishing users and measuring usage (only after consent)	13 months	Google
_ga_7KFJSSZNCM	Google Analytics 4: maintaining the measurement session state (only after consent)	13 months	Google

• Advertising or marketing: Google Ads measures conversions with prior consent, separate from contracting. Enhanced conversions are disabled. Technical identifiers may be personal data even if the User's email is not sent.

Name	Purpose	Expiry	Provider
_gcl_au	Google Ads: conversion measurement and linking of ad clicks (only after consent)	90 days	Google
test_cookie (doubleclick.net)	Google Ads: checking whether the browser supports cookies (only after consent)	15 minutes	Google
IDE (doubleclick.net)	Google Ads: measurement and ad frequency capping (only after consent)	13 months	Google

3.- How to disable cookies?

You may accept, refuse or withdraw consent by purpose through the permanent panel, with equal ease. Withdrawal stops future optional processing, without affecting the lawfulness of prior processing:

CHANGE MY PREFERENCES

In addition, all browsers allow cookie settings to be adjusted for greater control over privacy. The steps to disable them in the most commonly used browsers are set out below:

Google Chrome

Microsoft Edge

Firefox

Safari

4.- Cookies on mobile devices

The SYNAPSE Platform also uses cookies or other storage mechanisms on mobile devices.

In addition, just as with computer browsers, mobile device browsers allow changes to be made to the privacy options or settings to disable or delete cookies.

If you wish to change the privacy options, follow the instructions specified by the developer of your mobile device browser.

Below you will find some examples of the links that will guide you in changing the privacy options on your mobile device:

iOS / Safari: Safari settings on the device.

Android / Chrome: site and cookie settings.

Chrome Mobile: privacy and security settings.

Opera Mobile: privacy and cookie settings.

5.- Profiling

The creation of advertising profiles through optional technologies will require specific information and prior consent. Browsing identifiers may be personal data even if they do not include the User's name; their use will be limited to the stated purpose.

6.- Retention period

The retention period for the data collected through cookies will depend on their type and purpose. SYNAPSE will apply the following criteria:

Session cookies

Session cookies are deleted at the end of the session under the terms of their configuration. Server security logs are separate and are subject to their own purpose and retention period.

Persistent cookies

Persistent technologies will be retained only for the period necessary for their function. Withdrawal of consent will stop optional uses and allow their identifiers to be deleted, without affecting prior lawful processing.

Retention of third-party data

In the case of cookies managed by third parties, the retention period will be that established in their respective privacy policies. For further information, the User may consult the policies of the external providers:

Google, Firebase, Analytics and Ads: https://policies.google.com/privacy. Stripe: https://stripe.com/privacy. Enzuzo: https://www.enzuzo.com/privacy-policy. The effective periods of the resources used are indicated in the tables above.

7.- Acceptance of cookies

Strictly necessary technologies may be activated without consent for the requested service. Optional ones will only be activated after a valid affirmative choice, which may be withdrawn with the same ease.

Refusing optional technologies will not prevent access to the basic service. Blocking strictly necessary technologies from the browser may prevent signing in, staying signed in or completing a requested payment.

8.- Changes

SYNAPSE may amend this Cookie Policy when changes occur in the cookies used on the Website.

If cookies that are not strictly necessary are introduced, this Cookie Policy will be updated before they start to be used and such cookies will only be installed after the User has accepted their installation. The updated version will be available on the Website.

Inventory verified on 8 October 2026 on both domains (projectsynapse.ai and nexus.projectsynapse.ai) with a clean browser: before acceptance no measurement or advertising cookie is installed; with «Reject», none either. Google tags are only loaded after acceptance.

Version of 6 October 2026 · Informative translation — the binding contractual version is the Spanish one.

Annex II — Data processing agreement (Synapse as processor)

In Braga, on the date of electronic acceptance or signature of the Main Agreement.

PARTIES

On the one hand, the agency, agent or professional entity identified in the order and in the record of acceptance of the B2B Terms, acting through its representative or authorised user (hereinafter, the “CONTROLLER” or “Client”).

And

On the other hand, SIMBIOSE CARBONO SILÍCIO, SOCIEDADE UNIPESSOAL LDA, NIPC 519567625, Rua do Sobreiro, 16, 4705-333 Braga (Portugal), registered with the Conservatória do Registo Comercial de Vila Nova de Gaia and represented by its manager Filipe Miguel Pinho Borges de Freitas, operating Project Synapse (the “PROCESSOR”).

Hereinafter jointly referred to as “the Parties”.

The Parties, mutually acknowledging that they have the legal capacity required to enter into this agreement,

RECITALS

• That the CONTROLLER carries on a professional real estate activity and determines the purpose, lawfulness, documentation and recipients of the analysis requested. If it acts on behalf of another controller, it must evidence its authorisation and document the corresponding sub-processing chain before the processing.
• That the PROCESSOR provides the Project Synapse SaaS for reading real estate documentation, extracting fields and generating, hosting and sharing dossiers, in accordance with the instructions of the CONTROLLER. It shall not use the data processed on the CONTROLLER’s behalf for training, advertising or its own databases.
• That this DPA is incorporated into the B2B Terms accepted by the Client (the “Main Agreement”) and is executed electronically in accordance with Article 28.9 GDPR. The identification of the Client, the authorised user, the date and the version accepted shall be linked to the contractual record kept by the parties.
• That, in compliance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, “GDPR”), the parties agree to enter into this DATA PROCESSING AGREEMENT, in accordance with the following:

CLAUSES

FIRST. – DEFINITIONS

• Subject Matter of the Agreement: Has the meaning given to it in Clause 2 of this Agreement.
• Commencement Date: Means the date of signature of this Agreement.
• Controller: Means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
• Processor: Means the natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller and which does not decide on the purpose of such data.
• Data Protection Authority: Means the relevant Data Protection Authority in the territories where the Parties to this Agreement are located.
• Data Protection Legislation: Regulation (EU) 2016/679 (“GDPR”), Lei n.º 58/2019, de 8 de agosto, implementing the GDPR in Portugal, and the other mandatory rules applicable to the respective processing operations. The choice of Portuguese law does not remove the obligations specific to a client established in another Member State.
• Parties: The Parties signing the Agreement.
• Security breach: Means any actual loss, destruction, alteration, or unauthorised or unlawful disclosure of or access to Personal Data, and/or any other irregularity in the processing of Personal Data.
• Rights of Users or data subjects: Shall have the meaning given to it in the Data Protection Legislation.
• Profiling: Means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
• Data subject: Means persons affected by the processing of their data.
• Data Processing: Means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
• Consent of the data subject: Means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

SECOND. – SUBJECT MATTER OF THE AGREEMENT

• The subject matter is to process data on behalf of the CONTROLLER in order to generate real estate dossiers from addresses, references and accepted documentation; to extract information, perform calculations and draft content, and to host the results and share them solely in accordance with its instructions. The processing extends to transient text and to the fields and dossiers retained.
• The CONTROLLER retains control over the essential purposes and means. SYNAPSE is an independent controller of its own account, security, commercial support and billing data, which are subject to the Privacy Policy; that role does not authorise the reuse of the content processed on the CONTROLLER’s behalf.

THIRD. – TERM

The DPA shall apply for the duration of the provision of the service and for the period necessary for return or erasure in accordance with clause eight, without prejudice to the obligations that must survive. Retention shall not be extended by the mere absence of a request for account closure.

Upon termination, the CONTROLLER may opt for return or erasure. Save for a prior lawful instruction to erase, it shall have thirty calendar days for recovery from the effective account closure or, where there is a change of provider, from the end of the transition. The rules on erasure and backup copies shall be those of clause eight and clause 12 of the B2B Terms.

FOURTH. - PROCESSING OF PERSONAL DATA

• By means of this agreement, the PROCESSOR is authorised to process, on behalf of the CONTROLLER, the personal data strictly necessary for the provision of the Services. Such processing must be carried out in accordance with the instructions of the CONTROLLER and in compliance with the data protection legislation in force.
• Before commencing the processing, the PROCESSOR shall implement the measures required by this DPA, shall keep them appropriate to the risk throughout its term and shall provide the CONTROLLER with sufficient information to verify their effectiveness. It shall not commence or continue any operation that lacks the legally required safeguards.
• The categories of data subjects comprise owners, holders of rights, occupiers, debtors, applicants and other persons whose data appear incidentally in the Client’s documentation, and users or recipients insofar as they take part in the processing. The following limited categories and operations shall be processed:
• Real estate data that can be linked to persons: address, cadastral reference, registered property or CRU, floor areas, use, layout and other characteristics of the accepted documents.
• The extractor transiently reads the filtered encumbrances; the report and the drafter receive only type and status, without amounts or creditors. They are kept separate from the base calculation; the situations declared are used in supplementary analyses. Unnecessary free text concerning assets shall be excluded from the valuation.
• Input text: may contain names, NIF/NIE, marital status, property relationships and other personal data. Its transient reading, transmission and analysis constitute processing even if they do not persist.
• Before the AI, the following shall be extracted, classified and filtered locally: holders, identifiers, codes and unnecessary tax values. In the event of failure, nothing shall be sent to the AI; local reading is permitted. Natural-person creditors: generic category; matches by internal key. The prompt is an additional barrier, not anonymisation.
• App: originals in memory; text discarded after generation. In Synapse, WhatsApp expires at seven days and temporary files at one day, with asynchronous deletion and a recycle bin of a further seven days. Twilio/Meta and the AI have specific retention periods stated in the privacy information, which must be brought into line with this DPA, without extending its limits.
• Attributes, reference/article, registered property and type/status of encumbrances persist; CRU, VPT, amounts, creditors and intermediate data from certificates are discarded. Sales provided: only their file and street/area, without number, floor, door or postcode. There is no common database of documents, encumbrances or sales and no guarantee of anonymity.
• Operations: receipt, reading, extraction, structuring, consultation, calculation and generation of the dossier, hosting, authorised access, return and erasure.
• Reports remain private until shared on the CONTROLLER’s instructions. Link: ninety days, renewable for a further ninety and revocable by the author; it allows anyone who holds it to open it, without verifying the email address. Limit to legitimate recipients. It does not display the internal path and revoking it does not delete downloads.
• CPCV, unknown documents and documents of more than twelve pages are rejected before the AI, save for accepted Spanish energy performance certificates. Personal record sheets, special categories of data and data under Article 10 GDPR are excluded. Upon incidental detection, isolate and discard or minimise in accordance with lawful instructions.
• Card data are collected by Stripe for payments and do not form part of the real estate processing. Use of the dossiers to profile the creditworthiness of persons, or to incorporate restricted sources beyond the permitted uses, is not authorised.
• Within the framework of the Services and of the instructions of the CONTROLLER, the PROCESSOR shall carry out only the following operations:
• Collection and recording of data.
• Organisation, structuring and storage.
• Adaptation, alteration and retrieval.
• Consultation and use of the information.
• Disclosure of data to third parties where appropriate in accordance with the instructions of the CONTROLLER.
• Restriction, erasure or destruction of the data in accordance with the time limits and conditions laid down by the CONTROLLER.

The PROCESSOR undertakes not to carry out any additional processing that has not been expressly authorised by the CONTROLLER and to ensure the confidentiality and security of the data at all times.

FIFTH. - OBLIGATIONS OF THE PROCESSOR

The PROCESSOR and all its staff undertake to:

5.1 Use documents solely for the processing on the CONTROLLER’s behalf, without training, advertising, resale or common databases. Originals: time limits in section four. Public indicators shared per property: purpose communicated, legal basis and licence; never documents, encumbrances or sales provided.

5.2 Process the data in accordance with documented instructions, including with regard to international transfers. If a legal provision requires other processing, it shall inform the CONTROLLER beforehand unless prohibited by law. If an instruction infringes the legislation, it shall immediately give notice thereof and suspend the affected operation until it receives a lawful instruction.

5.3 Ensure that the persons authorised to process personal data have expressly committed themselves in writing to respect confidentiality and to comply with the corresponding security measures.

5.4 Take steps to ensure that any person acting under its authority who has access to personal data may only process them on the instructions of the CONTROLLER.

5.5 Not disclose the data to third parties, unless it has the express authorisation of the CONTROLLER.

5.6 Disclose data to other processors, in accordance with the instructions of the CONTROLLER. In this case, the CONTROLLER shall identify, in advance and in writing, the entity to which the data must be disclosed, the data to be disclosed and the security measures to be applied in making the disclosure.

5.7 Support the CONTROLLER in carrying out prior consultations with the supervisory authority, where appropriate.

5.8 Apply measures appropriate to the risk: encryption in transit and at rest, least-privilege access, segregation between clients, private storage, Google OAuth/Firebase authentication, document validation, secrets kept out of the code, and logging and monitoring. Not include unnecessary personal data in logs or object names.

5.9 Maintain and verify the technical and organisational measures described for the service:

a) Dossiers in Google Cloud Storage europe-west1 (Belgium), Firestore in the Europe multi-region and encrypted sessions; Vertex AI with Gemini and Claude in the global location and Resend are not described as exclusively European.

b) Private storage, access with no visible internal path and links valid for ninety days that are renewable/revocable by the author, with no recipient verification. Permission control and Cloud Armor. Expiry or revocation does not delete downloads.

c) Business continuity and restoration proportionate to the risk, with testing and isolated copies. Database backups shall have a fourteen-day cycle and other copies shall comply with clause eight. Exclude transient originals and re-apply erasures before granting access following a restoration.

d) Filter before the external call, block the sending in the event of error and log only filter counts. Test exclusions, retries, traces and isolation. Assess changes to models, filters, locations and providers before using them and in accordance with the sub-processing rules.

5.10 The CONTROLLER grants general authorisation to the sub-processors identified below, limited to their function and subject to a contract under Article 28.4 GDPR and to effective safeguards under Chapter V:

• Google Cloud EMEA Ltd: Cloud Run/Storage Belgium, Firestore Europe, Firebase Authentication USA and Vertex global. Gemini: Google terms; Claude: Separate Offering with Anthropic’s specific terms. KEPTAGO LTD (Geoapify): maps with coordinates. Google Maps geocodes as an independent controller, not as a sub-processor under this clause.
• Plus Five Five, Inc. (Resend): email from the USA; Twilio Ireland Limited/WhatsApp Ireland Limited: WhatsApp; Apify Technologies s.r.o.: authorised sources, USA infrastructure. SYNAPSE is liable for the sub-processing and shall provide contracts, chain, retention, destinations and safeguards. Sources without coverage or incompatible time limits are not authorised.

Additions or replacements shall be notified in writing fifteen days in advance, allowing a reasoned objection on data protection grounds. Until the objection is resolved, no client data shall be sent to the new sub-processor. If there is no reasonable alternative, the affected service may be terminated and the data and unused balance recovered in accordance with the B2B Terms. The authorisation does not cover unidentified source providers that access data processed on the CONTROLLER’s behalf.

5.11 Assist the CONTROLLER with security, rights, impact assessments and prior consultations. It shall forward data subjects’ requests immediately and, at the latest, on the following business day; it shall provide the necessary assistance without undue delay so that the CONTROLLER can meet its statutory deadline.

• So that the CONTROLLER can comply with its obligation to respond to requests for the exercise of data subjects’ rights (access, rectification, erasure and objection; restriction of processing; data portability; and not to be subject to automated individual decision-making, including profiling).
• Requests shall be forwarded to the contact designated by the CONTROLLER through a secure channel, together with the information available and a record of the date and the actions taken. The PROCESSOR shall not decide on its own account on the data processed on the CONTROLLER’s behalf, save on instruction or where required by law.
• So that the CONTROLLER can comply with its duties to apply the relevant security measures in the processing.
• In carrying out data protection impact assessments, where appropriate.

5.12 Vertex AI global, Resend and other services with access outside the EEA require valid safeguards. Before each flow, SYNAPSE shall provide the recipients, countries, data, purpose and applicable adequacy or Chapter V safeguards, including clauses under Decision (EU) 2021/914 and the necessary assessment and supplementary measures. It shall not commence or continue transfers without a valid safeguard and shall provide a copy of the safeguards.

SIXTH. - OBLIGATIONS OF THE CONTROLLER

The CONTROLLER shall be responsible for:

6.1 Ensuring compliance with all the technical and organisational measures necessary to guarantee the security of personal data, preventing their alteration, loss, or unauthorised processing or access.

6.2 Notifying the PROCESSOR of any change occurring in the personal data provided, so that they can be updated.

6.3 Collecting and providing only necessary data with a valid legal basis under Article 6 GDPR. A brokerage agreement only legitimises the contractual processing necessary with regard to the data subject who is a party to it; legitimate interest requires a documented balancing test. The ordinary processing of special categories of data is not authorised by this clause.

6.4 The CONTROLLER warrants:

• That it has lawfully obtained the documentation and has provided the information under Articles 13 or 14 GDPR according to its source, or has documented an applicable legal exemption; a public source does not in itself constitute an exemption. It must provide information on, among other matters:
• The identity and contact details of the controller and, where applicable, of the DPO.
• The applicable purposes, legal bases and legitimate interests.
• The recipients, including the use of processing and AI providers and international transfers.
• The retention periods, the source of the data and the consequences of providing them, where applicable.
• The possibility of exercising the rights of access, rectification, erasure, objection, where applicable, to be forgotten, restriction, and portability.
• The possibility of lodging a complaint with a supervisory authority and the other particulars required by the GDPR.
• That it has informed the data subject of the explicit and legitimate purposes for which it is going to use their data.
• That it offers data subjects or recipients the possibility of objecting to the processing of their data by means of a simple procedure free of charge.
• That it shall implement and maintain technical and organisational measures appropriate to the risk in the systems and operations under its responsibility.
• That the personal data are processed only by those employees whose involvement is necessary for the contractual purpose and that it has notified and trained them in their obligations with regard to the protection of personal data.
• That the data processing it carries out is lawful.
• That, where mandatory for its organisation, it has appointed a Data Protection Officer.
• That it keeps a Record of Processing Activities.

SEVENTH. - NOTIFICATION OF PERSONAL DATA BREACHES AND IMPACT ASSESSMENTS

7.1 Notification of personal data breaches

The PROCESSOR, through Filipe Freitas, shall notify each CONTROLLER client at its contact email address without undue delay and at the latest within forty-eight hours of becoming aware of a personal data breach. It shall not wait for the investigation to be concluded; it shall send the information available and successive updates, keeping a record of their delivery.

Every personal data breach affecting the data processed on the CONTROLLER’s behalf shall be notified to the CONTROLLER regardless of the estimated risk. The CONTROLLER shall decide on notification to the authority and to the data subjects; SYNAPSE shall provide assistance and retain evidence.

Where available, at least the following information shall be provided:

• A description of the nature of the personal data breach including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned.
• The name and contact details of the data protection officer or other contact point where more information can be obtained.
• A description of the likely consequences of the personal data breach.
• A description of the measures taken or proposed to be taken to address the personal data breach, including, where appropriate, measures taken to mitigate its possible adverse effects.

Where, and in so far as, it is not possible to provide all the information at the same time, the information shall be provided in phases without undue delay.

7.2 Impact assessments

The PROCESSOR undertakes to support the CONTROLLER in carrying out data protection impact assessments, where appropriate.

EIGHTH. – FATE OF THE DATA UPON TERMINATION OF THE RELATIONSHIP

Upon termination, the CONTROLLER shall choose return or erasure, with thirty days for recovery from the effective account closure or the end of the transition. Thereafter, active data shall be deleted and links revoked, save for prior lawful erasure or a written extension. Reports shall be deleted after twenty-four months without a login or new dossiers, subject to thirty days’ prior notice with recovery, without delaying earlier account closures or erasures.

• Return to the CONTROLLER the dossiers and structured fields, together with the processing metadata necessary for their use, by means of secure delivery in accordance with clause 12.3 of the B2B Terms. Return does not authorise the retention or reuse of the data once the recovery period has expired.
• Deliver those data to another processor designated in writing by the CONTROLLER, after verification of the recipient, through a secure channel. Delivery and erasure shall be coordinated so as to preserve the continuity of the changeover and avoid the premature loss of information.
• Erase the active data at the end of the recovery period or on the earlier date of a lawful instruction; delete the backup copies within the following limit and certify in writing the dates, scope and legal exceptions of the erasure.

Database backups have a fourteen-day cycle. Residual copies of the data processed on the CONTROLLER’s behalf shall be isolated and deleted no later than thirty days after active erasure; any restoration shall first re-apply the erasures. The additional period is agreed for the purposes of Article 25.2.h of Regulation (EU) 2023/2854 and does not authorise ordinary uses. A shorter mandatory period or lawful instruction shall prevail. Any statutory retention shall identify the data, the legal ground and the expiry date, with restricted access.

NINTH. - LIABILITY IN THE EVENT OF A CLAIM

Should the PROCESSOR become involved in any investigation or administrative proceedings initiated by a supervisory authority, it shall immediately notify the CONTROLLER thereof, describing the facts alleged against it and the actions taken. Once the proceedings have concluded, it must provide the CONTROLLER with a copy of the Decision issued.

Liability and any recourse between the parties shall be determined in accordance with Article 82 GDPR and Portuguese law, in proportion to actual responsibility. Penalties are not automatically passed on, nor are the PROCESSOR’s own obligations excluded.

Without prejudice to the foregoing, both parties, by mutual agreement, undertake to be liable for the loss and damage caused to the other in cases of negligent or wrongful conduct in the performance of the contractual and statutory obligations incumbent upon them under the terms of this Agreement.

TENTH. - MONITORING OF COMPLIANCE WITH THIS AGREEMENT

The PROCESSOR shall make available all information necessary to demonstrate compliance and shall allow for and contribute to audits and inspections by the CONTROLLER or by an authorised auditor, subject to confidentiality and reasonable prior notice. There shall be no annual limit or prior notice requirement preventing urgent checks owing to breaches, indications of non-compliance or a request from an authority.

ELEVENTH. - CONFIDENTIALITY

All information designated as confidential that is communicated between the parties in connection with the provision of the Services covered by this Agreement may be used by the parties solely for that purpose. Neither party shall disclose to any third party, whether directly or through third persons, without the prior written consent of the other, any information it receives from the other party in connection with this Agreement.

The PROCESSOR shall apply all the technical and organisational measures necessary to maintain the duty of confidentiality of the information, in particular those relating to the processing of personal data belonging to the CONTROLLER as laid down in the applicable data protection legislation.

The duty of confidentiality shall survive for five years after termination. For trade secrets and personal data, it shall continue for as long as they retain that character or as required by law. The obligations of return, erasure and limitation of use of the data processed on the CONTROLLER’s behalf shall prevail over the mere survival of confidentiality.

The foregoing restrictions shall not apply to any information:

• That is or becomes generally accessible to the public, for a reason other than a breach of an obligation arising under this clause.
• That is obtained from a third party who is not bound to keep the information confidential.
• That was previously known to it.
• Whose disclosure by the recipient is required by law.

TWELFTH. - BREACH AND TERMINATION OF THE AGREEMENT

A material breach shall entitle the parties to terminate the DPA and the affected service in accordance with the procedure and cure period of the Main Agreement. Unlawful processing or processing that gives rise to a serious risk may be suspended immediately. Termination does not extinguish the obligations of assistance, confidentiality and return or erasure of the data.

THIRTEENTH. – JURISDICTION AND GOVERNING LAW

This DPA is governed by Portuguese law. The courts of Braga are agreed as the forum in accordance with Article 25 of Regulation (EU) 1215/2012, without prejudice to mandatory rules and fora and to the data subjects’ rights to lodge complaints and seek redress. The Spanish version shall be binding where this is expressly communicated and accepted before contracting.

Should any of the clauses of this Agreement be declared null, unlawful or unenforceable, the validity, lawfulness and enforceability of the remaining clauses shall not be affected or impaired thereby. The clauses of this Agreement shall be interpreted in accordance with good faith and the proper, literal and ordinary meaning of the words in which they were expressed.

This DPA is executed by means of the electronic acceptance of the B2B Terms and of the DPA itself, linked to the Client, the authorised user, the date and the version. If an individual signature is used, the parties may use the spaces below, without altering the obligations under the agreement.