Privacy Policy

This Privacy Policy explains how Millgaard Group ("Millgaard", "we", "us") collects, uses, shares, and protects personal data when you interact with our brokerage and advisory services, our Broker Board, and our messaging on the WhatsApp Business Platform. We act as the data controller for the personal data described here.

1. Who we are

Millgaard Group is a private brokerage and advisory firm operated from Funchal, Madeira, Portugal. We facilitate introductions between vetted counterparties and coordinate the related paperwork and compliance steps. For any privacy question, contact us at privacy@millgaard.com.

2. Data we collect

• Contact details you provide (name or alias, WhatsApp number, email).
• Identity and verification data (KYC documents such as an identity document, and related attestations) where required to onboard you and to meet our anti-money-laundering obligations.
• Business information you share in connection with a matter (such as your requirements, preferences, and jurisdiction).
• Messages and metadata exchanged with us over WhatsApp, email, or call, and the associated timestamps and delivery status.
• Meeting information (scheduling details, and, only where you are informed and it applies, a recording used to prepare an internal summary).
• Technical data (IP address, device and browser information) when you use the Broker Board, used for security and to keep your session safe.

3. How we use your data

• To provide our brokerage and advisory services, including identifying and coordinating suitable introductions.
• To meet legal and regulatory obligations, in particular identity verification and anti-money-laundering (AML) checks.
• To prepare and manage non-circumvention and non-disclosure agreements and other documents for electronic signature.
• To communicate with you about your onboarding, matches, meetings, and pending signatures. We contact you on WhatsApp only after you have messaged us first, or where you have an active matter with us; we do not send unsolicited marketing.
• To operate, secure, and improve the Broker Board and our internal systems.

4. WhatsApp Business Platform

We communicate with counterparties and brokers through the WhatsApp Business Platform, provided by Meta Platforms Ireland Limited. When you message us on WhatsApp, your message content and metadata are processed by Meta in transit and by us to provide the service. Meta's handling of your data on WhatsApp is governed by its own terms and privacy policy. We use WhatsApp only for service communication tied to a matter you have with us, and pre-approved notification templates when a conversation window has closed.

5. Legal bases (GDPR)

• Performance of a contract with you, to provide the service you requested.
• Legal obligation, for identity verification and AML record-keeping.
• Legitimate interests, to run, secure, and improve our services, balanced against your rights.
• Consent, where specifically requested (for example, a meeting recording), which you may withdraw at any time.

6. How we store and protect data

We process sensitive data on private European infrastructure, apply encryption in transit and at rest where appropriate, restrict access on a need-to-know basis, and maintain audit trails. Identity and AML records are retained for the period required by applicable law (typically five years after the end of the business relationship), after which they are deleted or anonymised. Other personal data is kept only as long as needed for the purposes above.

7. Who we share data with

We share personal data only as needed to deliver the service and meet our obligations, with:

• Service providers acting on our behalf under contract, including the WhatsApp Business Platform (Meta), our electronic-signature provider, our video-meeting provider, partners engaged to complete a transaction, and cloud infrastructure providers.
• Regulators, law-enforcement, or professional advisers where we are legally required or permitted to do so.

We do not sell your personal data, and we do not disclose one counterparty's identity to another before both have explicitly agreed to be introduced.

8. International transfers

Where personal data is transferred outside the European Economic Area (for example, by a service provider), we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

9. Your rights

Subject to applicable law, you may request access to your personal data, correction, erasure, restriction of processing, portability, and you may object to certain processing. You may also lodge a complaint with your data-protection supervisory authority (in Portugal, the CNPD). To exercise a right, contact privacy@millgaard.com.

10. Changes to this policy

We may update this policy from time to time. The effective date above reflects the latest version, and material changes will be communicated where appropriate.