Privacy and Security Policy

This Privacy and Security Policy regulates the use of digital platforms (website and App) owned by NEROES.

If you wish to contact Neroes regarding these digital platforms, you may do so using the following email address info@neroes.tech.

Access and use of the website and App are the sole responsibility of the User, who is subject to the acceptance of this Privacy and Security Policy and the data processing described herein. The access and use of the services provided assume that the User has read, understood and accepted the Terms and Conditions of their use, that can be consulted here.

Neroes reserves the right to change and review this Privacy and Security Policy at any time, as well as the data processing described herein, whenever deemed appropriate, with or without prior notice.

This Privacy Policy constitutes an agreement between you, the User, and NEROES which applies to the use of these digital platforms. It is the sole responsibility of the user to read the Privacy and Security Policy whenever accessing the website or App, in order to be aware of any changes made, as it may affect its rights.

1. Scope

This policy intends to inform about the privacy rules in the scope of the services provided by [A CONFIRMAR — nome oficial, NIF e morada da sede] (NEROES), also designated as Responsible Entity. The personal data you provide is treated with the security and confidentiality guarantees required by the legal framework relating to the protection of personal data.

Any attempts to alter the information, or any other action that may cause damage and jeopardize the integrity of the system and services, are strictly prohibited under current legislation. The User undertakes to scrupulously comply with the applicable legislation, namely, in terms of computer crime and intellectual property rights, being solely responsible for the violation of these rules.

NEROES MENTAL TRAINING PLATFORM is a computational platform (App) that allows the User to improve performance through mental training and enhancement of emotional control.

This training makes use of the neurofeedback technique combined with a videogame that is controlled by the brain’s electrical activity signals of the User. These signals are collected through a wearable electroencephalography (EEG) device that is placed over the head of the User. In addition, the App allows qualitative and quantitative assessments of the mental abilities of the User before, during and after the referred mental training, by filling out questionnaires, testing specific game/assessments and from the signals of the brain’s electrical activity themselves.

However, it should be noted that the App is not a medical device and does not provide or can be used in order to obtain any diagnosis or mental health therapy.

The data collected is intended for the provision of the service requested by the User, with no personal data being collected that are not necessary to provide the service or without express consent of the User.

There are other types of information, non-personal and non-individualized, that are recorded to keep the website running appropriately and ensure a good browsing experience for visitors. This is statistical information that is usually, by definition, recorded through the browser window, such as: the website address that brought you directly to the Neroes website, most visited website pages, type of browser, operating system, etc.

2. What is Personal Data?

Personal data is information relating to a living, identified or identifiable person. Personal data can also be considered the set of different information that can lead to the identification of a specific person. Personal data that has been uncharacterized, encoded or pseudonymised, but that can be used to re-identify a person, remains personal data.

Personal data that has been made anonymous so that the person is not or ceases to be identifiable are no longer considered personal data. For data to be truly anonymized, anonymization must be irreversible.

Therefore, the data collected and used by the App, related to the brain’s electrical activity, with questionnaires and specific tests/assessments available on the App, are only considered personal data if associated with a living, identified or identifiable person. Otherwise, the data is not considered as personal data.

Since the App service will use data encoding or pseudonymisation, it is necessary to obtain explicit consent for the treatment of such personal data for one or more specific purposes.

However, the data collected is subject to irreversible anonymization and used for the overall improvement of the service provided, namely in the optimization of the algorithms used in the App, for aggregate statistical evaluation of the usage of the service, and in case the retention period ends.

3. Typology, Purposes of Collection and Processing of Personal Data

3.1 Brain’s electrical activity signals: The collection and processing of data aims to do mental training through a video game, using the neurofeedback technique, and also to evaluate and monitor the mental abilities of the User associated with the training.

3.2 Self-reported questionnaires or reported by institutional employee: The requested and collected data aim to assess mental abilities associated with training, personality trait, and also the mental health state of the User. These data will be aggregated and combined with the previous data to report the current status, to monitor mental training and to optimize the training process.

3.3 Data derived from specific tests/games: The collected data reflects the performance of specific tests/games that assesses mental abilities, which include the duration of the execution, rate of correct answers, and scores. These are intended to complement the evaluation of the mental abilities of the User, collected during the training. These data will be aggregated and combined with the previous data to report the current state of the User, monitor the mental training and to optimize the training process itself.

3.4 Demographic data: The requested and collected data aim, together with the previous data, to optimize the training process.

3.5 Contact details: The requested data is only intended to enable the creation of a personal and/or institutional User account. They can also be used to contact the User for operation notifications and to obtain feedback on the service provided.

3.6 Anonymization and aggregation of data for service optimization: The data collected is irreversibly anonymized and used by NEROES in an aggregated way to improve the service provided through the statistical evaluation of the usage, optimization of the algorithms or in case the retention period ends.

4. User Profile

The App enables users to create individual and institutional profiles by providing explicit consent during profile creation, by accepting the checkbox related to the agreement of the Terms and Conditions. This is done prior to using the App.

The individual User profile is intended for individuals, over 18 years old. When the user is a minor, he/she must be accompanied by the legal guardian, both when giving consent, and when using and filling in the App data.

The profile of the organization/institutional User (e.g. clubs, companies) allows institutions, being responsible for the collection and processing of data of their employees and assuming the responsibilities imposed by law in terms of protection of personal data, to enter and collect the data of their employees on the App, in a nominal, pseudonymised or anonymized way. In this profile, institutions will be able to conduct and monitor the mental training of their employees on an individual basis and still have an aggregate view of the group of employees.

5. Entity Responsible for Data Collection and Processing

NEROES, in its role as the data controller, is responsible for the collection and processing of data in strict compliance with national and community legislation in force. In fulfilling this role, NEROES ensures that:

• The processing of your personal data is carried out within the scope of the purposes for which they were collected or for purposes compatible with those.
• Only the personal data necessary are collected, used, and retained for the specific, explicit and legitimate purpose in question.
• Personal data is not transmitted to third parties for commercial or advertising purposes.
• Personal data is handled for legally provided purposes or for the provision of services at your request.

In addition to the above, NEROES is committed to implementing appropriate technical and organizational measures to protect the personal data of its users against accidental, unlawful loss, alteration, dissemination, or unauthorized access. An appropriate level of security is considered to be in effect regarding the data handling risks, given the sensitive nature of the data to be protected.

NEROES utilizes Amazon Web Services (AWS) as a cloud service provider for the storage of data in databases. In this capacity, AWS acts as a data processor, processing data on behalf of NEROES. The responsibilities and roles in this relationship are as follows:

• AWS’s Role as Data Processor: AWS is responsible for securely storing data provided by NEROES, adheres to strict security measures and protocols, and does not have permission to access or use the data for any purposes other than storage and maintenance as instructed by NEROES.
• Data Security with AWS: AWS provides robust physical and digital security measures to protect data from unauthorized access, disclosure, alteration, and destruction. NEROES, in collaboration with AWS, ensures that all data stored in AWS databases are encrypted and securely managed.
• Compliance and Auditing: AWS’s services are compliant with major data protection regulations and standards. NEROES regularly reviews and audits the data processing and storage practices of AWS to ensure ongoing compliance with data protection laws.

By using AWS for data storage, NEROES ensures enhanced security and reliability in the management of user data. NEROES remains committed to the protection of personal data and will continue to uphold the highest standards of data privacy in all aspects of its data collection and processing activities.

NEROES undertakes to only allow access to the employees or entities under confidentiality agreements, as the company’s current practice. NEROES may, with express and prior consent, only transmit the data to these entities for the purpose of scientific and research studies. The transmission of this data will be done in compliance with the rules on the irreversible anonymization of personal data.

6. Personal Data Security Measures and Data Breach Response

6.1 Security Measures: In carrying out its activities, the Responsible Entity employs a comprehensive set of technologies and security procedures to protect personal data from unauthorized access or disclosure. These include physical security measures (controlled access to headquarters’ facilities, 24x7 equipment monitoring) and logical security measures (identity management, authentication and privilege controls, firewalls and intrusion detection, network segregation, and encryption of information through secure communication channels). NEROES maintains its own database for storing all personal data registered by the User, ensuring the protection of this data through both physical and logical security measures.

6.2 Safety Procedures for Special Category Data: NEROES recognizes that physiological signals and self-reported mental health data fall under ‘special category data’ as defined by GDPR, which requires heightened protective measures: strict access control limited to personnel who require it, advanced encryption in transit and at rest, data minimization and anonymization wherever possible, and specific employee training on the legal requirements and risks of processing such data.

6.3 Data Breach Notification Procedures: In the event of a data breach, NEROES has established comprehensive procedures to promptly and effectively respond, especially when special category data is involved. This includes breach detection and assessment, notification to affected users without undue delay when the breach is likely to result in a high risk to their rights and freedoms, notification to the relevant data protection authorities within 72 hours of becoming aware of the breach, and post-breach mitigation, documentation and review.

6.4 Commitment to Data Integrity and Confidentiality: NEROES is dedicated to maintaining the highest standards of confidentiality and integrity in all personal data processing, with a special emphasis on special category data. NEROES may, with your express and prior consent, transmit the data for the purpose of scientific studies, in compliance with the rules on anonymization of personal data and under the protection of a Non-Disclosure Agreement.

7. Cross-Border Data Transfers

In the course of providing services, NEROES may transfer personal data across borders, including to regions outside the European Union (EU) and the European Economic Area (EEA), such as the EU/EEA, North America (the United States and Canada), Brazil, and Australia.

To ensure the protection of personal data when transferred outside the EU/EEA, NEROES adheres to the GDPR’s stringent data protection standards, relying on adequacy decisions where possible, and otherwise on Standard Contractual Clauses approved by the European Commission. Users are informed about any cross-border data transfers and the safeguards in place, and by accepting the terms and conditions checkbox upon signing up for the App, users explicitly consent to such transfers. NEROES regularly reviews its data transfer practices to ensure ongoing compliance with GDPR and other relevant data protection laws.

8. Access and Control of Personal Data

NEROES is committed to ensuring that Users have full control over their personal data. To this end, the following mechanisms are in place:

8.1 Providing Consent: When a User signs up for the NEROES App, they will encounter a clear consent checkbox — a unified consent action for agreeing to the Terms and Conditions and, consequently, to the Privacy Policy of the App. The Privacy Policy is easily accessible at the point of signing up, allowing Users to review it in full before giving their consent.

8.2 Withdrawing Consent: Users have the right to withdraw their consent at any time, either by deleting the account through the App, or by contacting NEROES at info@neroes.tech. Withdrawal of consent will halt processing of the user’s data for the withdrawn purposes, unless another legal ground for processing is applicable. The lawfulness of processing based on consent before its withdrawal remains unaffected.

8.3 Access to Personal Data: Users can request access to their personal data held by NEROES, including how it is being used and for what purposes, directly through the App or by contacting info@neroes.tech.

8.4 Rectification, Erasure, Objection, and Restriction: Users have the right to request rectification of inaccurate personal data, erasure of their data via the App or by account deletion, and to object to certain types of data processing or request a restriction on processing in specific circumstances, by contacting info@neroes.tech.

8.5 Response Time: NEROES will respond to all personal data rights requests within 5 business days, adhering to the timeframes stipulated by applicable data protection laws. In cases where immediate action is not feasible due to legal or technical constraints, users will be informed of the measures taken as soon as possible.

8.6 Right to Lodge a Complaint: Users have the right to lodge a complaint with the National Data Protection Commission (CNPD) via www.cnpd.pt.

9. Personal Data Retention Period

Your personal data is retained for the period necessary to fulfill the purposes for which it was collected. The specific retention periods are as follows:

• Personal data information: If an account remains inactive for 2 years, NEROES reserves the right to irreversibly anonymize all personal and special category data. This data will be retained for as long as necessary to maintain active research purposes and used to improve the models and algorithms that run within the App.
• User profile information: Contact data related to user accounts, such as email addresses or phone numbers, will be retained for the duration of the user’s active engagement with the services. If the account remains inactive for 2 years, the user profile storing the contact information will be deleted. Before the stipulated time, the User can delete their account, directly erasing the information from the system.
• Transaction data: Data related to transactions, including purchase history, will be retained for a period of 10 years in compliance with financial and accounting regulations.

The Responsible Entity undertakes to adopt appropriate conservation and safety measures throughout the retention period, and remains committed to regular reviews of data retention practices to ensure compliance with industry standards and applicable regulations.

If you have any specific concerns or questions about the retention period for your personal data, please contact info@neroes.tech.

10. Cookie Policy

NEROES uses cookies and similar technologies to enhance user experience and improve performance, as detailed below.

10.1 What are Cookies?

Cookies are small text files with relevant information that your access device (computer, mobile phone, smartphone, or tablet) carries through the browser when a site is visited. The use of cookies optimizes navigation by adapting information and services to user interests, providing a better experience with each visit.

Cookies used by NEROES do not collect personal information that identifies the user but store generic information, such as the place/country of access and user preferences. NEROES uses cookies for: ensuring proper page functionality; storing user preferences, language, and font size; analyzing anonymous statistical information about user interactions with the website; and customizing, adapting, and improving users’ browsing experience.

Users can choose to be notified of and block cookies at any time through their browser. Note that refusing cookies may limit access to certain areas of the site and affect the overall browsing experience.

10.2 Types of Cookies

• Permanent Cookies: Stored on the device and used whenever the user revisits the site for personalized navigation.
• Session Cookies: Temporary cookies available until the session ends, providing a better browsing experience.

10.3 Functions of Cookies

• Essential Cookies: Necessary for specific website areas, navigation, and application use.
• Feature Cookies: Recall user preferences for a customized browsing experience.
• Analytic Cookies: Analyze user site interactions for statistical purposes without collecting personal information.

10.4 Cookies in Newsletters/Emails

Newsletters/emails may contain a small image for statistical purposes, allowing users to unsubscribe if desired.

10.5 Disable the Use of Cookies

Users can disable cookies at any time through browser settings. However, note that disabling cookies may affect web service functionality. For example, in Google Chrome you may do so via Google Chrome support.

10.6 Cookies and Similar Technologies in the App

The App uses cookies for Functionality and Performance, excluding targeted advertising. Users can control cookie preferences. The following cookies are used:

To opt out of non-essential cookies, change your browser settings. Most browsers accept cookies by default, but preferences can be adjusted in privacy settings. For more information about cookies, including how to disable them, visit aboutcookies.org.

11. Questions and Contacts

You can contact us to clarify any doubts or questions at the following addresses:

• Email: info@neroes.tech
• Address: Lisboa, Portugal

12. Applicable Law and Competent Forum

This Privacy and Security Policy is governed and interpreted in accordance with Portuguese law. The Lisbon area court is competent, to the exclusion of any other, to settle any conflicts that result from the interpretation and application of this Privacy and Security Policy.

13. Amendment to the Privacy and Security Policy

This Privacy and Security Policy, which you must read carefully, may be changed, with the changes coming into effect as of the date of its publication on this website, with express reference to the date of update.

Date of the last update of the Privacy and Security Policy: November 11, 2023.