Privacy Policy

1. Scope of This Privacy Policy

This Privacy Policy applies primarily to personal data collected through:

• the Gyroscope Website;
• the Gyroscope Discipline Score (“GDS”) Assessment;
• eligibility or introductory questionnaires made available through the Website;
• Request a Conversation and other contact forms;
• email and other communications with Gyroscope;
• Website analytics and technical systems.

Certain services provided by third-party financial institutions, custodians, investment advisers, portfolio managers, or other regulated financial providers are governed by their own privacy policies and data protection practices.

Gyroscope does not control the independent processing activities of those providers merely because they may be referenced on or connected with the Website.

2. Personal Data We May Collect

The personal data we collect depends on how you interact with Gyroscope.

2.1 Information You Provide Through Contact Forms

When you request a conversation or otherwise contact us through the Website, we may collect information such as:

• first and last name;
• email address;
• telephone number, where provided;
• country or jurisdiction;
• preferred method of contact;
• the content of your message;
• additional context you voluntarily provide;
• referral source, where requested;
• date and time of the request.

Our initial contact forms are not designed to request bank account credentials, investment account passwords, portfolio statements, government identification documents, or other detailed financial documentation.

We ask that you do not submit information of this nature through general Website forms.

2.2 GDS Assessment Information

If you complete the Gyroscope Discipline Score Assessment, we may collect:

• your responses to the assessment questions;
• your calculated GDS score;
• component scores or related behavioral indicators;
• the behavioral classification generated from your responses;
• first and last name, where requested;
• email address;
• country or jurisdiction;
• consent and communication preferences associated with the assessment.

The GDS is designed to provide a structured view of behavioral patterns related to investment decision-making.

It is not a financial knowledge test, risk-profile assessment, suitability determination, investment recommendation, psychological or clinical diagnosis, guarantee of future behavior, or guarantee of investment performance.

2.3 Eligibility and Introductory Information

The Website may ask certain introductory or eligibility questions before allowing access to particular content or before a conversation is requested.

Depending on the applicable form, this may include information relating to your country or jurisdiction, eligibility criteria, or other contextual information necessary to determine whether a particular Website experience or conversation is appropriate.

We seek to limit these questions to the information reasonably necessary for their stated purpose.

2.4 Communications

When you communicate directly with Gyroscope by email, telephone, messaging service, or another communication channel, we may retain:

• your contact details;
• the date and time of the communication;
• the content of messages;
• information necessary to respond to or maintain the communication.

2.5 Technical and Website Usage Information

When you visit the Website, certain technical information may be collected automatically, including:

• IP address;
• browser type and version;
• device type;
• operating system;
• pages visited;
• date and time of access;
• navigation paths;
• referring source;
• session or technical identifiers;
• Website interactions;
• cookie and privacy preferences.

For further information about cookies and similar technologies, please refer to our Cookie Notice.

3. How We Use Personal Data

3.1 Operating and Securing the Website

To provide Website functionality, maintain technical security, prevent misuse, diagnose technical problems, and protect our systems.

3.2 Responding to Requests

To review and respond to questions, conversation requests, and other communications submitted through the Website.

Information submitted through Request a Conversation is used to understand the context of the request and determine the appropriate next step.

Submitting a request does not automatically create an advisory, contractual, fiduciary, or investment relationship with Gyroscope.

3.3 Providing the GDS Assessment

To:

• process assessment responses;
• calculate the GDS;
• generate and display the corresponding result;
• deliver the result by email where requested;
• contextualize the assessment;
• maintain relevant records associated with the assessment;
• support subsequent conversations requested by the participant.

The information provided for the GDS is not used to access, control, or manage any financial account.

3.4 Reviewing Eligibility and Context

Where eligibility or introductory questions are used, the information may be processed to determine whether particular Website content, communication, or a further conversation is appropriate under the criteria established by Gyroscope.

3.5 Communications Requested by You

We may use your contact information to send:

• an assessment result requested by you;
• confirmation of a submitted request;
• responses to your questions;
• information directly related to an existing communication or relationship.

3.6 Marketing Communications

Where appropriate and permitted by applicable law, we may send institutional updates, insights, publications, invitations, or other communications if you have requested or consented to receive them.

You may unsubscribe from marketing communications at any time.

Withdrawal from marketing communications will not prevent us from sending communications that are necessary to respond to a request, provide a service you specifically requested, or comply with applicable obligations.

3.7 Website Analysis and Improvement

Where permitted, we may use analytics and aggregated information to understand how visitors use the Website and to improve its content, structure, functionality, and performance.

Non-essential analytics technologies will be subject to the choices described in our Cookie Notice.

3.8 Legal, Regulatory, and Security Purposes

We may process information where reasonably necessary to:

• comply with applicable laws or legal obligations;
• respond to lawful requests from public authorities;
• establish, exercise, or defend legal rights;
• protect the security and integrity of the Website;
• prevent fraud, abuse, or unauthorized activity.

4. Legal Bases for Processing

Depending on the nature and context of the processing, Gyroscope may rely on one or more legal bases permitted under applicable law.

Under the LGPD, these may include:

Consent

Where you have freely provided consent for a specific purpose, such as certain non-essential cookies or optional communications.

You may withdraw consent in accordance with applicable law.

Performance of a Contract or Steps Requested by You

Where processing is necessary to respond to a request or provide functionality or information that you have specifically requested.

Legitimate Interests

Where necessary for legitimate purposes such as Website security, fraud prevention, administration, service improvement, or communication management, provided that such interests do not improperly override your fundamental rights and freedoms.

Legal or Regulatory Obligations

Where processing is required to comply with applicable laws, regulations, court orders, or other legally binding requirements.

Exercise of Rights

Where information must be retained or processed for the establishment, exercise, or defense of rights in judicial, administrative, or arbitration proceedings.

The applicable legal basis may differ according to the particular processing activity.

5. Automated Processing and the GDS

Certain Website functions may use automated processing.

In particular, the GDS uses your selected responses to calculate a score and related behavioral indicators according to the methodology incorporated into the assessment.

The calculation itself may occur automatically.

The GDS result does not, by itself:

• determine your suitability for an investment;
• determine a risk profile;
• produce an investment recommendation;
• select securities or financial products;
• determine an asset allocation;
• authorize transactions;
• provide access to or control over financial accounts;
• establish an advisory relationship;
• guarantee acceptance as a client.

The GDS is intended as a behavioral reference for reflection and dialogue.

Where applicable law provides rights relating to decisions based solely on automated processing that materially affect an individual’s interests, such rights may be exercised as described in Section 10 below.

6. How We Share Personal Data

Gyroscope does not sell personal data.

We may share personal data only where reasonably necessary and in accordance with applicable law.

6.1 Technology and Service Providers

Information may be processed by service providers that support functions such as:

• Website hosting;
• cloud infrastructure;
• Website security;
• form processing;
• email delivery;
• data storage;
• Website analytics;
• technical support;
• communication systems.

These providers are permitted to process information only as necessary to provide the relevant services and subject to applicable contractual and legal requirements.

6.2 Professional Advisers

Where necessary, information may be shared with professional advisers, such as legal, accounting, compliance, cybersecurity, or other specialist advisers, subject to appropriate confidentiality obligations.

6.3 Government Authorities and Legal Requirements

We may disclose information where required or permitted by law, including where necessary to:

• comply with a legal or regulatory obligation;
• respond to a valid judicial or governmental request;
• protect legal rights;
• prevent fraud or unlawful activity;
• protect the safety or security of individuals, systems, or property.

6.4 Financial Providers

Gyroscope and regulated financial providers perform distinct roles.

Completing the GDS, submitting a contact request, or otherwise interacting with the Website does not automatically result in your information being transferred to a bank, custodian, investment adviser, portfolio manager, or other financial provider.

If personal data needs to be shared with a financial provider in connection with a specific relationship or request, such sharing will be carried out under an appropriate legal basis and subject to any additional notices or documentation that may be required.

7. International Transfers

Some of the technology or service providers supporting the Website may process or store information outside Brazil.

Accordingly, personal data may be transferred internationally where necessary for the purposes described in this Privacy Policy.

Where the LGPD applies, international transfers will be carried out in accordance with applicable data protection requirements and legally recognized transfer mechanisms.

Depending on the circumstances, these may include transfers to jurisdictions recognized as providing an adequate level of protection or the use of contractual or other mechanisms permitted under applicable regulation.

8. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected.

Retention periods may vary depending on:

• the nature of the information;
• the purpose for which it was collected;
• whether a communication or relationship remains active;
• security and fraud-prevention requirements;
• applicable contractual arrangements;
• legal or regulatory obligations;
• the need to establish, exercise, or defend legal rights.

When personal data is no longer reasonably required, it may be deleted, anonymized, or otherwise handled in accordance with applicable law.

Withdrawal of consent or a deletion request does not necessarily require immediate deletion where retention is permitted or required for another lawful purpose.

9. Data Security

Gyroscope takes reasonable administrative, organizational, and technical measures intended to protect personal data against unauthorized access, accidental loss, alteration, disclosure, destruction, or misuse.

Access to personal data should be limited to individuals and service providers who require the information for legitimate purposes.

However, no internet-based system or method of electronic storage can guarantee absolute security.

For this reason, visitors should not transmit passwords, financial account credentials, payment card information, portfolio statements, identification documents, or other highly sensitive information through general Website forms unless specifically requested through an appropriate secure process.

10. Your Data Protection Rights

Depending on applicable law and the circumstances of the processing, you may have rights relating to your personal data.

Under the LGPD, these may include the right to:

• obtain confirmation that personal data is being processed;
• access your personal data;
• request correction of incomplete, inaccurate, or outdated information;
• request anonymization, blocking, or deletion of unnecessary, excessive, or unlawfully processed data;
• request portability where applicable and subject to applicable regulation;
• request deletion of personal data processed on the basis of consent, subject to lawful retention exceptions;
• obtain information regarding public or private entities with which data has been shared;
• obtain information about the possibility of refusing consent and the consequences of doing so;
• withdraw consent where processing is based on consent;
• object to certain processing where permitted by law;
• request review of decisions made solely through automated processing where applicable;
• request information regarding the criteria and procedures used in applicable automated decision-making, subject to lawful limitations.

You may also have the right to submit a petition regarding the processing of your personal data to Brazil’s National Data Protection Authority (“ANPD”), subject to applicable procedures.

These rights are not absolute and may be subject to exceptions established by applicable law.

11. Exercising Your Rights

To exercise a data protection right or submit a privacy-related question, please contact Gyroscope through the privacy or contact channel made available on the Website.

We may need to request information reasonably necessary to verify your identity before responding to a request involving personal data.

Requests will be handled in accordance with applicable legal requirements.

12. Cookies

The Website uses cookies and similar technologies for purposes including essential functionality, security, preference management, and, where permitted, analytics.

Further details regarding the categories of cookies used, the purposes for which they are used, and the choices available to you are described in our Cookie Notice.

13. Third-Party Websites and Services

The Website may contain links to websites, platforms, financial institutions, or services operated by third parties.

Gyroscope is not responsible for the privacy or data protection practices of independent third parties.

When you leave the Gyroscope Website or interact directly with an external service, you should review the privacy information provided by the relevant third party.

14. Children and Minors

The public Website and the services described through it are intended for adults with legal capacity to enter into the relevant interactions.

Gyroscope does not knowingly seek to collect personal data from children through its general Website forms or assessments.

If we become aware that personal data relating to a child has been collected through the Website in circumstances where it should not have been collected, appropriate steps will be taken in accordance with applicable law.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in:

• our Website;
• the services or assessments made available through it;
• technology providers;
• data processing practices;
• legal or regulatory requirements.

The updated version will be published on this page and the “Last updated” date will be revised accordingly.

Where required by law, additional notice or renewed consent may be provided before material changes affecting consent-based processing take effect.

16. Contact

If you have questions regarding this Privacy Policy, the processing of your personal data, or the exercise of your data protection rights, please contact Gyroscope through the contact channels made available on the Website.