AUDACIOUS Privacy Policy

Programme organisers

The Programme Promoter and the Programme Manager process personal data in connection with AUDACIOUS in accordance with their respective roles and responsibilities under applicable data protection law.

Programme Promoter:

MOTA-ENGIL NEXT, S.A.Registered office: Rua do Rego Lameiro, no. 38, 4300-454 Porto, Portugal

Program Managers:

Beta-i Collaborative Innovation, Lda registered with the Commercial Registry Office under the sole company and tax number 514075228, with registered office at Edifício Atrium Saldanha Praça Duque de Saldanha, nº 1, 2º andar, 1050-094 Lisboa, Portugal

The Program Manager and the Promoter are separate entities that are working together to deliver the Program and nothing in these terms is intended to suggest any other association between the Program Managers and the Promoters. Nothing in this Privacy Policy is intended to create any partnership, agency or other association between them beyond their respective roles in the Programme.

Applications are submitted through services provided by F6S Network Global Limited. F6S processes personal data relating to the creation and use of F6S accounts and its platform as an independent controller, in accordance with its own Terms of Service and Privacy Policy. The Programme Promoter and Programme Manager process the application data made available tothem through F6S for the purposes described in this Privacy Policy.

Personal data we collect

During the application and selection process we may collect personal information including, but not limited to:

• Name and professional contact details;
• Position or role within your organisation;
• Company information;
• Information relating to your solution, technology, business model and innovation;
• Pitch decks and supporting documentation;
• Communications exchanged throughout the Programme;
• Evaluation notes and application status.

This information is necessary to assess your application and manage your participation in AUDACIOUS. If you choose not to provide the information requested, we may be unable to evaluate your application.

Applicants must not include special categories of personal data within the meaning of Article 9 of the GDPR, or personal data relating to criminal convictions and offences within the meaning of Article 10 of the GDPR, unless such information is expressly requested by the Programme Promoter and an appropriate legal basis and safeguards have been identified. Personal data of this nature that is submitted inadvertently and is not necessary for the Program will be deleted or redacted, where possible

Minors: The individual completing and submitting an application must be at least 18 years old. The Program is not intended to collect personal data relating to minors

Personal data about other individuals

As part of your application you may submit information relating to other members of your team or organisation.

Where you provide personal data relating to another individual, you confirm that:

• you have informed that individual that their information will be shared with us and processed for the purposes described in this Privacy Policy;
• you have made this Privacy Policy available to them; and
• you have obtained any necessary authorisation and/or otherwise ensured that you have a valid legal basis to share their personal data with the Programme Promoter and the Programme Manager.
• You are responsible for ensuring that any personal data relating to third parties that you submit is accurate, relevant and limited to what is necessary for the purposes of the application and the Programme.

Purposes and legal bases

We process personal data for the following purposes:

• to receive and manage applications;
• to evaluate eligibility and the suitability of proposed solutions;
• to communicate with applicants throughout the Programme;
• to organise interviews, workshops, online pitches, the Pilot Design Sprint, the Showcase and other Programme activities;
• to facilitate collaboration between selected startups, Mota-Engil teams, MEXT and Beta-i;
• to comply with legal and regulatory obligations;
• to maintain records relating to Programme management;
• to manage and communicate about AUDACIOUS 2026 and its activities.

Depending on the relevant processing activity, we process personal data where necessary for the purposes of our legitimate interests in organising, managing and operating the Programme and assessing potential collaboration opportunities, where necessary to take steps at the applicant’s request prior to entering into a potential contractual relationship, where necessary to comply with a legal obligation, or on the basis of consent, where applicable.

Where we rely on legitimate interests, we will only process personal data where those interests are not overridden by the interests, rights or freedoms of the relevant data subjects.

Optional uses and consent

Where applicants provide consent, we may also:

• use the company name and logo in communications about the Programme;
• photograph or record Programme events for communication or promotional purposes;
• contact applicants regarding future innovation programmes or opportunities organised by Beta-i or MEXT.

Where processing is based on consent, applicants may withdraw that consent at any time. Withdrawal will not affect any processing carried out before consent was withdrawn. Refusal to provide, or withdrawal of, consent for these optional purposes will not affect the assessment of an application or participation in the Programme.

Sharing personal data

We (and our representatives) may disclose your personal data to third parties only to the extent necessary for the purposes described in this Privacy Policy, including:

• for completing due diligence on you and your business or business idea (and, where appropriate, on your team or company);
• to assess and facilitate potential investment, pilot, partnership or commercial opportunities connected with your application or proposed solution;;
• for publicity or promotional purposes, where permitted under the Application Terms and, where required, subject to your prior consent;
• to suppliers involved in the operation of the Programme, including technology providers, event venues, professional advisers, communications agencies and other service providers, where access to personal data is necessary for the performance of their services and subject to appropriate confidentiality and data protection obligations;
• if we are under a duty to disclose or share your personal data in order to comply with any legal obligation,
• or in order to enforce or apply such other terms as apply to our relationship, or to protect the rights, property, or safety of our customers, ourselves or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction;
• if we determine that such disclosure is necessary in connection with any investigation or complaint regarding your application; and
• in the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets.

The Program Managers and the Promoters may also share your personal data between them and with other companies in the Promoters’ groups for the purposes of assessing and processing your application and arranging your participation in pitch day. Where selected applicants proceed to pilot discussions or commercial collaboration with Mota-Engil, any additional processing of personal data will be governed by the relevant contractual arrangements.

The Promoter may share personal data, to the extent strictly necessary for the achievement of the identified purposes, with the following categories of recipients:

1. Entities providing technological services, including providers of hosting, cloud storage, systems maintenance, technical support, software development, IT security, data analysis, and other entities that provide services essential to the technical operation of the Platform;
2. Beta-i, as a partner entity responsible for methodological, technical, and operational support to the AUDACIOUS 2026;
3. Subcontractors or service providers acting on behalf of the Promoter, under documented instructions and subject to contractual obligations of confidentiality and data protection;
4. Public, regulatory, judicial, or administrative authorities, whenever such communication is required by law, regulation, court decision, by legitimate order of a competent authority, or when it is necessary for compliance with a legal obligation to which the Promoter is subject;
5. Other users of the F6S Platform, when such sharing occurs as a result of the normal operation of the programme and is necessary for facilitating connections between Companies and startups/scaleups, in accordance with the Terms and Conditions and Regulations.
6. Public, regulatory, judicial or administrative authorities, where disclosure is required by applicable law or a binding decision.

Whenever applicable, the Promoter will ensure that third parties accessing personal data within AUDACIOUS 2026 are bound by confidentiality obligations and appropriate contractual obligations regarding data protection.

The Promoter does not, under any circumstances, sell personal data to third parties.

F6S platform and data collection

Applications are submitted through the F6S platform. F6S has its own Terms of Service and Privacy Policy, which govern the use of its platform. Applicants should review those documents before creating an account or submitting an application. We are not responsible for the operation of the F6S platform, its user accounts or its cookies.

Personal data may be collected, in particular, through the following means:

1. During the account creation and registration process on the F6S Platform, by filling out the registration form;
2. In filling out or updating User profiles, including the voluntary insertion of professional, commercial, technical, or other information considered relevant by the User;
3. In the publication of challenges by companies, including a description of the business problem, technical requirements, evaluation criteria, and other information associated with the challenge;
4. In the submission of solutions or proposals by startups or scaleups in response to the published challenges, including the description of the solution, implementation proposal, technical information, and supporting documentation;
5. In the exchange of information and communications between Users through the Platform, whether through messages, comments, or other interaction tools made available by the Platform;
6. Through direct contact with the Promoters or the AUDACIOUS 2026 operational team, including the Program Managers, via email, contact forms, telephone, or other means provided;
7. Through cookies or similar technologies, when browsing and using the F6S Platform, in accordance with the Cookie Policy;
8. Through the presentation of documentation or additional information submitted by Users for the purposes of eligibility validation, identity verification, or compliance with other requirements for participation in the Platform.

Photography and recordings

Certain Programme activities, including interviews, workshops, online sessions and the Showcase, may be photographed or recorded.

These recordings may be used for internal communications and, where appropriate, external communication about AUDACIOUS. Where the use of a participant’s identifiable image or voice for external communication or promotional purposes requires consent under applicable law, such consent will be requested separately.

International transfers

The Programme Promoter will identify and document any transfer of personal data to a country outside the European Economic Area.

Where the recipient is located in a country covered by an adequacy decision of the European Commission, the transfer will be based on Article 45 of the GDPR. In the absence of an adequacy decision, the Program Promoter will implement appropriate safeguards under Article 46 of the GDPR, such as the European Commission’s Standard Contractual Clauses, together with supplementary measures where required.

Information about the relevant destination countries and a copy or description of the applicable safeguards may be requested through: privacy@motaengilnext.com

F6S independently describes the international transfers carried out in connection with its services in the F6S Privacy Policy.

Your data protection rights

Data subjects may at any time, under the applicable laws, request access to their personal data, as well as their rectification, erasure and restriction of processing, withdraw consent, request the portability of their data, or object to processing, provided that the relevant legal requirements are met.

Users have the following personal data protection-related rights under the applicable laws:

The user may contact the Program Managers’ Data Protection Officer at Beta-i, Av. Duque de Loulé 12 7o, 1050-090 Lisbon, Portugal or by email at data.protection@beta-i.com, or privacy@motaengilnext.com to exercise these rights.

The data subject is further entitled to lodge a complaint with the Comissão Nacional de Proteção de Dados (Portuguese Data Protection Commission) if he or she considers that the processing of his or her personal data infringes applicable data protection law.

Personal data breaches

Where a personal data breach is likely to result in a risk to the rights and freedoms of natural persons, the Program Promoter will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of the breach, in accordance with applicable law.Whenever a breach is likely to pose a high risk to the rights and freedoms of data subjects, the Promoter will notify the affected data subjects, when legally required.

Any suspected personal data breach may be reported to: privacy@motaengilnext.com

Changes to this Privacy Policy

The Programme Promoter and the Programme Manager reserve the right to change this Privacy Policy at any time. The changes shall be duly disclosed on the Platform and notified using the contact details provided by the data subjects.

The most current version of the Privacy Policy will be permanently available on the Platform.

Changes to this Privacy Policy will not affect the lawfulness of processing carried out before the relevant change. Where a change requires new consent or the provision of additional information to data subjects, the Programme Promoter will take the necessary steps before commencing the relevant processing.