Privacy Policy

Privacy Policy

Effective Date: March 22, 2026 Last Updated: March 22, 2026

This Privacy Policy explains how Angola 2050 (“we,” “us,” or “our”), a publication of the Vanderbilt Portfolio, collects, uses, stores, shares, and protects personal data when you visit angola2050.com (the “Site”). This policy is designed to comply with the European Union General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), the Swiss Federal Act on Data Protection (FADP/nDSG), the Brazilian General Data Protection Law (LGPD), the United Kingdom Data Protection Act 2018 and UK GDPR, and other applicable data protection laws worldwide.

By accessing or using the Site, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with any part of this policy, you should discontinue use of the Site immediately. This policy should be read in conjunction with our Terms of Service and Cookie Policy.

1. Data Controller

The data controller responsible for your personal data is:

Vanderbilt Portfolio Email: info@angola2050.com

For questions regarding this policy, to exercise your data rights, or to raise a complaint about our data processing practices, contact us at the email address above. Our contact page provides additional information about response timeframes for different inquiry types. We are committed to responding to all data protection inquiries within the timeframes mandated by applicable law, and in most cases significantly faster.

2. Personal Data We Collect

We collect and process different categories of personal data depending on how you interact with the Site. We adhere to the principle of data minimization, collecting only the personal data that is necessary for the specific purposes described in this policy.

2.1 Data Collected Automatically

When you visit the Site, we automatically collect certain technical data through cookies and similar technologies. This data is collected to ensure the Site functions properly, to understand how visitors interact with our content, and to serve relevant advertising.

• IP address — Your Internet Protocol address is collected by our web servers and may be processed by Google Analytics and Google AdSense. Where required by applicable law (including under GDPR), IP addresses are anonymized before storage by truncating the last octet, preventing identification of individual users. Full IP addresses are retained in server access logs for up to 90 days for security and abuse prevention purposes.
• Browser type and version — The name and version of your web browser (e.g., Chrome 120, Firefox 121, Safari 17) is collected to ensure content renders correctly and to diagnose technical issues.
• Operating system — Your device operating system (e.g., Windows 11, macOS Sonoma, iOS 17, Android 14) is collected for the same purposes.
• Device type — Whether you are accessing the Site from a desktop computer, laptop, mobile phone, or tablet is recorded to optimize content delivery and understand usage patterns across device categories.
• Screen resolution — Your screen dimensions are collected to understand the range of display configurations used by our audience and to optimize layout and design decisions.
• Referring URL — The web address of the page that directed you to our Site (e.g., a search engine results page, a link from another website, or a social media platform) is recorded to understand traffic sources and the effectiveness of external links to our content.
• Pages visited on the Site and time spent on each page — Your navigation path through the Site and the duration of each page view are recorded to understand content engagement and to identify the topics and formats that are most valuable to our audience.
• Date and time of access — Timestamps for each page request are recorded in server logs and analytics data to understand usage patterns across time zones and days of the week.
• Geographic location — Country-level and city-level geographic location is derived from your IP address. This data is used to understand the geographic distribution of our audience and to ensure compliance with applicable regional data protection laws. We do not collect precise GPS coordinates or street-level location data.
• Language preferences — Your browser’s language settings are recorded to understand the linguistic profile of our audience and to inform decisions about potential multilingual content offerings.

2.2 Data Collected Through Cookies

We use cookies and similar tracking technologies as described in detail in our Cookie Policy. Cookie-based data collection includes:

• Strictly necessary cookies for Site functionality, including session management, consent preference storage, and security token validation. These cookies are essential for the Site to operate and do not require consent.
• Analytics cookies (Google Analytics 4) for understanding Site usage patterns, including page views, session duration, bounce rate, traffic sources, and user flow through the Site. These cookies are only activated after you provide affirmative consent through our consent management platform.
• Advertising cookies (Google AdSense) for serving relevant advertisements and measuring advertising effectiveness. Personalized advertising cookies are only activated with your explicit consent. Without consent, only non-personalized contextual ads are served.
• Functionality cookies for remembering preferences such as consent choices, display settings, and other functional parameters that enhance your browsing experience.

For a complete list of cookies used on the Site, including cookie names, purposes, and retention periods, please refer to our Cookie Policy.

2.3 Data You Provide Voluntarily

When you interact with certain features of the Site, you may voluntarily provide personal data:

• Email address when subscribing to the Angola 2050 Intelligence Brief. We use your email address solely to deliver the newsletter and related communications that you have opted into.
• Name and email address when downloading gated reports such as the Angola Investment Guide 2025. We use this information to deliver the download link and to understand the professional profile of our report readership.
• Email address and message content when contacting us through the contact page or by emailing info@angola2050.com. We use this information solely to respond to your inquiry.
• Payment information when subscribing to premium access. Payment card details are processed directly by PCI-DSS compliant third-party payment processors. We do not receive, access, or store payment card numbers, CVV codes, or other sensitive payment credentials. We receive only transaction confirmation data, including the amount, date, and a truncated reference number.
• Professional information — In some contexts (such as institutional partnership inquiries or premium subscription applications), you may voluntarily provide your job title, employer name, and professional role. This information is used to tailor our response and ensure that our services match your organizational needs.

2.4 Data We Do Not Collect

Angola 2050 does not collect or process the following categories of data:

• Special categories of personal data (as defined under GDPR Article 9), including data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data concerning sex life or sexual orientation
• Social Security numbers, national identification numbers, or government-issued identification document numbers
• Financial account numbers, credit card numbers, or debit card numbers (these are processed by our payment processors, not by us)
• Precise geolocation data (GPS coordinates)
• Data from children under the age of 16 (see Section 13 below)

3. Legal Basis for Processing (GDPR)

Under the GDPR, we process personal data on the following legal bases. Each processing activity is mapped to its corresponding GDPR legal basis to ensure full compliance with the principle of lawfulness.

Where processing is based on consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. You can withdraw cookie consent through our consent management platform and withdraw newsletter consent through the unsubscribe link in any newsletter edition or by contacting us directly.

Where processing is based on legitimate interest, we have conducted a balancing test to ensure that our legitimate interests are not overridden by your rights and freedoms. You have the right to object to processing based on legitimate interest at any time (see Section 10 below).

4. Google Analytics

We use Google Analytics 4 (GA4) to understand how visitors interact with the Site. GA4 collects data including pages visited, session duration, traffic sources, user engagement events, and geographic location at the country and city level. We have configured GA4 with the following privacy protections to minimize data collection and align with data protection requirements:

• IP anonymization is enabled by default in GA4, which truncates user IP addresses within Google’s collection network before any storage or processing occurs
• Data retention is set to the minimum available period of 14 months, after which user-level and event-level data associated with cookies is automatically deleted
• Advertising features (including remarketing, demographics, and interest reporting) are disabled unless you have provided explicit consent for advertising cookies
• User-ID tracking is not enabled — we do not create persistent cross-session user profiles
• Google Signals is disabled unless consent has been granted for both analytics and advertising cookies, preventing cross-device tracking without explicit user permission
• Data sharing with Google for benchmarking and product improvement purposes is disabled
• Granular location and device data collection is configured to collect only country-level geographic data rather than city or sub-city level precision

Google Analytics uses cookies to distinguish unique users and maintain session state. For comprehensive information on how Google processes data collected through Analytics, see Google’s Privacy Policy and Google’s data processing terms. You may opt out of Google Analytics entirely by installing the Google Analytics Opt-Out Browser Add-on, which is available for all major browsers.

5. Google AdSense

We use Google AdSense to display advertisements on the Site. Advertising revenue supports the continued operation of Angola 2050 and the production of free, publicly accessible intelligence content. Google AdSense uses cookies and web beacons to serve ads and measure advertising effectiveness.

• Personalized ads are only displayed if you have provided explicit consent through our consent management platform. Personalized ads use data about your browsing history across Google’s advertising network to serve advertisements that may be more relevant to your interests.
• Non-personalized ads may be displayed without consent for personalized advertising, using contextual targeting based solely on the content of the page you are viewing rather than your personal browsing history. Non-personalized ads still use cookies for frequency capping, aggregated ad reporting, and combating fraud and abuse.
• You may opt out of personalized advertising at any time by visiting Google Ad Settings or by revoking advertising cookie consent through our consent management platform.
• You may also visit aboutads.info or youronlinechoices.eu to opt out of third-party vendor cookies for personalized advertising across the broader advertising ecosystem.

For further details on how Google uses data when you visit sites that use Google advertising products, see how Google uses data when you use our partners’ sites.

6. Google Consent Mode v2

Angola 2050 implements Google Consent Mode v2 to ensure that Google tags (Analytics, AdSense) respect user consent choices in real time. This is a technical framework that communicates your consent status to Google’s services, ensuring that data collection aligns with your preferences.

Consent Mode operates as follows:

• Before consent is granted: Google tags load in a restricted mode. No cookies are set for analytics or advertising purposes. Google receives only anonymized, cookieless pings that do not identify individual users and cannot be used to build user profiles. These cookieless pings provide aggregate, non-identifying data that helps us understand overall traffic patterns without compromising individual privacy.
• After consent is granted: Full cookie functionality is enabled for the categories you have consented to (analytics, advertising, or both). Data collection proceeds in accordance with the standard Google Analytics and AdSense data processing frameworks.
• If consent is denied or withdrawn: Google tags remain in restricted mode for the duration of your session and all future visits until you change your consent preferences. No identifying data is collected or stored.

Consent Mode v2 implements the following consent signals, each of which can be independently granted or denied:

7. Data Sharing and Third Parties

We share personal data only with the following categories of recipients, and only to the extent necessary to fulfill the purposes described in this policy:

• Google LLC — As the provider of Google Analytics 4 and Google AdSense services. Google processes data in accordance with its own privacy policy and applicable data processing agreements. Our relationship with Google for Analytics and AdSense is governed by Google’s data processing terms, which include Standard Contractual Clauses for international data transfers.
• Email service providers — For newsletter delivery and contact form processing. Our email service provider processes your email address and associated metadata (such as open rates and click-through data for newsletters) in accordance with their privacy policy and our data processing agreement.
• Payment processors — For premium subscription transactions. Payment processors handle payment data directly, are PCI-DSS compliant, and operate under their own privacy policies. We do not access or store sensitive payment credentials.
• Hosting providers — Our Site hosting infrastructure processes server logs containing IP addresses, request timestamps, and access data. Server logs are retained for 90 days for security monitoring and are then automatically purged.
• Content delivery network (CDN) providers — Our CDN provider processes minimal technical data (IP addresses, request headers) to deliver Site content efficiently and protect against distributed denial-of-service attacks.

We do not sell personal data to third parties under any circumstances. We do not share personal data with data brokers, lead generation companies, or marketing aggregators. We do not engage in cross-context behavioral advertising beyond what is facilitated through Google AdSense with your explicit consent. We do not provide personal data to any government authority except when required by valid legal process (court order, subpoena) under applicable law.

8. International Data Transfers

Data collected through the Site may be transferred to and processed in countries outside the European Economic Area (EEA), the United Kingdom, and Switzerland, including the United States. When such transfers occur, we ensure appropriate safeguards are in place to protect your personal data in accordance with applicable data protection laws:

• Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914) are incorporated into our data processing agreements with service providers that process personal data outside the EEA
• EU-US Data Privacy Framework (DPF) — Where applicable, we rely on service providers that have self-certified under the EU-US Data Privacy Framework for transfers to the United States. Google LLC is certified under the DPF.
• Swiss-US Data Privacy Framework — For transfers of personal data from Switzerland to the United States, we rely on service providers certified under the Swiss-US Data Privacy Framework
• UK International Data Transfer Agreement (IDTA) — For transfers of personal data from the United Kingdom, we ensure that appropriate transfer mechanisms recognized under UK data protection law are in place
• Transfer impact assessments — We conduct transfer impact assessments for data transfers to countries not covered by an adequacy decision, evaluating the legal framework of the recipient country and the effectiveness of supplementary measures

9. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes described in this policy, comply with legal obligations, resolve disputes, and enforce our agreements. The following retention periods apply:

When retention periods expire, personal data is securely deleted or anonymized such that it can no longer be associated with an identified or identifiable individual. Anonymized data may be retained indefinitely for aggregate statistical analysis.

10. Your Rights Under GDPR

If you are located in the European Economic Area, the United Kingdom, or any jurisdiction that provides equivalent data protection rights, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR) — You have the right to request confirmation of whether we process your personal data and, if so, to receive a copy of that data along with supplementary information about the processing, including the purposes, categories of data, recipients, retention periods, and the source of the data.
• Right to rectification (Art. 16 GDPR) — You have the right to request correction of inaccurate personal data and completion of incomplete personal data without undue delay.
• Right to erasure (Art. 17 GDPR) — You have the right to request deletion of your personal data (“right to be forgotten”) when the data is no longer necessary for its original purpose, when you withdraw consent, when you object to processing and there are no overriding legitimate grounds, when the data has been unlawfully processed, or when deletion is required by law.
• Right to restriction of processing (Art. 18 GDPR) — You have the right to request that we limit how we use your data in certain circumstances, including when you contest the accuracy of the data, when processing is unlawful but you oppose erasure, when we no longer need the data but you require it for legal claims, or when you have objected to processing pending verification of legitimate grounds.
• Right to data portability (Art. 20 GDPR) — You have the right to receive your personal data in a structured, commonly used, and machine-readable format (such as JSON or CSV) and to transmit that data to another controller without hindrance, where processing is based on consent or contract and is carried out by automated means.
• Right to object (Art. 21 GDPR) — You have the right to object to processing based on legitimate interests at any time. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims. You have an absolute right to object to processing for direct marketing purposes.
• Right to withdraw consent (Art. 7(3) GDPR) — You have the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. You can withdraw cookie consent through our consent management platform and newsletter consent through the unsubscribe link or by contacting us.
• Right to lodge a complaint — You have the right to file a complaint with your local data protection supervisory authority. For a list of EEA supervisory authorities, visit the European Data Protection Board website.
• Right not to be subject to automated decision-making (Art. 22 GDPR) — You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. Angola 2050 does not engage in automated individual decision-making.

To exercise any of these rights, email info@angola2050.com with the subject line “Data Rights Request” and specify which right(s) you wish to exercise. We will verify your identity using reasonable measures and respond within 30 days as required by the GDPR. If your request is complex or we receive a large number of requests, we may extend the response period by an additional 60 days, in which case we will inform you of the extension within the initial 30-day period.

11. Your Rights Under CCPA/CPRA

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act provides you with the following rights:

• Right to know — You have the right to request disclosure of the categories of personal information we have collected about you, the categories of sources from which the information was collected, the business or commercial purposes for collection, the categories of third parties with whom we share personal information, and the specific pieces of personal information we have collected about you in the preceding 12 months.
• Right to delete — You have the right to request deletion of personal information we have collected from you, subject to certain exceptions provided by law (such as data necessary to complete transactions, detect security incidents, comply with legal obligations, or exercise free speech rights).
• Right to correct — You have the right to request correction of inaccurate personal information we maintain about you.
• Right to opt out of sale or sharing — We do not sell personal information as defined by the CCPA. We do not share personal information for cross-context behavioral advertising beyond Google AdSense with consent. If you have consented to personalized advertising through our consent management platform, you may withdraw that consent at any time, which constitutes opting out of sharing for targeted advertising purposes.
• Right to non-discrimination — We will not discriminate against you for exercising your CCPA/CPRA rights, including by denying goods or services, charging different prices or rates, providing a different level or quality of goods or services, or suggesting that you will receive a different price or rate or a different level or quality of goods or services.
• Right to limit use of sensitive personal information — We do not collect sensitive personal information as defined by the CCPA/CPRA.

Categories of personal information collected in the preceding 12 months:

To submit a CCPA/CPRA request, email info@angola2050.com with the subject line “CCPA Request.” We will verify your identity using reasonable measures (which may include confirming your email address matches our records) and respond within 45 calendar days. If additional time is needed, we may extend the response period by an additional 45 days with notice.

12. Swiss Federal Act on Data Protection (FADP/nDSG)

If you are located in Switzerland, the revised Swiss Federal Act on Data Protection (nDSG), effective September 1, 2023, provides you with rights substantially similar to those under the GDPR, including:

• Right to information (Art. 25 nDSG) — You have the right to request information about whether we process your personal data and to receive details about the processing, including the identity of the controller, the processing purposes, categories of data processed, recipients, and any transfer to countries without adequate data protection.
• Right to data portability (Art. 28 nDSG) — You have the right to request your personal data in a commonly used electronic format or to have it transferred to another controller, where technically feasible.
• Right to correction and deletion — You have the right to request correction of inaccurate personal data or deletion of personal data that is no longer necessary for its original purpose or for which you have withdrawn consent.
• Right to object — You have the right to object to the processing of your personal data for direct marketing purposes.

The Federal Data Protection and Information Commissioner (FDPIC) is the competent supervisory authority for data protection matters under Swiss law. You have the right to lodge a complaint with the FDPIC if you believe that our processing of your personal data violates the nDSG.

13. Children’s Privacy

Angola 2050 is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. The content on this Site is designed for professionals, researchers, analysts, and policymakers, and is not intended for minors. If we become aware that we have collected personal data from a child under 16 without verifiable parental consent, we will take immediate steps to delete that information from our systems. If you are a parent or guardian and believe that your child has provided personal data to Angola 2050, please contact us at info@angola2050.com and we will promptly investigate and delete any such data.

14. Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, destruction, loss, and misuse. These measures include:

• Encryption in transit — All data transmitted between your browser and our servers is encrypted using HTTPS/TLS (Transport Layer Security) with modern cipher suites.
• Access controls — Access to personal data within our organization is restricted to authorized personnel who require access for legitimate business purposes, on a need-to-know basis.
• Hosting security — Our hosting infrastructure implements firewalls, intrusion detection systems, DDoS protection, and regular security patches.
• Third-party security — We select third-party service providers that maintain appropriate security certifications (such as SOC 2, ISO 27001, or PCI-DSS) and include security obligations in our data processing agreements.
• Incident response — We maintain an incident response procedure for the detection, investigation, and notification of personal data breaches in accordance with GDPR Article 33 (notification to supervisory authority within 72 hours) and Article 34 (notification to affected individuals when there is a high risk to rights and freedoms).

No method of electronic transmission or storage is completely secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee absolute security. In the event of a data breach that affects your personal data, we will notify you and the relevant supervisory authorities in accordance with applicable law.

15. Do Not Track Signals

Some browsers transmit a “Do Not Track” (DNT) signal when visiting websites. There is currently no universally accepted standard for how websites should respond to DNT signals. We do not currently alter our data collection or use practices in response to DNT signals. However, we honor consent choices made through our consent management platform, which provides granular control over analytics and advertising data collection. We also support the Global Privacy Control (GPC) signal, which is recognized under the CCPA/CPRA as a valid opt-out of sale/sharing of personal information.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our data processing practices, technology, legal requirements, regulatory guidance, or other factors. When we make changes, we will update the “Last Updated” date at the top of this page. Material changes — such as changes to the categories of personal data collected, new processing purposes, changes to data sharing practices, or changes that affect your rights — will be communicated through the consent management platform (which will re-request your consent as appropriate) and, for registered users, by email notification.

We encourage you to review this policy periodically to stay informed about how we are protecting your personal data. Your continued use of the Site after changes to this policy constitutes acceptance of the revised policy, except where re-consent is required by law.

17. Contact Us

For questions about this Privacy Policy, to exercise your data protection rights, or to raise a concern about our data processing practices:

Email: info@angola2050.com

When contacting us about data protection matters, please include “Privacy” or “Data Rights” in your subject line to ensure your inquiry is prioritized appropriately. We aim to acknowledge receipt of all data protection inquiries within 48 hours and to provide a substantive response within the timeframes mandated by applicable law (30 days under GDPR, 45 days under CCPA/CPRA).

You may also visit our contact page for additional inquiry options and response timeframes. For information about how we use cookies specifically, see our Cookie Policy. For the terms governing your use of this Site, see our Terms of Service. For details on our data collection and verification methodology, see our methodology page.

Angola 2050 is part of the Vanderbilt Portfolio, a network of specialized intelligence platforms delivering institutional-grade research across global markets.