Privacy policy

Company name: Hispania Data Solutions, S.L. Tax ID (CIF): B23880313 Registered address: Avenida de la Libertad, 6, Bloque 5, 4.ºA, 30009 Murcia, Spain Registry: Murcia Commercial Registry, Section 8, Sheet MU 117816, Entry 1 Privacy email: privacidad@hispaniasolutions.com Platform: InvertirDeuda (https://invertirdeuda.com) Data Protection Officer (DPO): we have appointed an external Data Protection Officer, ASEPROEM, S.L.P., whom you can contact at pdatos@aseproem.es for any matter relating to the processing of your data. If you have any questions about how your data is handled, please contact us at the addresses above.

We collect personal data mainly when you create an account on the platform: Platform account. When you create an account on the platform (/plataforma), we collect your first and last name, email address, phone number and password. The password is always stored encrypted using a hash function, never in plain text. If you register as a company, we additionally collect your company name and tax ID (CIF). If you sign in with Google, we receive from Google the basic profile data needed to authenticate you. During onboarding we collect qualification data that you provide voluntarily: capital range, investor profile, experience, provinces of interest, team size and similar details. We also record your acceptance of the Confidentiality Agreement (NDA), storing the date, the accepted version and the IP address from which it is accepted. For members with access to the Pro plan, we may process billing and payment data depending on the agreed terms. When applicable, payment is handled by Stripe as the payment processor; the company does not store card details. Additionally, like any website, we may automatically process browsing data (IP address, browser type, pages visited) through the tools described in section 6.

We process your data for the following purposes: - Create and manage your platform account and authenticate your access. - Provide the platform service and tailor it to your profile using the qualification data you provide. - Show you information about discounted debt investment opportunities (NPLs, judicial auctions, court order transfers, discounted mortgage debt) that we select and analyse. - Manage access to the Pro plan and, where applicable, payment and billing. - Communications related to the operation of the platform. - Measure how the platform is used (which sections you visit, which assets you view, what you search and filter, time of use) to understand the product, improve it and prioritise its development. This internal usage analytics is carried out with our own means, is not shared with third parties and does not store your IP address. - Comply with our legal and tax obligations. We do not use your data for third-party advertising or share it with other companies for commercial purposes.

The processing of your data is based, depending on the case, on: - Consent: for creating an account and sending communications. You can withdraw it at any time (see section 7, "Your rights"); withdrawal does not affect the lawfulness of prior processing. - Performance of a contract: for providing the platform service and managing the Pro subscription. - Legal obligation: for issuing invoices and complying with tax and commercial regulations. - Legitimate interest: to ensure the security of the service and to prevent fraud, and to measure internal use of the platform with our own means (no third parties, no IP) in order to improve the product.

We retain your platform account data while the account is active. When you unsubscribe or cancel your account, we block your data and retain it only for the applicable statutory limitation periods to handle potential claims (generally up to 5 years for personal actions under the Spanish Civil Code), after which we securely delete it. Billing data and accounting records are retained for 6 years under the Spanish Commercial Code, and tax-relevant data for 4 years under tax regulations. Acceptance of the Confidentiality Agreement (NDA) is retained for the duration of the relationship and for the term of the confidentiality obligations set out in the agreement itself.

To provide the service we rely on the following providers, which act as data processors and process your data in accordance with our instructions: - Stripe: payment processing and billing for the Pro plan, where applicable. - Supabase: database hosting. - Google: authentication via Google sign-in. - Vercel: application hosting and aggregated usage analytics. - Resend: email delivery. For website analytics we use Google Tag Manager (Google Analytics) and Vercel Analytics, which are only activated if you accept analytics cookies (see section 8), and Plausible, a cookieless analytics tool with no personal data that does not require consent. They process browsing data in aggregated form. Some of these providers (for example, Stripe, Google or Resend) may involve international transfers of data outside the European Economic Area. In those cases, such transfers rely on the appropriate safeguards provided for in the regulations: the provider's adherence to the EU-U.S. Data Privacy Framework (DPF) or the standard contractual clauses approved by the European Commission. We do not share your personal data with third parties except where required by law.

As the data subject, you have the right to: - Access: request a copy of the data we hold about you. - Rectification: correct inaccurate or incomplete data. - Erasure: ask us to delete your data ("right to be forgotten"). - Objection: object to processing in certain circumstances. - Restriction: request that we restrict processing in certain cases. - Portability: receive your data in a structured, commonly used format. - Withdrawal of consent: at any time and at no cost. To exercise any of these rights, write to us at privacidad@hispaniasolutions.com or to our Data Protection Officer (pdatos@aseproem.es). We will respond within a maximum of one month (extendable by two additional months in complex cases). If you believe the processing does not comply with regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or your local supervisory authority.

A cookie is a small file stored on your device when you visit the website. We use cookies and local storage technologies, both our own and third-party. Analytics cookies are only set if you accept them in the consent banner; technical cookies are essential for the site to function and do not require consent. Technical cookies (necessary, no consent required): - id_cookie_v1 (local storage, first-party): stores your cookie preferences. Persistent. - authjs.session-token (first-party, Auth.js): keeps your session logged in on the platform. Up to 30 days. - authjs.csrf-token (first-party, Auth.js): protects against CSRF attacks. Session. - authjs.callback-url (first-party, Auth.js): manages the sign-in flow. Session. - pl_view and pl_ob (first-party): remember the access mode and onboarding state on the platform. Session. Analytics cookies (require your consent): - _ga and _ga_* (Google, via Google Tag Manager): measure aggregated website usage. Up to 13 months. - _gid (Google): distinguishes users for analytics. 24 hours. - Vercel Analytics (Vercel): aggregated usage statistics. Does not set cookies in your browser. Marketing cookies: we currently do not use advertising or commercial tracking cookies. If we introduce them in the future, we will ask you beforehand through the banner. You can accept, reject or configure cookies at any time from the preferences panel available in the website footer, as well as manage or delete them from your browser settings (Chrome, Firefox, Safari, Edge).

Our services are intended exclusively for persons over 18 years of age. We do not knowingly collect data from minors. If we become aware that a minor has registered without the consent of the holder of parental authority or guardianship, we will delete their data as soon as possible.

We may update this privacy policy to reflect regulatory changes or changes to the service. We will inform you of material changes via the email address you provided. The date of the last update appears at the top of the document.