Privacy policy

Company name: Hispania Data Solutions, S.L. Tax ID (CIF): B23880313 Registered address: Avenida de la Libertad, 6, Bloque 5, 4.ºA, 30009 Murcia, Spain Registry: Murcia Commercial Registry, Section 8, Sheet MU 117816, Entry 1 Privacy email: privacidad@hispaniasolutions.com Platform: InvertirDeuda (https://invertirdeuda.com) Data Protection Officer (DPO): we have appointed an external Data Protection Officer, ASEPROEM, S.L.P., whom you can contact at pdatos@aseproem.es for any matter relating to the processing of your data. If you have any questions about how your data is handled, please contact us at the addresses above.

We collect personal data mainly when you create an account on the platform: Platform account. When you create an account on the platform (/plataforma), we collect your first and last name, email address, phone number and password. The password is always stored encrypted using a hash function, never in plain text. If you register as a company, we additionally collect your company name and tax ID (CIF). If you sign in with Google, we receive from Google the basic profile data needed to authenticate you. During onboarding we collect qualification data that you provide voluntarily: capital range, investor profile, experience, provinces of interest, team size and similar details. We also record your acceptance of the Confidentiality Agreement (NDA), storing the date, the accepted version and the IP address from which it is accepted. For members with access to the Pro plan, we may process billing and payment data depending on the agreed terms. When applicable, payment is handled by Stripe as the payment processor; the company does not store card details. Additionally, like any website, we may automatically process browsing data (IP address, browser type, pages visited) through the tools described in section 6.

We process your data for the following purposes: - Create and manage your platform account and authenticate your access. - Provide the platform service and tailor it to your profile using the qualification data you provide. - Show you information about discounted debt investment opportunities (NPLs, judicial auctions, court order transfers, discounted mortgage debt) that we select and analyse. - Manage access to the Pro plan and, where applicable, payment and billing. - Communications related to the operation of the platform (email verification, password recovery, account notices): these are necessary for the service and do not require a separate opt-in. - Send you occasional notices about important platform news if you have ticked the corresponding consent box. You can unsubscribe at any time from the email itself. - If you are a registered user, communications about opportunities and news of this same service (Article 21.2 LSSI-CE), with a one-click unsubscribe link in every email. - If you gave us your address without creating an account (by requesting information about an asset on this site, or by joining the opportunities club in June 2026), communications about assets similar to the ones you asked about, based on that prior relationship (Article 21.2 LSSI-CE). Three emails at most, each with a one-click unsubscribe link, and we stop writing if you open none of them. Every email states exactly where you gave us your address, and you can object at any time. - Choose what we email you based on your activity on the platform: if you save a search, mark favourites or view the same asset or province several times, we use that activity to notify you of new matching assets, of changes in the ones you follow, or to offer you the dossier of one you have viewed. This is profiling for commercial communications about our own service; it has no legal effects on you and involves no automated decisions, and you can object at any time from "Email and alerts" in your account or with the unsubscribe link in every email (Article 21.2 GDPR). - Measure how the platform is used (which sections you visit, which assets you view, what you search and filter, time of use) to understand the product, improve it and prioritise its development. This internal usage analytics is carried out with our own means, does not store your IP address and is not shared with third parties, except for what we explain about partner companies in section 6. - Comply with our legal and tax obligations. We do not use your data for third-party advertising or share it with other companies for commercial purposes.

The processing of your data is based, depending on the case, on: - Consent: for creating an account and, separately and optionally, for sending news notices by email. You can withdraw it at any time (see section 7, "Your rights"); withdrawal does not affect the lawfulness of prior processing. - Legitimate interest and Article 21.2 LSSI-CE: for communications about opportunities and news of the service itself to registered users, always with a free and simple way to object in every mailing. - Performance of a contract: for providing the platform service and managing the Pro subscription. - Legal obligation: for issuing invoices and complying with tax and commercial regulations. - Legitimate interest: to ensure the security of the service and to prevent fraud, to measure internal use of the platform with our own means (no IP) in order to improve the product, and so that the partner company that brought you to the platform, if any, can assist you (section 6).

We retain your platform account data while the account is active. When you unsubscribe or cancel your account, we block your data and retain it only for the applicable statutory limitation periods to handle potential claims (generally up to 5 years for personal actions under the Spanish Civil Code), after which we securely delete it. Billing data and accounting records are retained for 6 years under the Spanish Commercial Code, and tax-relevant data for 4 years under tax regulations. Acceptance of the Confidentiality Agreement (NDA) is retained for the duration of the relationship and for the term of the confidentiality obligations set out in the agreement itself. If you give us your email without creating an account (for example, to receive alerts about assets in a province or when requesting information about an asset), we keep your data while you maintain your consent or while your request is being handled, and we delete it if you do not confirm the subscription within 30 days, if you withdraw your consent or after 12 months without any interaction. When you unsubscribe we keep only a fingerprint (hash) of your address so that we do not write to you again.

To provide the service we rely on the following providers, which act as data processors and process your data in accordance with our instructions: - Stripe: payment processing and billing for the Pro plan, where applicable. - Contabo (Contabo GmbH, Germany): hosting of the server where the application, the database and the files reside. - Google: authentication via Google sign-in. - Cloudflare: content delivery network and encrypted backup outside the main server. - Resend: email delivery. For website analytics we use Google Tag Manager (Google Analytics) and PostHog (hosted in the European Union), which are only activated if you accept analytics cookies (see section 8). They process browsing data in aggregated form, without your IP address. To send emails we use Resend (Resend, Inc., with EU servers for our sending), which processes your address and delivery events as a data processor. Some of these providers (for example, Stripe, Google or Resend) may involve international transfers of data outside the European Economic Area. In those cases, such transfers rely on the appropriate safeguards provided for in the regulations: the provider's adherence to the EU-U.S. Data Privacy Framework (DPF) or the standard contractual clauses approved by the European Commission. Partner companies. If you came to the platform through a partner company with which we have an agreement, that company can see your name, your email and your activity on the platform (which assets you view and save, what you search for and when you log in) so that it can assist you in your deals. Only that company sees it, never other users. If you do not want it to see it, write to us at privacidad@hispaniasolutions.com and it will stop seeing it. Apart from the above, we do not share your personal data with third parties except where required by law.

As the data subject, you have the right to: - Access: request a copy of the data we hold about you. - Rectification: correct inaccurate or incomplete data. - Erasure: ask us to delete your data ("right to be forgotten"). - Objection: object to processing in certain circumstances. - Restriction: request that we restrict processing in certain cases. - Portability: receive your data in a structured, commonly used format. - Withdrawal of consent: at any time and at no cost. To exercise any of these rights, write to us at privacidad@hispaniasolutions.com or to our Data Protection Officer (pdatos@aseproem.es). We will respond within a maximum of one month (extendable by two additional months in complex cases). If you believe the processing does not comply with regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or your local supervisory authority.

A cookie is a small file stored on your device when you visit the website. We use cookies and local storage technologies, both our own and third-party. Analytics cookies are only set if you accept them in the consent banner; technical cookies are essential for the site to function and do not require consent. Technical cookies (necessary, no consent required): - id_cookie_v1 (local storage, first-party): stores your cookie preferences. Persistent. - authjs.session-token (first-party, Auth.js): keeps your session logged in on the platform. Up to 30 days. - authjs.csrf-token (first-party, Auth.js): protects against CSRF attacks. Session. - authjs.callback-url (first-party, Auth.js): manages the sign-in flow. Session. - pl_view and pl_ob (first-party): remember the access mode and onboarding state on the platform. Session. - pl_escala (first-party): remembers the interface size you choose on the platform (normal, large or TV). It only exists if you change it. 1 year. Analytics cookies (require your consent): - _ga and _ga_* (Google, via Google Tag Manager): measure aggregated website usage. Up to 13 months. - _gid (Google): distinguishes users for analytics. 24 hours. - ph_<project key>_posthog (PostHog, cookie and local storage entry with the same name): stores a random pseudonymous identifier to measure website usage (pages viewed, clicks and where the screen is tapped), without your IP address and without recording the session. It is only created if you accept analytics cookies. Up to 1 year. Marketing cookies: we currently do not use advertising or commercial tracking cookies. If we introduce them in the future, we will ask you beforehand through the banner. You can accept, reject or configure cookies at any time from the preferences panel available in the website footer, as well as manage or delete them from your browser settings (Chrome, Firefox, Safari, Edge).

Our services are intended exclusively for persons over 18 years of age. We do not knowingly collect data from minors. If we become aware that a minor has registered without the consent of the holder of parental authority or guardianship, we will delete their data as soon as possible.

We may update this privacy policy to reflect regulatory changes or changes to the service. We will inform you of material changes via the email address you provided. The date of the last update appears at the top of the document.