Privacy policy

Last reviewed: 2026-05-02

1. Data controller

• Identity: IBVAS
• Address: España

2. Purposes, legal basis and retention

2.1. Enquiries and contact form

Purpose: To handle your request, respond and maintain necessary communication with you.

Legal basis: Consent given when you tick the acceptance box and submit the form (Art. 6(1)(a) GDPR), and where applicable legitimate interest in responding to prior requests (Art. 6(1)(f) GDPR).

Retention: For as long as needed to handle your request and thereafter for applicable legal periods or any contractual relationship that follows.

2.2. Private investor area (user account)

Purpose: Managing the contractual or pre-contractual relationship with investors, access to documentation and reserved information.

Legal basis: Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR) and legitimate interest in service security (Art. 6(1)(f) GDPR).

Retention: For the duration of the relationship and, after it ends, for commercial, tax and claims defence retention periods.

2.3. Legal compliance and security

Purpose: To comply with legal obligations, prevent fraud and protect the website and systems.

Legal basis: Legal obligation (Art. 6(1)(c) GDPR) and legitimate interest (Art. 6(1)(f) GDPR) in information security.

3. Recipients and processors

Data will not be disclosed to third parties except where legally required or to providers acting as processors (e.g. hosting, email or management tools) with the obligations required under Art. 28 GDPR.

Some providers outside the EEA may involve international transfers; in that case safeguards under the GDPR will apply (adequacy decisions, standard contractual clauses or other measures).

4. Data subject rights

You may exercise rights of access, rectification, erasure, restriction, portability and objection, and withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing.

You may also lodge a complaint with the competent supervisory authority; in Spain: Agencia Española de Protección de Datos (AEPD) — www.aepd.es.

To exercise your rights, write to the controller at the address indicated or to shown in the contact section, attaching a copy of identification where necessary.

5. Minors

Services are not aimed at children under 14. If you believe we have collected a minor’s data without appropriate consent, please tell us so we can delete it.

6. Security measures

Technical and organisational measures appropriate to the risk are applied to protect personal data against accidental or unlawful destruction, loss, unauthorised access or unlawful processing.

Complete contact and controller details in config/config.php (legal section) and adapt the text with legal advice suited to your activity.