Privacy Policy

Who is responsible

The controller is Alvera Iberia Holding S.L., NIF/CIF [COMPANY_TAX_ID], at [REGISTERED_ADDRESS]. Privacy requests: [PRIVACY_CONTACT_EMAIL]. Data protection officer, if applicable: [DPO_DETAILS_OR_NOT_APPLICABLE].

Information involved

Required fields are identified on each form. Without the information needed for your request or authentication, we cannot provide that particular service. Please do not include unnecessary identity documents, payment-card information or sensitive personal data in a general enquiry.

• Contact enquiries: name, email address, area of interest, message and the record of your privacy-policy acknowledgement.
• Investor enquiries: name, email, country of residence, indicative investment range, project interest and, if supplied, telephone number.
• Portal access and administration: invitation details, email or telephone number used for sign-in, name, account identifier, role, status, authentication and session information; contact details, investment and recorded-payment information, documents, requests and updates associated with your account where provided.
• Technical information needed to deliver and protect the service, such as connection and request records. Enquiry abuse controls use hashed email/IP identifiers and a request fingerprint. These are security controls, not advertising profiles.

Purposes and legal bases

We use enquiry information to respond to your request; invitation and authentication information to manage authorised access; and portal records to administer the relevant investor relationship. Technical records help prevent abuse and protect accounts.

[CONFIRM_LEGAL_BASES: identify the applicable basis for each activity before publication. Requested pre-contractual steps or a contract may support relevant enquiries and investor services; a documented legitimate-interest assessment may support general correspondence and security; mandatory records require the specific legal obligation to be identified. Consent must be reserved for genuinely optional processing.]

The required Privacy Policy checkbox records that you have read and accepted the policy. It is not consent to receive marketing, and does not waive your data-protection rights. Responding to an enquiry and sending a requested sign-in message by email or SMS are distinct from sending promotional communications. Any optional marketing consent must be obtained separately.

Service providers and recipients

The website is designed to use Supabase for authentication, database records and private document storage. Hosting, email delivery and other operational providers process data as necessary to deliver the selected services. Authorised Alvera personnel may access information needed for their responsibilities. Information may also be disclosed where required by law.

Where enabled, email or SMS is used for requested sign-in verification messages, internal enquiry notifications and enquiry confirmations. An email receipt may be sent to the address supplied with an enquiry. An SMS receipt is optional and is sent only when you expressly request it and verify the phone number. These transactional communications are not marketing. [CONFIRM_MESSAGING_PROVIDERS: planned enquiry notifications and receipts use Resend for email and Twilio for SMS; confirm which are activated, who receives notifications, the final login-email/SMS providers and the data included before publication.]

[CONFIRM_PROCESSORS_AND_TRANSFERS: list the final hosting and authentication-email providers, relevant processing locations, recipient categories, any transfers outside the EEA and the applicable safeguards or adequacy decision, including how to obtain details. An EU database region alone does not establish that every provider operation stays in the EEA.]

How long information is kept

Enquiries: [ENQUIRY_RETENTION_PERIOD_OR_CRITERIA]. Portal accounts, investment records and documents: [PORTAL_RETENTION_PERIOD_OR_CRITERIA]. Security records and provider logs: [SECURITY_RETENTION_PERIOD_OR_CRITERIA]. Records needed to meet legal obligations or establish, exercise or defend claims may require a separate retention period, which must be identified in the relevant schedule.

Browser-storage lifetimes and controls are described in the Cookie Policy.

Your rights

Depending on the circumstances, you may request access, correction, deletion, restriction or portability of your personal data, and object to processing based on legitimate interests. Where processing depends on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing. Send requests to the privacy contact above; we may need proportionate information to confirm your identity.

You may complain to the Spanish Data Protection Agency (AEPD), www.aepd.es, or another competent supervisory authority. You do not have to contact us first.

Automated decisions and changes

The website's enquiry and portal functions do not make automated decisions about your eligibility to invest. Security controls can reject or limit technical requests. Any separate investment assessment is subject to the information provided for that process.

This policy may be updated to reflect actual services and processing. Where a new purpose needs consent or additional information, we will provide that before the new processing begins.