Privacy Policy

1. Data controller

The controller for the processing of your personal data is RE-ACT INVERSIONS 2000, S.L., with NIF B-67262865. For any matter regarding this policy or the exercise of your rights, you may contact us at info@arkosinvestor.com.

2. Data we process

Account data: email address, password (stored as a hash), preferred language, registration timestamp, last sign-in timestamp.

Communication data: emails, messages and queries you send through the channels we provide.

KYC onboarding data (when you complete investor onboarding): full name, national ID (DNI/NIE), evidence of economic activity and source of funds, as required by anti-money-laundering rules.

Browsing data: IP address, user-agent and technical events strictly necessary for service operation and security auditing.

NDA and contract signature: digitised handwritten signature, date and time, IP address and user-agent. These elements prove your consent and are required to unlock access to sensitive asset information.

3. Purposes

Account management and service delivery (Platform access, session maintenance, customer support).

Compliance with applicable legal obligations (KYC, anti-money-laundering, tax, record-keeping).

Communication of investment opportunities matched to your preferences.

Service improvement, fraud prevention and Platform security.

Marketing communications about new services or content, only when you have given express consent.

4. Legal basis

Performance of the contract: purposes necessary to provide the service rely on the contract (the terms accepted at registration).

Legal obligations: KYC, AML, tax and record-keeping rely on applicable regulation.

Legitimate interest: security, fraud prevention and service improvement rely on our legitimate interest, duly balanced against your rights.

Consent: marketing communications and non-essential cookies rely on your consent, which you may withdraw at any time.

5. Recipients

Your data may be shared with the following processors, acting on our behalf and under contract pursuant to GDPR art. 28: hosting and infrastructure providers (Vercel Inc., Supabase Inc.), transactional email provider, KYC and electronic-signature providers when you complete investor onboarding.

We do not sell or rent your personal data to third parties for commercial purposes.

Where legally required, we may share data with competent public authorities (judicial, tax, AML).

6. International transfers

We aim to keep processing of your data within the European Economic Area. When a processor operates from outside the EEA, we guarantee an adequate level of protection through European Commission adequacy decisions or standard contractual clauses, in line with GDPR arts. 45 and 46.

7. Retention periods

Account data: while the account is active and, after closure, for the limitation period of any actions that could arise from use of the service.

KYC and transaction data: for ten (10) years from the last transaction, as required by AML regulation.

Accounting and tax data: for the periods required by applicable tax and commercial law.

Marketing data: until you withdraw consent or exercise your right to object.

8. Your rights

As a data subject you have the rights of access, rectification, erasure, restriction of processing, portability, objection, and the right not to be subject to automated decision-making with legal effects. You can exercise them by writing to info@arkosinvestor.com with proof of identity.

If you consider the processing does not comply with applicable law, you have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or your local supervisory authority.

9. Cookies and similar technologies

We use cookies strictly necessary for Platform operation (session, authentication) and preference cookies (language), the legal basis being service provision and your consent respectively.

We do not use third-party analytics, advertising or profiling cookies without your prior consent. If we do so in the future, you will be informed via a specific banner and asked for granular consent.

10. Security

We apply reasonable technical and organisational measures to protect your data: encryption in transit (HTTPS), salted-hash password storage, role-based access control, audit logs of sensitive events, and breached-password checks via the Have I Been Pwned service.

Despite these measures, no system can guarantee absolute security. In the event of a security breach affecting your data, we will notify the Spanish Data Protection Agency and, where applicable, the affected individuals, within the timeframes established by the GDPR.

11. Changes to this policy

We may update this policy to reflect legal, technical or operational changes. The current version will always be available at arkosinvestor.com/privacy with its last-updated date. Substantial changes will be notified by email or by notice on the Platform.

12. Contact

For any query about this policy or how your data is processed, write to info@arkosinvestor.com.