Privacy Policy

[LEGAL_ENTITY_NAME], registered at [COMPANY_REGISTERED_OFFICE], registration number [COMPANY_REGISTRATION_NUMBER].

Contact: info@balanos.club

You may contact our Data Protection Officer at [DPO_EMAIL]. Appointment of a DPO is required for fund and financial-services activity; we have appointed one.

Identification and contact data: full name, date and place of birth, nationality, residential address, email, phone, preferred language.

Identity verification (KYC): copies of identity documents (passport or national ID), selfie and liveness video, proof of address, PEP and sanctions screening results, source-of-funds documentation, tax residency and taxpayer identification numbers.

Investor suitability: professional experience, financial situation, investment objectives, risk tolerance, answers to the suitability questionnaire.

Transaction and holdings data: subscription amounts, redemption requests, allocation choices, tokenised share holdings and transfers recorded on the security-token registry.

Account and technical data: login credentials (hashed), IP address, device identifiers, browser fingerprint used for fraud prevention, session and audit logs.

Communications: emails, support tickets, call recordings if we speak by phone (with notice), and messages you send through the platform.

Cookie and analytics data: see the Cookie Policy.

We process your personal data on the following legal bases under Article 6 GDPR, and — for identity documents and biometric liveness — Article 9 GDPR where applicable:

Contract (Art. 6(1)(b)): to establish and perform the investor relationship, including onboarding, order execution, and account management.

Legal obligation (Art. 6(1)(c)): to comply with AML/CTF rules, tax-reporting rules (CRS, DAC6), securities-law rules, and other mandatory obligations.

Legitimate interests (Art. 6(1)(f)): to secure the platform, prevent fraud, defend legal claims, and improve our service. We balance these interests against your rights.

Consent (Art. 6(1)(a)): for optional analytics and marketing cookies, and for optional marketing communications. You can withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

Public interest / AML (Art. 9(2)(g) where applicable): for biometric liveness detection and politically-exposed-person screening, which may involve special-category data.

We share personal data with the following categories of recipients, each acting under a written GDPR-compliant contract:

KYC/AML provider (Sumsub): identity verification, biometric liveness, sanctions and PEP screening.

Fund administrator ([FUND_ADMINISTRATOR_NAME]): registrar and transfer-agent functions, NAV calculation, investor records.

Custodian and depositary: safekeeping of fund assets.

Tokenisation provider (Tokeny): security-token registry maintenance under the ERC-3643 standard.

Banking partners: subscription and redemption payments.

Technology providers: cloud infrastructure (Google Cloud), email and calendaring, customer support tooling.

Auditors, regulators, and tax authorities: where required by law.

We do not sell personal data.

Some processors (for example cloud-infrastructure providers) may process data outside the European Economic Area. When that happens, we rely on the safeguards listed in Chapter V GDPR, principally the European Commission's Standard Contractual Clauses and, where relevant, supplementary measures such as encryption and access controls. A list of current third-country recipients and the applicable safeguard is available on request at info@balanos.club.

We keep personal data only as long as necessary for the purpose for which it was collected, and in any event for the periods required by law. Typical retention periods: onboarding and KYC data — 10 years after the end of the investor relationship (Luxembourg / Spanish AML law); transaction records — 10 years; general account and communications data — 6 years after the end of the relationship; cookie data — as described in the Cookie Policy.

Under the GDPR you have the right to: access a copy of your personal data; rectify inaccurate data; request erasure where there is no overriding legal ground to retain it; restrict or object to processing; request portability of data you provided; withdraw consent where processing is based on consent; and lodge a complaint with a supervisory authority. In Spain, the competent authority is the Agencia Española de Protección de Datos (www.aepd.es). In Luxembourg, the Commission nationale pour la protection des données (www.cnpd.lu).

To exercise your rights, contact us at info@balanos.club or [DPO_EMAIL]. We will respond within one month, and may extend by two further months for complex requests, informing you of the extension.

We do not make decisions that produce legal or similarly significant effects based solely on automated processing. KYC and suitability outcomes are reviewed by human operators before a final decision is taken.

We maintain technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access controls and multi-factor authentication for staff, regular vulnerability reviews, and a documented incident-response plan. No system is perfectly secure; we will notify you and the relevant supervisory authority of any personal-data breach within the timeframes required by law.

The Site and the fund are directed at adults (18+) who are professional or well-informed investors. We do not knowingly collect personal data from minors.

We may update this Policy from time to time. The updated version will be posted on the Site with a new "Last updated" date. For material changes we will notify account holders by email.