Privacy Policy

1. Data controller

1.1.The controller of the personal data is:

Owner

NEOVEXA, S.L.

CIF (tax ID)

B22864516

Registered office

Plaza Sor Ángela de la Cruz 4, 21400 Ayamonte (Huelva), Spain

Registry details

Pendiente de completar

Email

info@gruponeovexa.com

1.2.This Policy applies to users of the Website, to Neovexa clients and to those who use the “Neovexa” mobile application for iPhone and Android (the “App”), which gives access to the private client area, and has been drawn up in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR; in Spanish, RGPD), and Ley Orgánica 3/2018, on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD).

2. Data we process

2.1.Neovexa may process the following categories of data:

•Identification and contact data: first name, surnames, NIF (tax ID), address, telephone number and email.

•Economic and financial data: amounts contributed, bank details, source of funds and tax information.

•Profile data: financial knowledge, investment experience and risk tolerance, obtained through the suitability test.

•Browsing data: data obtained through cookies, in accordance with the Cookie Policy.

•Private-area usage data: the screens visited and the area where you click, on the terms of section 10.

•Private-area chat messages: what you write in the chat and the replies you receive, including those from the automated assistant, on the terms of section 13.

2.2.Neovexa does not process special categories of data. The user warrants that the data provided is truthful and undertakes to report any change.

3. Purposes and legal bases

Purpose

Legal basis

Handling the enquiries and requests received through the Website or by other means.

Consent of the data subject and the application of pre-contractual measures at the data subject’s request (Art. 6(1)(a) and 6(1)(b) GDPR).

Managing the contractual relationship with clients, including the contributions, settlements and communications arising from the contract.

Performance of the contract (Art. 6(1)(b) GDPR).

Assessing the client’s financial profile and suitability.

Performance of pre-contractual measures and of the contract (Art. 6(1)(b) GDPR).

Identifying the client and verifying the source of funds.

Compliance with legal obligations, including, where applicable, anti-money-laundering legislation (Art. 6(1)(c) GDPR).

Complying with tax, accounting and commercial obligations.

Compliance with legal obligations (Art. 6(1)(c) GDPR).

Sending commercial communications about Neovexa’s solutions.

Consent of the data subject (Art. 6(1)(a) GDPR), which may be withdrawn at any time.

Recording which screens are visited and where you click within the private area, to improve the usability and design of the platform.

Neovexa’s legitimate interest in improving the platform (Art. 6(1)(f) GDPR).

Answering immediately, with an automated artificial-intelligence assistant, the general enquiries the client writes in the private-area chat (section 13).

Performance of the contract for use of the platform (Art. 6(1)(b) GDPR) and Neovexa’s legitimate interest in handling enquiries immediately (Art. 6(1)(f) GDPR). The client may object at any time from My profile → Privacy.

3.2.Neovexa does not take decisions based solely on automated processing that produce legal effects on the data subject. The result of the suitability test is indicative and is reviewed by Neovexa staff.

4. Retention period

4.1.Data will be kept for as long as the relationship with the data subject lasts and, once it has ended, for the periods legally required to deal with possible liabilities, including those laid down in commercial and tax law and, where applicable, anti-money-laundering legislation. Once those periods have elapsed, the data will be erased.

4.2.Data processed for sending commercial communications will be kept until the data subject withdraws consent.

5. Recipients

5.1.Data will not be disclosed to third parties, except where required by law or where necessary for the performance of the contract. The recipients may be:

•Public administrations, the Agencia Tributaria (Spanish tax authority), judicial authorities and other competent bodies, in compliance with legal obligations.

•Banks and financial intermediaries involved in the performance of the contract.

•Providers that supply services to Neovexa (web hosting, IT systems, consultancy), which act as processors under a contract in accordance with Article 28 GDPR.

•Anthropic, provider of the chat’s automated assistant, as processor and unless the client has objected to the assistant, on the terms of section 13.

6. International transfers

6.1.Where performance of the contract requires it, data may be disclosed to banks located outside the European Economic Area, in particular in the United Arab Emirates. Such transfers will be made under the safeguards provided for in Chapter V GDPR or, failing that, the derogations in Article 49 GDPR, such as the transfer being necessary for the performance of the contract.

6.2.Unless the client has objected to the chat’s automated assistant, the data sent to it may be processed in the United States by Anthropic, PBC. This transfer relies on the standard contractual clauses approved by the European Commission (Implementing Decision (EU) 2021/914), incorporated into Anthropic’s data processing agreement (section 13).

7. Rights of the data subject

7.1.The data subject may exercise at any time their rights of access, rectification, erasure, objection, restriction of processing and portability, and may withdraw any consent given, by writing to Neovexa at the address or email given in section 1, enclosing a copy of a document proving their identity.

7.2.If you consider that your rights have not been duly met, you may lodge a complaint with the Agencia Española de Protección de Datos (www.aepd.es).

7.3.From My profile → Privacy you can download a copy of your data in a structured format and request the deletion of your account, without needing to write to us.

8. Security

8.1.Neovexa applies appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR, and protects data against loss, alteration or unauthorised access.

9. Minors

9.1.Neovexa’s services are aimed exclusively at adults. Neovexa does not knowingly process data of minors.

10. Browsing log within the platform

10.1.When the user uses the private area of the platform (the client area, the sales area or the administration), Neovexa, S.L. automatically records which screens they visit and where on the screen they click, for the sole purpose of improving the usability and design of the platform.

10.2.Data processed: the user identifier and role, the date and time, the screen visited (without parameters or identifying data in the address) and, for each click, the type of element pressed and its position. What the user types into forms, the content of the screens and their IP address are not recorded for this purpose.

10.3.Legal basis: Neovexa’s legitimate interest in improving the platform (Art. 6(1)(f) GDPR).

10.4.Access: only Neovexa’s management (CEO). This data is not disclosed to third parties.

10.5.Retention: 90 days from the time it is recorded; after that period it is deleted automatically.

10.6.The user may access this data, rectify it, erase it, restrict its processing and object to it at any time by writing to info@gruponeovexa.com. They may also lodge a complaint with the Agencia Española de Protección de Datos (www.aepd.es).

11. The mobile application

11.1.The App is a way of accessing the private client area. The data processed through it is the same as in the private area on the web, with the particulars of this section.

11.2.Device permissions. The App only asks for the permissions it needs, at the moment they are used. You can withdraw them at any time from your phone’s settings:

•Camera and microphone: to photograph your identity document and record the verification video. The images are sent to Neovexa only when you press “Send” in the identity verification.

•Photos: so that you can choose an image or a document already saved on your phone. The App does not access the photo library on its own.

•Notifications: to alert you to pending signatures, chat messages, transactions and other notices about your account. On the lock screen only a short title is shown, with no amounts or personal data.

•Face ID, Touch ID or fingerprint: to unlock the App without typing your password. The check is carried out by your phone’s own operating system; Neovexa does not receive or store your face, your fingerprint or any biometric data. The App only receives from the phone the confirmation that the unlock was successful. The preference to use it is stored on the phone itself.

11.3.Notification identifier. If you accept notifications, Apple (iPhone) or Google (Android) assigns your device an identifier that Neovexa stores alongside your session so that it can send you notices. Notices are delivered through Apple’s notification service (Apple Push Notification service) or Google’s (Firebase Cloud Messaging). The identifier is deleted when you end the session with “Sign out” or delete your account; if the session ends on its own because of inactivity, it is kept so that we can continue to notify you, and those notices show no personal data or amounts.

11.4.What the App does not do. The App does not access your location, your contacts or other applications; it does not use advertising identifiers, contains no advertising or third-party analytics tools and does not track your activity in other applications or websites.

11.5.Downloaded documents. When you download a contract, a statement or your data, the file is temporarily saved on your phone so that you can open it, save it or share it using the system’s own options. What you do with it from then on stays on your phone.

12. How to delete your account

12.1.You can delete your account at any time from the private area, on the web or in the App: My profile → Privacy → Delete my account. If you have no access, write from your account’s email to info@gruponeovexa.com with the subject “Delete my account”. Full instructions are at https://gruponeovexa.com/eliminar-cuenta.

12.2.If you have no contracts in force, balance or transactions in progress, the account is closed at that moment. If you do, Neovexa will first settle what is due under your contract, return the money to your bank account and then close the account. In the meantime you can keep signing in and cancel the request.

12.3.When the account is closed, access is cut off and your email, telephone numbers, preferences, notices, commercial consent and device identifiers are erased. The data that the law requires us to keep (section 4) is blocked for the legal period and erased at the end of it.

13. Automated chat assistant

13.1.What it is. In the private-area chat, on the web and in the App, an artificial-intelligence assistant can immediately answer general questions about how the platform works and about the status of your account. It only replies while no member of the team has taken over the conversation and during the hours Neovexa has configured; during working hours the chat is handled by members of the team, and when a person takes over a conversation the assistant stops replying in it. Its replies are marked “AI reply”, are general information and do not constitute advice. The assistant does not carry out transactions or take decisions on your account. Before being sent, every reply goes through an automatic check: if it mentions returns or percentages, recommends investing or comes out incomplete, it is not sent and the enquiry is passed to a person.

13.2.You can object. The assistant replies by default. If you choose “I prefer to speak to a person” in My profile → Privacy, the assistant stops replying to you, none of your data is sent to Anthropic and your enquiries are handled by a member of the team. You can change your decision at any time, and in any conversation you can press “Speak to a person”.

13.3.What data is sent. For each reply, the following is sent to Anthropic:

•The latest messages of the conversation (at most eight, each cut to 1,500 characters): yours, the replies from the team and from the assistant, and the platform’s notices. Before they are sent, IBANs, DNI, NIE and passport numbers, long numbers (such as card or telephone numbers), emails, dates of birth, addresses, postcodes and amounts are replaced by a label. This replacement is automatic and based on the format of each item of data, so we ask you not to write in the chat any personal data that is not necessary.

•A summary of the status of your account, without amounts or balances: your first name; the name of your adviser; the status of your identity verification, of pending documentation and of the validity of your document; whether you have confirmed your email, accepted the current terms and completed the knowledge questionnaire; whether you have a verified bank account; whether the account is blocked from transacting; the reference, product and status of your contracts; requests in progress (deposits, withdrawals, contributions, data changes and documents to sign); the documents you can download, and whether two-step verification is switched on.

13.4.The summary of your account does not include your surnames, your document number, your address, your telephone number, your email, your bank details, amounts or balances, or the team’s internal notes. What you write in messages is sent as you write it, apart from the automatic replacements in section 13.3: if you put your full name or a figure in a message, it may reach the assistant. For that reason we ask you not to write in the chat data that is not needed for your enquiry.

13.5.Provider. The assistant uses Anthropic’s models (Anthropic, PBC, based in the United States, which provides the service to clients in the European Economic Area through Anthropic Ireland, Limited). Anthropic acts as processor in accordance with Article 28 GDPR, under its data processing agreement, and processes the data on Neovexa’s behalf to generate the reply. According to its commercial terms, Anthropic may not use this data to train its models. The international transfer is explained in section 6.2.

13.6.Purpose, legal basis and retention. The purpose is to reply to you immediately in the chat; the legal basis is the performance of the contract for use of the platform (Art. 6(1)(b) GDPR) and Neovexa’s legitimate interest in handling your enquiries immediately (Art. 6(1)(f) GDPR), to which you may object as explained in section 13.2. The messages of the conversation, including the assistant’s replies, are stored on Neovexa’s platform like the rest of the chat and are kept in accordance with section 4. You can exercise your rights in accordance with section 7.

14. Amendments

14.1.Neovexa may amend this Policy to adapt it to changes in legislation or in its activity. Any significant change will be announced prominently on the Website and, in the case of clients, by the usual means of communication.