Privacy Policy

The investor portal at investors.secyda.eu is operated by Secyda. Access to the portal is granted individually and requires prior registration. By accessing the portal, you acknowledge this privacy policy.

2.1 Account data
Name, email address, and any other information provided at registration. Used to authenticate your access to the portal and to identify your activity within it.

2.2 Session and navigation data
Each time you access the portal, we record:

• The date and time of access
• The sections and tabs you visit
• The documents you open or download, including file name and, where applicable, file size
• The buttons and links you click within the portal
• The duration of your session

This data is collected to allow Secyda to understand how investors interact with the portal, identify which materials are reviewed, and improve the quality and relevance of the information provided.

2.3 Technical data
For each session, we also collect:

• Your IP address, captured at the moment of access
• Your device type (desktop, mobile, or tablet)
• Your operating system and version (for example: macOS 14.4, Windows 11, iOS 17)
• Your browser and version (for example: Chrome 124, Safari 17)
• The raw User-Agent string transmitted by your browser

This data is collected for security purposes, to detect unauthorised access attempts, and to maintain an accurate audit record of portal activity.

The processing of the data described above is based on the legitimate interest of Secyda (Article 6(1)(f) GDPR).

You have been granted access to the portal in the context of an existing relationship with Secyda as an investor or prospective investor. Collecting detailed interaction data in that context is proportionate and serves a legitimate purpose: understanding investor engagement, maintaining security, and meeting the record-keeping obligations associated with the management of investor relations.

This data is not used for advertising, profiling unrelated to the portal, or any purpose other than those described in this policy.

Activity logs are retained for a maximum of 24 months from the date of each recorded event. Account data is retained for the duration of the investor relationship and for a period of 5 years after its conclusion, in accordance with applicable commercial and tax record-keeping obligations.

Your activity data is accessible only to authorised personnel at Secyda. It is not shared with third parties, sold, or used for any external purpose.

The portal infrastructure is hosted on a server operated by Secyda (Ventotene, EU-based hosting). Data does not leave European infrastructure.

Under the GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data, subject to our legitimate interest in retaining activity logs for security and audit purposes
• Object to processing based on legitimate interest
• Request restriction of processing
• Lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos — aepd.es)

To exercise any of these rights, contact: legal@secyda.eu

We will respond within 30 days.

The portal uses session storage (not persistent cookies) to maintain your authenticated session and to assign a session identifier for activity tracking purposes. No advertising cookies or third-party tracking pixels are used.

For usage analytics, we use PostHog, a self-hosted analytics platform running exclusively on Secyda-operated European infrastructure. PostHog operates in cookieless mode (in-memory persistence only) and does not set any tracking cookies. No data is sent to external services.

If this policy is updated in a material way, registered users will be notified by email at least 14 days before the changes take effect.