Skip to content
Sign NDA

Legal · updated on September 24, 2026

Privacy policy

Owner identification

Owner
Albert Vilardell Serra
Tax ID (NIF)
52167251P
Registered address
Carrer Numància, 95, local 5, 08029 Barcelona
Email
invest@investin.barcelona
Website
investin.barcelona

In compliance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Personal Data Protection (LOPDGDD), this policy explains how we handle the data you give us on investin.barcelona. The data controller is the owner of the website, whose details are shown above.

What data we process and why

We only process the data you give us in the forms, and only for the purpose of each one:

  1. Non-disclosure agreement (NDA) and access to a listing: first and last name, company, position, country, investment vehicle, investment range, email, phone and your acceptance of the NDA. We use them to verify the investing entity, send you the memorandum and manage the transaction.
  2. Investment criteria: subsectors, investment range, vehicle, name, company, country and email, so we can notify you when a matching company is published.
  3. Selling your company: sector, approximate revenue, expected timing, ownership of the real estate, province, name, phone and email. We use them to study your case, call you and, if you decide to sell, prepare the mandate.
  4. Contact: the details in the contact form, to reply to your message.
  5. Market notes subscription: your email, to send you one note a month.
  6. Usage statistics: aggregate measurement of visits: cookieless with Plausible and, if you accept them, with Google Analytics cookies (see the cookie policy).

We do not make automated decisions or build profiles with legal effects.

  • Consent (Art. 6.1.a GDPR) for requests you send with the acceptance box, for the subscription and for Google Analytics cookies. You can withdraw it at any time.
  • Pre-contractual steps and performance of a contract (Art. 6.1.b GDPR) when a request leads to an NDA, a sale mandate or a transaction.
  • Legitimate interest (Art. 6.1.f GDPR) in verifying the investing entity before releasing confidential information, and for cookieless usage statistics.
  • Legal obligation (Art. 6.1.c GDPR) to keep transaction records.

Confidentiality between buyers and sellers

A seller’s data is never shared with a buyer who has not signed the non-disclosure agreement, and a buyer’s data is not shared with the seller without the buyer’s knowledge.

Retention

  • Requests that do not lead to a transaction: until you withdraw your consent and, at most, three years after the last contact.
  • Mandates, NDAs and transactions: for as long as the relationship lasts and then for the statutory retention periods for commercial and tax records (generally six years).
  • Subscription: until you unsubscribe.

Recipients and processors

We do not share data with third parties unless required by law. To provide the service we use these providers, which process data only on the owner’s behalf and under a data processing agreement:

  • Cloudflare, Inc.: hosting of the website and of the owner’s contact management system (CRM), form delivery and email forwarding.
  • Google Ireland Limited (Google Workspace): email and the spreadsheet where requests are recorded.
  • Plausible Insights OÜ (Plausible Analytics): usage statistics measured from our server, with no cookies and no code in your browser, processed within the European Union.
  • Google Ireland Limited (Google Analytics): usage statistics with cookies, only if you accept them (see the cookie policy).

Cloudflare and Google may process data outside the European Economic Area. Those transfers rely on the EU-US Data Privacy Framework or on the European Commission’s standard contractual clauses.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability by writing to the email shown above. Say which right you are exercising and prove your identity.

If you consider that your request has not been handled properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es) or with the supervisory authority of your country of residence.

Security and accuracy

We apply technical and organisational measures appropriate to the risk: encrypted connections, restricted access to requests and an anti-spam field in the forms. You are responsible for the data you provide being accurate and up to date.

Changes to this policy

We may update this policy to reflect changes in the law or in the service. The date of the last update is shown at the top of this page.