Privacy policy

The controller of the personal data collected through the website www.alter5.com and the Alter5 platform is:

Alter5 Financial Technologies, S.L. ("Alter5"), Spanish tax identification number (CIF) B-88357769, with its registered office at Calle Manuel Pombo Angulo, 10, Floor 1, Office 2, 28050 Madrid, Spain, registered with the Madrid Commercial Registry at Volume 24,985, Folio 192, Section 8, Sheet M-449888.

Alter5 may be contacted at [email protected] for any question regarding this policy or the processing of personal data.

Alter5 collects and processes only the personal data strictly necessary for each purpose. The following sections set out, for each purpose, the data processed and its legal basis under Article 6 of Regulation (EU) 2016/679 (GDPR).

2.1. Account and use of the platform

Purpose: to create and maintain the user's account on the Alter5 platform (app.alter-5.com), manage the transaction in which the user takes part, provide access to its documentation and related analyses, and enable communication between the parties involved. Alter5 creates accounts for the companies, lenders and investors with which it has a relationship: there is no registration open to the public.

Data processed: full name, email address, telephone number, job title, company, fund, investment vehicle or institution, language of use and password, which is stored in hashed form. Alter5 also processes the financial and documentary data the company provides about its transaction (including annual accounts and tax returns such as the Spanish corporate income tax return, Form 200), together with the record of activity on the platform.

Automated processing: to prepare the analysis, Alter5 uses third-party artificial intelligence tools that extract data from the financial documents provided and draft descriptions of the transaction. The Alter5 team uses the output of that extraction to prepare the analysis of the transaction.

Legal basis: performance of the contract entered into with the user or of the pre-contractual measures requested (Art. 6(1)(b) GDPR) and compliance with legal obligations applicable to Alter5 (Art. 6(1)(c) GDPR).

2.2. User support and information requests

Purpose: to handle enquiries, requests and complaints that the user addresses to Alter5 through any of the available channels, including the website contact form and the investor information, documentation and access request forms.

Data processed: full name, email address, name of the company or investing entity, products of interest and the content of the enquiry.

Legal basis: performance of the contract and pre-contractual measures at the request of the data subject (Art. 6(1)(b) GDPR).

2.3. Commercial communications and newsletter

Purpose: to send the selected newsletters, with information on developments in the energy sector.

Data processed: name, email address, selected topics and basic engagement metrics for the communications (opens, clicks).

Legal basis: consent of the data subject, given on subscribing to the communications (Art. 6(1)(a) GDPR). Consent may be withdrawn at any time through the unsubscribe link included in each communication or by writing to [email protected], without affecting the lawfulness of processing carried out before withdrawal.

2.4. Sector Monitor

Purpose: to send the user, by email, the quarterly report for the sector selected.

Data processed: name, professional email address and chosen sector. At present, sign-ups are forwarded to Alter5's internal mailbox and added manually to the sending tool.

Legal basis: consent of the data subject (Art. 6(1)(a) GDPR), which may be withdrawn at any time by writing to [email protected].

2.5. Preliminary debt capacity analysis

Purpose: to prepare a preliminary, non-binding analysis of the requesting company's debt capacity and to send the requester, by email, a personal access link to the analysis, valid for 7 days.

Data processed: company name, its tax identification number (CIF) — which constitutes personal data where the requesting company is a sole trader —, corporate email address and revenue band. This data is shared with Alter5's analysis system, which combines it with publicly available information on the company and with any documentation the company provides.

Legal basis: consent of the data subject (Art. 6(1)(a) GDPR), which may be withdrawn at any time by writing to [email protected], without affecting the lawfulness of processing carried out beforehand.

2.6. European Investment Fund guarantee eligibility enquiry

Purpose: to assess whether the transaction described by the company meets the criteria of the European Investment Fund guarantee and to contact the company to continue the conversation. The result shown by the questionnaire is indicative; the final assessment is carried out internally and does not constitute an approval.

Data processed: full name, email address, telephone number, company name and tax identification number (CIF), answers to the eligibility questionnaire and description of the financing need.

Legal basis: consent of the data subject (Art. 6(1)(a) GDPR), which may be withdrawn at any time by writing to [email protected], without affecting the lawfulness of processing carried out beforehand.

2.7. Product guidance (Request financing)

Purpose: to indicate which Alter5 product corresponds to the user's need on the basis of the description provided, and to reply to the user where contact is requested.

Data processed: description of the financing need, approximate amount and, if the user decides to continue, their email address.

Legal basis: pre-contractual measures at the request of the data subject (Art. 6(1)(b) GDPR) and, for the subsequent contact, their consent (Art. 6(1)(a) GDPR), which may be withdrawn by writing to [email protected].

2.8. Website analytics

Purpose: to measure the audience, use and performance of the website www.alter5.com through Google Analytics 4 and Microsoft Clarity.

Data processed: analytics cookie identifiers, IP address, pages visited, visit duration, device and browser type, and interaction with the page.

Legal basis: consent of the user, given through the website cookie banner (Art. 6(1)(a) GDPR and Art. 22.2 LSSI). The user may withdraw consent at any time by changing their preferences in the cookie settings panel, without affecting the lawfulness of processing carried out beforehand.

2.9. Fraud prevention and security of the platform and forms

Purpose: to detect and prevent fraudulent use, ensure information security, protect systems against attacks, prevent automated (bot) submission of the forms through Google reCAPTCHA and diagnose any technical errors that arise.

Data processed: technical identifiers, IP address, activity logs, authentication data and data on the user's interaction with the form collected by Google reCAPTCHA. Error reports are generated without personal data.

Legal basis: Alter5's legitimate interest in protecting its platform, its forms and its users against abuse and automated attacks (Art. 6(1)(f) GDPR), following a balancing test documented internally.

2.10. Accounting, tax and legal obligations

Purpose: to comply with the accounting, tax and other obligations imposed on Alter5 by applicable law.

Data processed: identification, tax and financial data.

Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR) — Spanish Commercial Code, General Tax Act, VAT Act and related legislation.

2.11. Recruitment

Purpose: to manage applications received through careers.alter-5.com, LinkedIn or email, to assess each candidate's suitability for the role and, where appropriate, to invite them to interview.

Data processed: identification and contact details, CV, education and professional experience, any public professional profile the candidate provides, and information supplied during the selection process.

Legal basis: steps taken at the request of the data subject prior to entering into a contract, by submitting an application (Art. 6(1)(b) GDPR). Retaining an application for selection processes other than the one applied for requires the candidate's consent (Art. 6(1)(a) GDPR), which may be withdrawn at any time.

Data marked as mandatory in Alter5's forms is required to handle the request, register the user or provide the contracted services. If it is not provided, the request or registration cannot be completed and the contractual relationship cannot continue. All other data is optional, and not providing it has no consequences for the user.

Alter5 does not sell or disclose personal data to third parties for commercial purposes. Data may be disclosed to:

• Public authorities and competent bodies where required by a legal obligation (e.g. the Spanish Tax Agency or the Social Security General Treasury).
• Lenders, investors and their advisers, where the user requests a service that requires it and to the extent necessary to provide it, with prior notice to the user.
• Service providers acting as data processors on behalf of Alter5, always under a contract compliant with Article 28 GDPR. As at the date of this policy, the main processors are: Amazon Web Services (website and platform hosting and document storage), Mailgun (email delivery), Google Workspace (corporate email and office tools), Google Analytics 4 and Microsoft Clarity (website analytics, only with consent), Google reCAPTCHA (form protection), Silktide (cookie banner management), Mailchimp (newsletter delivery), Airtable (management of eligibility enquiries), Pipedrive (commercial contact management), OpenAI (extraction of data from the financial documents provided to the platform), Sentry (technical error diagnostics, without personal data), Signaturit and Adobe Sign (electronic signature of contracts), LinkedIn (publication of job vacancies) and Alter5's payroll and accounting advisers, for payroll management and accounting obligations.

Some of the providers listed above process data from outside the European Economic Area, in particular from the United States (Mailchimp, Airtable, OpenAI, Microsoft Clarity, Adobe Sign, LinkedIn, Google Analytics, Google reCAPTCHA and, in part, Amazon Web Services and Google Workspace) and from the United Kingdom (Silktide).

All these international transfers are carried out with the appropriate safeguards provided for in Chapter V of the GDPR. Specifically: (i) for transfers to the United States, through the importer's adherence to the EU-US Data Privacy Framework, which has been covered by a European Commission adequacy decision since July 2023, and through Standard Contractual Clauses approved by Decision (EU) 2021/914; (ii) for transfers to the United Kingdom, under the European Commission's adequacy decision of 28 June 2021. Additional technical measures are applied wherever appropriate.

A copy of the safeguards applicable to any transfer may be requested by writing to [email protected].

Alter5 retains personal data only for as long as necessary to fulfil the purposes for which it was collected and, thereafter, for the applicable statutory periods:

• Data relating to the contractual relationship with the user: for the duration of that relationship and, once it has ended, for the applicable statutory limitation periods (up to 6 years under the Commercial Code and 4 years under the General Tax Act).
• Enquiries received through the website forms, including debt capacity analysis requests and eligibility enquiries: while the enquiry is being handled and, once closed, for the applicable statutory limitation periods.
• Personal access links to the debt capacity analysis: 7 days from sending, after which they cease to be valid.
• Data of candidates in recruitment processes: no more than 1 year from the last interaction, unless express consent is given for a longer period.
• Data of subscribers to commercial communications and to the Sector Monitor: until the data subject withdraws consent or unsubscribes.
• Web analytics data (Google Analytics 4 and Microsoft Clarity): the period configured in each tool, and in any case no longer than 14 months.
• Accounting and tax data: the applicable statutory periods, with a minimum of 6 years.

The user may exercise the following rights over their personal data at any time:

• Access: to know which of their data Alter5 processes.
• Rectification: to have inaccurate or incomplete data corrected.
• Erasure: to have their data deleted when it is no longer necessary.
• Objection: to object to processing based on legitimate interest.
• Restriction: to have processing restricted in certain cases.
• Portability: to receive their data in a structured, commonly used format.
• Not to be subject to automated decisions producing legal or similarly significant effects.
• Withdrawal of consent at any time, without retroactive effect, where processing is based on consent.

To exercise these rights, the user need only email [email protected] stating the right they wish to exercise. Alter5 will respond within one month, extendable by a further two months in particularly complex cases, in accordance with Article 12 GDPR.

A user who considers that the processing of their data does not comply with the law may lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es), the competent supervisory authority in Spain.

Alter5 applies appropriate technical and organisational measures to ensure the confidentiality, integrity and availability of personal data, including encryption in transit and at rest, multi-factor authentication for access to critical systems, role-based access control, regular backups and activity logging, all on infrastructure hosted on Amazon Web Services.

Alter5's website uses strictly necessary technical cookies for its correct operation and analytics cookies, which are activated only with the user's prior consent through the cookie banner. Details of the cookies used are set out in the Cookies Policy, available at www.alter5.com/en/cookies.

Alter5's website may contain links to websites operated by third parties. Alter5 is not responsible for the processing of personal data carried out by those third parties through their own sites. Users are advised to review the privacy policy of each such site before providing any personal information.

Alter5 may amend this privacy policy to reflect legislative developments or changes in its processing activities. Any amendment will be published on this page, together with the date of the latest update. If the changes are material, Alter5 will also give notice by email or through a notice in the user's account area on the platform.

Any question regarding this policy or the processing of personal data may be sent to [email protected] or addressed to Alter5 at the registered office indicated in section 1.