Privacy Policy

Last Updated: July 16, 2026

1. Data Controller

The entity responsible for processing your personal data is:

2. Data We Collect

We collect information necessary to provide specialized financial and real estate services:

Identification Data: Full name, National ID/NIE/Passport number, and signature.
Contact Information: Phone number, email address, and physical billing/mailing address.
Financial Profiles: Bank account details, transaction history, and source of funds.
Compliance Data: Information required for Anti-Money Laundering (AML) and Know Your Customer (KYC) checks.
Digital Data: IP addresses, browsing behavior, and cookie data via our digital platforms.

3. Purposes of Processing

We use your personal data strictly for the following operational and legal reasons:

Service Delivery: Managing investment profiles, real estate trusts, and executing financial contracts.
Legal Compliance: Fulfilling statutory financial reporting, AML verification, and tax obligations under Spanish law.
Communication: Sending essential transactional updates, statements, and security alerts.
Marketing: Providing tailored financial insights or offers, subject to your explicit consent.

4. Legal Basis for Processing

We only process data when a valid legal framework applies under Article 6 of the GDPR:

Contractual Necessity: To perform agreements or pre-contractual measures requested by you.
Legal Obligation: To comply with strict Spanish and European financial regulations.
Legitimate Interest: To ensure network security, prevent fraud, and optimize our services.
Consent: When you explicitly opt-in to receive promotional materials or non-essential cookies.

5. Data Retention

We store your data only as long as necessary to fulfill the purposes outlined above:

Active Files: Kept throughout the duration of your contractual relationship with us.
Legal Archives: Blocked and retained for up to 10 years following contract termination to comply with Spanish AML laws (Ley 10/2010 de prevención del blanqueo de capitales).

6. Data Sharing and Third Parties

We do not sell your personal data. We only share information with trusted third parties under strict confidentiality clauses:

Regulatory Bodies: Spanish Tax Agency (AEAT), Bank of Spain, and Sepblac.
Service Providers: Trusted IT hosting, auditing firms, legal advisors, and payment gateways.
Data Transfers: All servers are hosted within the European Economic Area (EEA).

7. Your Privacy Rights

Under European data protection laws, you hold the following rights regarding your data:

Access: Request a copy of all personal data we hold about you.
Rectification: Demand correction of inaccurate or incomplete information.
Erasure («Right to be Forgotten»): Request data deletion when it is no longer needed for legal obligations.
Restriction: Limit how we process your data under specific conditions.
Portability: Receive your data in a structured, machine-readable format.
Objection: Oppose data processing based on legitimate interests or direct marketing.

To exercise these rights, please email your request alongside a copy of your ID/Passport to privacy@vrst.es