Data Deletion Policy

Last updated: 24 September 2026

This policy explains how you can request the erasure of your personal data processed by Aita Ventures (website forms, downloads, startup applications, the investor and professional contact database, and the client portal), in compliance with the General Data Protection Regulation (GDPR) and Spanish legislation. It complements our Privacy Policy.

1. Your right to erasure

You have the right to have your personal data erased when:

• It is no longer necessary for the purposes for which it was collected
• You withdraw the consent on which processing was based and there is no other legal basis
• You object to processing based on legitimate interest (for example, to being contacted as an investor) and there are no overriding legitimate grounds
• The data has been unlawfully processed
• It must be erased to comply with a legal obligation

2. How to request erasure

Write to hola@aita.ventures with the subject "Data erasure request" and include:

• Your full name
• The email address (or phone number) you used with us
• Which data you want erased (or "all")
• Whether you also want us never to contact you again

If your only goal is to stop receiving emails, you do not need to request erasure: use the unsubscribe link included in every email we send you.

2.1. Identity verification

To protect your data, before erasing it we check that the request comes from the data subject. Writing from the registered email address is normally enough; if that is not possible, we will ask for additional information. If you act on behalf of someone else, we will need proof of your authority.

3. Timeline and response

We will respond within one month of receiving your verified request, extendable by two further months in complex cases; if so, we will tell you within the first month and explain why.

When done, we will confirm which data has been erased and, if we have kept any, which and why (see section 4).

4. What we keep for legal reasons

Some data cannot be erased immediately:

• Invoices and accounting and tax records: 6 years (Spanish Commercial Code and tax law).
• Data needed to establish, exercise or defend legal claims for as long as the applicable limitation period runs.
• The minimum data needed to honour your objection: if you ask us not to contact you again, we keep only your email address (or an equivalent identifier) on a suppression list so that we do not. If we erased it completely, we could re-add you from a public source without knowing you had objected.
• Technical and audit logs for their retention periods: technical logs (Cloud Logging), 30 days; application audit logs, 90 days; portal access logs, 180 days. The cockpit audit log is immutable: when a user is deleted, their data in it is anonymised.

This data is blocked: it is used only for the purpose that requires keeping it and is erased when the period expires.

5. Scope of erasure

Erasure covers every system where we process your data:

• Contact form, download and startup application records
• The investor and professional contact database
• Accounts and data in the client and investor portal
• Email and our internal management tool (cockpit)
• Data processors that handle your data on our behalf (we forward the request to them)
• Backup copies, in the next rotation cycle

We may keep aggregated, anonymised statistics that do not identify you.

6. Other rights

Besides erasure, you may exercise your rights of access, rectification, restriction, portability and objection, and withdraw your consent, by writing to hola@aita.ventures. See the "How to exercise your rights" section of the Privacy Policy.

7. Complaints

If you are not satisfied with how we handled your request, you may lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es (C/ Jorge Juan, 6, 28001 Madrid, Spain).

8. Contact

Aita Ventures
Email: hola@aita.ventures
Address: Paseo de la Castellana 129, Madrid, Spain