Privacy Policy

Last updated: 24 September 2026

Welcome to Aita Ventures. This Privacy Policy outlines how we collect, use, disclose, and protect your personal information, whether we obtain it through this website, from public sources, or from our professional relationship with you. It explains how we treat your data and how you can exercise your rights.

1. Data Controller

Identity: Aita Ventures
Address: Paseo de la Castellana 129, Madrid, Spain
Email: hola@aita.ventures

2. Investor and professional contact database

Aita Ventures maintains a database of investment funds, business angels and professional contacts in the startup ecosystem. It is built from public sources (websites, press, professional directories, public registries and public LinkedIn profiles) and from the professional relationships we maintain.

This section constitutes the information required by Article 14 GDPR for individuals whose data we did not obtain directly from them.

2.1. Purpose and legal basis

We process this data to connect startups with investors whose thesis fits them. The legal basis is the legitimate interest of Aita Ventures (Art. 6.1(f) GDPR) in carrying out its activity as an intermediary between startups and investors. We have balanced that interest against the rights of the individuals concerned: the data is professional in nature, publicly accessible, processed in the same context in which it was made public, and there is a reasonable expectation of receiving professional contact.

2.2. Categories of data

• Name and surname
• Role and organisation
• Professional email and phone number
• Public profile URL (for example, LinkedIn)
• Investment thesis (sectors, stages, tickets, geography)
• History of interactions with Aita Ventures

2.3. Recipients

The startups we work with receive only the name of the investing organisation, never the personal contact details, unless the investor has expressly agreed to be introduced to a specific startup.

2.4. Retention period

We keep this data while the person holds an investment role and for up to 5 years after the last interaction with Aita Ventures. After that period we review the record and delete or anonymise it if there is no reason to keep it.

2.5. Your rights

You may exercise at any time your rights of access, rectification, erasure and objection by writing to hola@aita.ventures. If you object to being contacted, we will not contact you again: we will flag your record so that you receive no further investment proposals or communications, keeping only the minimum data needed to honour that objection.

3. Data processors

To provide our services we use the following providers, which process data on behalf of Aita Ventures under data processing agreements (Art. 28 GDPR):

• Google (Firebase and Google Cloud): web hosting, database, file storage and server functions. Data is hosted in European Union regions (europe-southwest1 — Madrid, and europe-west1 — Belgium).
• Microsoft 365: email and calendar.
• Anthropic: AI text generation through its API. Anthropic does not use our data to train its models.
• Neon: database of our internal management tool (cockpit).
• Holded: invoicing and accounting.
• Google reCAPTCHA Enterprise: protection of our forms against spam and abuse; it processes your IP address and signals from your interaction with the page.
• Google Analytics: measurement of website usage, only if you accept analytics cookies.

Where any of these providers processes data outside the European Economic Area, it does so under the safeguards of Chapter V GDPR (adequacy decision or standard contractual clauses). See section 12.

4. Retention periods

• Contact form: 2 years from receipt of the message.
• Thesis download and other lead magnets: 3 years from the last interaction or until you unsubscribe.
• Startup applications ("Present your startup"): 2 years from receipt, unless a mandate follows, in which case the contractual retention periods apply. This includes the deck and the data submitted, which are analysed with Anthropic's API (see section 5).
• Investor and professional contact database: while the person holds an investment role and up to 5 years after the last interaction, followed by review (see section 2).
• Portal users: for the duration of the contract and 5 years after it ends, for legal obligations and limitation periods.
• Technical logs (Cloud Logging): 30 days.
• Application audit logs: 90 days.
• Cockpit audit log: immutable; when a user is deleted, their data in it is anonymised.
• Portal access logs: 180 days.
• Invoices and accounting records: 6 years (Spanish Commercial Code).

After these periods, data goes to a review list and a member of our team decides on it; it is never deleted automatically. We only keep it if the relationship has been reactivated or there is another legitimate reason, which is documented, and in that case the period starts again from that moment. Otherwise it is deleted or anonymised manually, unless a legal retention obligation or an ongoing claim requires otherwise.

5. Automated decision-making

We use artificial intelligence tools to rank the fit between a startup and the investors in our database and to draft messages. No decision with legal effects or that significantly affects you is made automatically: a member of the Aita Ventures team reviews every outreach before it is sent and decides whether it goes out, to whom, and with what content.

"Present your startup" applications: the deck and the data you submit through this form are analysed with Anthropic's API (United States, under a data processing agreement and without Anthropic using our data to train its models) to prepare Aita Ventures' evaluation. That analysis is only support: the decision on your application is always made by a member of the team.

6. Read tracking

Some governance emails (for example, meeting notices, minutes or documents that require confirmation of reading) are sent from the cockpit platform, which Aita Ventures operates on behalf of each portfolio company. These emails include a personal link and, when you open it, the date and time at which you confirm reading is recorded, solely to evidence that the document was received and read; the record is kept together with the document it refers to.

For this data, the data controller is the portfolio company that sends you the communication, and Aita Ventures acts as its data processor. If you send us a request about this data, we will forward it to that company so that it can handle it.

7. How to exercise your rights

You may exercise your rights of access, rectification, erasure, restriction, portability and objection, and withdraw your consent, by writing to hola@aita.ventures, stating which right you wish to exercise and the email address you used with us. We will respond within one month of receiving your verified request, extendable by two further months in complex cases; if so, we will tell you within the first month and explain why.

If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.

8. Information we collect through the website

8.1. Personal Information

We may collect various types of personal information when you interact with our website:

Contact information:

• Full name
• Email address
• Company
• Phone number (optional)
• Information provided in contact forms and startup application forms

Subscription information:

• Email address to receive updates
• Communication preferences

When you submit any form we ask you to expressly accept this policy; we store the version of the policy you accepted together with your submission.

8.2. Usage Information

We use Google Analytics, only if you accept analytics cookies, to collect information about your interactions with the website:

• IP address (anonymized)
• Browser type and version
• Operating system
• Pages visited and time on site
• Referral source
• Approximate geographic location
• Browsing patterns

8.3. Cookies and Tracking Technologies

We use cookies and similar technologies. For more information, see our Cookie Policy.

9. Legal Basis for Processing

We process your personal data under the following legal bases according to GDPR:

• Consent: When you voluntarily provide your information through forms
• Legitimate interest: To maintain the investor and professional contact database (see section 2), analyze website usage and improve our services
• Contract performance: When you establish a contractual relationship with us
• Legal compliance: When we must comply with legal obligations

10. How We Use Your Information

We use the collected information for the following purposes:

10.1. Service Provision

• Respond to your inquiries and requests
• Provide information about our services
• Manage business relationships
• Process advisory or consulting requests
• Review startup applications and connect them with investors

10.2. Website Improvement

• Analyze and understand user preferences
• Optimize user experience
• Improve website content and functionality
• Develop new services and features

10.3. Communications

• Send updates about our services
• Share relevant content about innovation and technology
• Notify changes to our policies
• Respond to questions or comments

You can unsubscribe from our communications at any time using the link included in every email or by writing to hola@aita.ventures.

10.4. Legal Compliance

• Comply with legal and regulatory obligations
• Protect our legal rights
• Prevent fraud and illegal activities

11. Information Disclosure

11.1. We Do Not Sell Your Data

We do not sell, rent, or share your personal information with third parties for marketing purposes.

11.2. Limited Sharing

We may share your information in the following circumstances:

Data processors: the providers listed in section 3, which process data on our behalf and under our instructions.

Startups and investors: as described in section 2 (startups receive only the name of the investing organisation).

Legal requirements:

• When required by law
• To protect our legal rights
• In response to valid legal processes

Business transactions:

• In case of merger, acquisition, or asset sale (with prior notification)

12. International Data Transfers

Some of our service providers may be located outside the European Economic Area (EEA). In these cases:

• We ensure appropriate safeguards are in place (adequacy decision or standard contractual clauses)
• Google Analytics complies with the EU-U.S. Data Privacy Framework
• We take measures to protect your data according to GDPR standards

13. Data Security

We implement appropriate technical and organizational security measures to protect your personal information:

• SSL/TLS encryption for data transmissions
• Restricted access to personal information
• Certified provider security protocols
• Access and audit logs (see retention periods in section 4)
• Regular security reviews

However, no Internet transmission is completely secure. You provide information at your own risk.

14. Your Rights

Under GDPR and Spanish data protection legislation, you have the following rights:

14.1. Right of Access

You can request a copy of the personal data we hold about you.

14.2. Right to Rectification

You can request correction of inaccurate or incomplete data.

14.3. Right to Erasure

You can request deletion of your personal data in certain circumstances. See our Data Deletion Policy.

14.4. Right to Restriction of Processing

You can request that we restrict processing of your data in certain situations.

14.5. Right to Data Portability

You can request to receive your data in a structured, commonly used format.

14.6. Right to Object

You can object to processing of your data based on legitimate interests, including the professional outreach described in section 2.

14.7. Right to Withdraw Consent

You can withdraw your consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, follow the instructions in section 7.

15. Children's Privacy

Our website is not directed at individuals under 16 years of age. We do not knowingly collect personal information from minors. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.

16. External Links

Our website may contain links to external sites, including social media platforms. We are not responsible for the privacy practices or content of these external sites. We recommend reviewing their respective privacy policies.

17. Changes to this Privacy Policy

We may update this Privacy Policy periodically. The "Last updated" date at the beginning of the policy will indicate the latest revision. Your continued use of the website after any changes signifies your acceptance of the updated Privacy Policy.

We will notify you of significant changes through:

• A prominent notice on our website
• An email (if we have your email address)

18. Complaints

If you believe we have violated your data protection rights, you have the right to file a complaint with the supervisory authority:

Spanish Data Protection Agency (AEPD)
C/ Jorge Juan, 6
28001 Madrid, Spain
Website: www.aepd.es

19. Privacy Contact Information

If you have questions, comments, or concerns about this Privacy Policy or our data practices, contact us:

Aita Ventures
Email: hola@aita.ventures
Address: Paseo de la Castellana 129, Madrid, Spain