This Privacy Policy describes how Onada Ventures collects, uses and protects personal data provided by users of onadaventures.com (the “Website”), in accordance with Regulation (EU) 2016/679 (“GDPR”) and Spanish Organic Law 3/2018 on Data Protection and Guarantee of Digital Rights (“LOPDGDD”).

1. Data Controller

• Identity: Onada Ventures (company in the process of incorporation; until incorporation is completed, the data controller is [FULL NAME OF PROMOTER], acting on behalf of the company being formed).
• Tax ID (NIF/CIF): Pending assignment — to be updated upon incorporation.
• Address: Carrer Constitució 2, 1º, 08960 Sant Just Desvern, Barcelona, Spain.
• Email: info@onadaventures.com.
• Data Protection Officer (DPO): Not applicable. Onada Ventures is not required to appoint a DPO under Article 37 GDPR given the nature and scale of its data processing activities. This will be reassessed as the company grows.

2. What Personal Data We Collect

We collect personal data that you voluntarily provide to us through the startup submission form available on the Website. This may include:

• Contact details: full name, email address and, where provided, phone number;
• Professional information: company or project name, role, project or business description;
• Materials voluntarily submitted: pitch decks, presentations, website links, social media profiles or other documents you choose to attach;
• Any other information you choose to include in your submission.

We do not knowingly collect special categories of data (Article 9 GDPR) through this form, and we ask that you do not include such information, or confidential/trade-secret information, unless a non-disclosure agreement has been signed, as set out in our Terms of Use.

3. Purposes of Processing

We process your personal data for the following purposes:

• To review and evaluate startup submissions received through the Website;
• Where your submission is selected, to share it — including your contact details and pitch materials — with potential private investors for their independent evaluation, as described in our Terms of Use;
• To contact you regarding your submission, including to request additional information or to communicate a decision;
• To maintain records of submissions received for internal organisational and reporting purposes;
• To comply with applicable legal obligations.

4. Legal Basis for Processing

The legal basis for processing your personal data is your consent, given by voluntarily submitting your information through the form (Article 6.1.a GDPR), and, in relation to the evaluation and management of the submission, our legitimate interest in assessing potential venture-building and advisory opportunities (Article 6.1.f GDPR), which we have determined does not override your fundamental rights and freedoms. You may withdraw your consent at any time, without affecting the lawfulness of processing carried out prior to such withdrawal.

5. Data Retention

We retain personal data collected through submissions for as long as necessary to evaluate the submission and, where relevant, to maintain a record of the interaction, and in any case for no longer than [RETENTION PERIOD, e.g. 24 months] from the date of submission, unless a longer retention period is required to comply with a legal obligation or to establish, exercise or defend legal claims. If you request the deletion of your data before this period, we will comply with your request in accordance with Section 8 below.

6. Recipients of Your Data

Your personal data will not be sold, nor shared with third parties for their own independent marketing purposes. Your data may be shared with or accessed by:

• Potential private investors, where your submission is selected by Onada Ventures for introduction. This is the core purpose for which the submission form exists: if selected, your contact details and the materials you submitted (including your pitch deck) will be shared directly with one or more prospective investors so that they can independently evaluate your project. Onada Ventures does not control what the investor subsequently does with this information, and recommends that Users agree confidentiality terms directly with any investor before sharing sensitive information beyond what was included in the original submission;
• Service providers acting as data processors on our behalf, such as website hosting providers, email service providers, and cloud storage or productivity tools used to manage submissions (e.g. [NAME HOSTING PROVIDER], [NAME EMAIL/CLOUD PROVIDER]);
• Members of the Onada Ventures team involved in evaluating submissions;
• Public authorities, where required by law.

Where third-party service providers process personal data on our behalf, we enter into data processing agreements with them in accordance with Article 28 GDPR. Potential investors receiving your data act as independent data controllers with respect to their own subsequent processing of it, and are not Onada Ventures’ data processors.

7. International Data Transfers

Some of the service providers referred to above may be located outside the European Economic Area (EEA), in particular in the United States. Where this is the case, we ensure that such transfers are subject to appropriate safeguards, such as an adequacy decision by the European Commission or Standard Contractual Clauses approved by the European Commission, together with any additional measures required to ensure a level of protection equivalent to that guaranteed within the EEA. You may request further information about these safeguards by contacting us at info@onadaventures.com.

8. Your Rights

You have the right to:

• Access your personal data and obtain confirmation as to whether we are processing it;
• Request rectification of inaccurate or incomplete data;
• Request erasure of your data where, among other reasons, it is no longer necessary for the purposes for which it was collected;
• Request restriction of processing in certain circumstances;
• Object to processing based on our legitimate interest;
• Request portability of your data, where technically feasible;
• Withdraw your consent at any time, without affecting the lawfulness of prior processing.

To exercise these rights, please contact us at info@onadaventures.com, attaching a copy of your ID or an equivalent document to verify your identity. You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), www.aepd.es, if you consider that the processing of your personal data infringes applicable regulations.

9. Security Measures

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including measures to protect personal data against unauthorised access, loss, alteration or disclosure.

10. Cookies

This Website currently uses only technical/necessary cookies required for its basic functioning. If, in the future, analytics, marketing or other non-essential cookies are implemented, this Website will request your prior consent through a cookie banner and provide full details in a dedicated Cookie Policy, available at [LINK TO COOKIE POLICY].

11. Minors

The Website and its services are directed at professionals and entrepreneurs and are not intended for use by individuals under the age of 16. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us so that we can take appropriate action.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable legal requirements. The updated version will be published on the Website with a revised “Last updated” date.

13. Contact

For any queries regarding this Privacy Policy or the processing of your personal data, please contact us at info@onadaventures.com.