Privacy policy

This English version is a courtesy translation provided for convenience; the legally binding version of this document is the Spanish original.

1. Information for the user

Who is the controller of your personal data?

SHELLMENT, S.L. is the CONTROLLER of the USER's personal data and informs you that this data will be processed in accordance with Regulation (EU) 2016/679 of 27 April (GDPR) and Organic Law 3/2018 of 5 December (LOPDGDD).

What do we process your personal data for and what is the legal basis of the processing?

Depending on the form where we obtained your personal data, we will process it confidentially to achieve the following purposes:

Management of our platform

• User registration. The data obtained during user registration will be processed in order to provide you with personalised access to the SHELLMENT platform and the services it offers. The legal basis of this processing is the data subject's consent.
• Intermediation. Managing the publication of assets or financial-real estate products and connecting users with the owners. Based on a contractual relationship to which the data subject is a party.
• Identity Verification and KYC (Know Your Customer) Processes. Collecting, verifying and cross-checking the identification data and documentation provided in order to comply with the regulations in force on the prevention of money laundering and terrorist financing, as well as the supervision requirements of the financial and real estate sector. The legal basis of the processing is the legal obligations applicable to the controller.
• Real estate tokenisation. Through the generation of identifiers, tokenised representations of the transactions will be made using blockchain technology in order to guarantee the immutability, traceability, certified date and integrity of the purchase process of the share in the real estate asset. Privacy by Design techniques will be applied, ensuring that directly identifying personal data is processed exclusively off-chain (Off-Chain), being associated with the blockchain network only through pseudonymised data in order to preserve the rights of erasure and restriction of processing where legally applicable.
• Security and fraud prevention. Monitoring the correct functioning of the website, verifying the authenticity of accesses (through verification codes or credentials), preventing unauthorised access and detecting possible fraudulent uses. Based on the legitimate interest of the controller and the legal obligation to guarantee data security.
• Sending commercial information. Sending newsletters or real estate asset alerts, provided that you have expressly authorised it or there is a prior contractual relationship. This processing is based on the consent given by the data subject or on the legitimate interest of the controller when there is a prior contractual relationship with the recipient of the communications.

On the Contact form

• Responding to queries or any type of request made by the user through any of the contact methods made available on the controller's website (based on the legitimate interest of the controller).
• Sending advertising commercial communications by e-mail, fax, SMS, MMS, social networks or any other electronic or physical means, present or future, that enables commercial communications. These communications will be made by the controller and will be related to its products and services, or those of its collaborators or suppliers with whom it has reached a promotion agreement. In this case, third parties will never have access to the personal data (based on the data subject's consent).
• Carrying out statistical analyses and market studies (based on the legitimate interest of the controller).

On the Newsletter form

• Sending information newsletters, news, offers and online promotions (based on the data subject's consent).

How long will we keep your personal data?

They will be kept for no longer than necessary to maintain the purpose of the processing or where there are legal prescription periods that dictate their custody, and when they are no longer necessary for this purpose, they will be deleted with appropriate security measures to guarantee the anonymisation of the data or their total destruction. When the data is no longer necessary to achieve the intended purpose, it will be blocked in accordance with current regulations, at the disposal of the Courts, Public Administrations or supervisory bodies during the limitation periods required by tax, commercial and anti-money laundering legislation.

Who do we disclose your personal data to?

Your personal data will not be transferred or communicated to third parties unless it is essential for the execution of the operations carried out through our platform, the fulfilment of legal obligations enforceable against our entity, or the correct functioning of the technologies applied. Specifically, the following data communications are foreseen:

• To the securities agent, in order to manage the financial intermediation, the transmission of orders or the acquisition of products or financial instruments linked to the real estate assets offered on the platform.
• To the Public Limited Company Owning the Asset, in order to transmit the data of the investors who have acquired shares in the real estate asset, in order to carry out the formalisation of the shareholders' register and the corresponding corporate management.
• To Public Authorities and Official Bodies such as the Executive Service of the Commission for the Prevention of Money Laundering and Monetary Offences (SEPBLAC) or the Spanish National Securities Market Commission (CNMV), when there is a legal obligation.
• To Blockchain technology providers, in order to transmit or record the data on the blockchain network. However, in order to respect the principles of data minimisation and protection by design (Privacy by Design), the user's identifying data will be kept off-chain (Off-Chain) and will not be publicly exposed on the blockchain network.

What are your rights?

The rights of the USER are:

• Right to withdraw consent at any time.
• Right of access, rectification, portability and erasure of your data, and of restriction of or objection to its processing.
• Right to lodge a complaint with the supervisory authority (www.aepd.es) if you consider that the processing does not comply with current regulations.

Contact details to exercise your rights:
SHELLMENT, S.L. Paseo de la Castellana, 194 - 28046 Madrid (Madrid). E-mail: dpo@shellment.com

2. Mandatory or optional nature of the information provided by the user

USERS, by ticking the corresponding boxes and entering data in the fields marked with an asterisk (*) in the contact form or presented in download forms, expressly and freely and unequivocally accept that their data is necessary to deal with their request by the provider, the inclusion of data in the remaining fields being voluntary. The USER guarantees that the personal data provided to the CONTROLLER is truthful and is responsible for communicating any modification thereof.

The CONTROLLER informs that all data requested through the website is mandatory, as it is necessary for the provision of an optimal service to the USER. If all the data is not provided, it is not guaranteed that the information and services provided will be completely tailored to your needs.

3. Security measures

In accordance with the provisions of the current regulations on personal data protection, the CONTROLLER is complying with all the provisions of the GDPR and LOPDGDD regulations for the processing of personal data under its responsibility, and manifestly with the principles described in article 5 of the GDPR, whereby they are processed lawfully, fairly and transparently in relation to the data subject and adequately, relevantly and limited to what is necessary in relation to the purposes for which they are processed.

The CONTROLLER guarantees that it has implemented appropriate technical and organisational policies to apply the security measures established by the GDPR and the LOPDGDD in order to protect the rights and freedoms of USERS and has communicated to them the appropriate information so that they can exercise them.

For more information about privacy guarantees, you can contact the CONTROLLER through SHELLMENT, S.L. Paseo de la Castellana, 194 - 28046 Madrid (Madrid). E-mail: dpo@shellment.com