Privacy policy

The binding version of this policy is the Spanish one. This English text is provided for convenience.

1. Who is the data controller?

This Privacy Policy explains how the personal data of people who access or use the ALIVIO platform, and of those who deal directly with ALIVIO, is processed.

Where ALIVIO determines the purposes and means of processing personal data, the controller is:

• ALIVIO Asset Management, S.L.
• NIF: [pending]
• Registered office: [pending]
• Privacy email: privacidad@alivioasset.com

Hereinafter, “ALIVIO”.

In certain services — especially where ALIVIO manages information entered into the Platform by a developer, builder, asset manager, professional owner or other client — ALIVIO may act as a processor on behalf of that Client. This distinction is explained below.

2. When does ALIVIO act as controller and when as processor?

The Platform may contain personal data processed under two different situations.

A. ALIVIO as controller

ALIVIO acts as controller when it decides why and how to process certain personal data. This may occur, among other cases, to:

• create and administer user accounts;
• identify Authorised Users;
• manage access to the Platform;
• ensure account security;
• keep security and activity logs;
• manage the contractual relationship with its clients;
• manage billing and administration;
• handle queries addressed directly to ALIVIO;
• manage communications relating to the operation of the service;
• prevent fraudulent or abusive use;
• comply with legal obligations;
• and bring, exercise or defend claims.

These processing activities are governed by this Privacy Policy.

B. ALIVIO as processor

In other cases, personal data is entered or processed in ALIVIO on behalf of the company or organisation that has contracted the Platform. For example, a developer may use ALIVIO to manage the issues of owners of a development. In these cases, that organisation determines the purposes of the processing and is normally the controller, while ALIVIO processes the information following its instructions as processor. This may affect data relating to owners or buyers; properties; issues; photographs; documentation; suppliers; actions; quotes; signatures; sign-offs; and communications relating to an issue.

Where ALIVIO acts only as processor, requests relating to such data should generally be addressed to the relevant controller. If ALIVIO directly receives a request relating to data processed on behalf of one of its clients, it may forward it to the relevant controller for handling.

3. What personal data may we process?

The data will depend on each person’s relationship with ALIVIO and the functionalities they use.

3.1. Identification data

Name and surname; user identifier; company or organisation; position; profile or role within the Platform.

3.2. Contact data

Email; phone; business address; and other data necessary to manage communications.

3.3. Access and account data

Account identifier; role; permissions; assigned projects; account status; registration date; and other information necessary to manage access.

Passwords must be stored using appropriate technical security mechanisms and will not be accessible in legible text by ALIVIO where the technology architecture used allows such mechanisms.

3.4. Activity and traceability data

ALIVIO may record certain actions performed on the Platform, including accesses; issue creation; modifications; status changes; assignments; document uploads; photographs; quotes; actions; signatures; sign-offs; date and time; and the user responsible for the action. These logs help ensure the security and traceability of the service.

3.5. Property-related data

Depending on the User’s function: address; development; building; dwelling; premises; element; common areas; and the User’s relationship with the property.

3.6. Issues and actions

The Platform may contain issue descriptions; observations; photographs; communications; actions taken; assigned suppliers; quotes; documentation; status; dates; and other information necessary for their management.

3.7. Photographs

ALIVIO may process photographs relating to dwellings, common areas, construction elements, installations, defects, issues, visits, repairs and actions. Users must avoid including images of people, personal documents or other private elements where not necessary to document the relevant action.

3.8. Signatures and sign-offs

Where these functionalities are enabled we may process: the signer’s identity; signature; date and time; related issue or action; associated document; expressed sign-off; and technical evidence necessary to record the action.

4. Do we process special categories of data?

ALIVIO is not designed to routinely process special categories of personal data. Therefore, Users must not unnecessarily enter information relating to health; racial or ethnic origin; political opinions; religious or philosophical beliefs; trade-union membership; genetic data; biometric data intended to uniquely identify a person; sex life; or sexual orientation.

Where an issue could indirectly reveal such information, Users must provide only the strictly necessary information.

5. What do we use the data for?

Where ALIVIO acts as controller, it may process data for the following purposes.

A. Manage accounts and access to ALIVIO: create accounts; identify Users; assign profiles; manage access; authenticate Users; administer permissions; manage registrations and deregistrations.

B. Provide and administer the Platform: enable the operation of the functionalities available to each User and maintain the relationship with our clients.

C. Security and traceability: ensure security; prevent improper access; investigate incidents; prevent fraud; maintain the integrity of the information; evidence certain actions performed via the Platform.

D. Support: handle queries, technical problems and requests relating to the operation of ALIVIO.

E. Contractual, administrative and financial management: manage contracts, quotes, billing, collections, accounting, suppliers and other administrative processes.

F. Legal compliance: process or retain certain information where necessary to comply with legal obligations.

G. Claims and legal defence: retain and use information where necessary to bring, exercise or defend claims.

6. What is the legal basis?

The legal basis depends on each processing activity.

• Performance of a contract or pre-contractual measures: where the User is directly party to a contractual relationship with ALIVIO and the processing is necessary to provide the service.
• Legitimate interest: for processing necessary to ensure the security of the Platform, prevent abusive use, keep certain activity logs, adequately manage professional relationships and defend against claims. ALIVIO will ensure such processing does not unjustifiably override the rights and freedoms of data subjects.
• Compliance with legal obligations: where ALIVIO must process or retain information by legal requirement.
• Consent: where a processing activity specifically requires it, it will be requested separately, specifically and in an informed manner.

Acceptance of ALIVIO’s Conditions of Use does not constitute general consent for all personal data processing.

7. Is it mandatory to provide the data?

Certain data is necessary to create an account and use the Platform. If the User does not provide the essential information, they may not be able to access certain functionalities. Mandatory fields may be identified during the relevant process.

8. Where do we obtain the data?

Data may be provided directly by the User; by the company or organisation requesting their registration; by the Client using ALIVIO; by another authorised User within the project; or generated as a result of using the Platform. For example, a developer may provide an owner’s email to enable their access to a development.

9. Who may we share the data with?

ALIVIO does not sell the personal data processed via the Platform. Data may be accessible, where necessary, by:

A. Users participating in the project: according to the relevant permissions and functions, certain information may be accessible by Administrators, Managers/Technicians, Owners, Suppliers and other duly authorised profiles. Access is limited by the permissions set for each role.

B. Technology providers: ALIVIO may use providers necessary to operate the Platform (cloud infrastructure, hosting, storage, databases, communications, email, support, security, backups, monitoring). Where such providers process personal data on behalf of ALIVIO they are subject to the corresponding contractual data-protection obligations.

C. Public administrations and authorities: where there is a legal obligation or a legitimate request from judicial bodies, law-enforcement agencies, administrative authorities, data protection authorities or other competent bodies.

10. Suppliers and access to owners’ data

Where a supplier is assigned an action, they may access the data strictly necessary to manage it. This may include, where necessary: address; information about the issue; photographs; documentation; contact data; availability; and communications relating to the action.

Such access does not authorise the supplier to use the data for its own commercial purposes. Suppliers are subject to the applicable Conditions of Use, Confidentiality and Authorised Use of the Platform.

11. International transfers

ALIVIO will endeavour to use providers that keep data within the European Economic Area (EEA) where reasonably possible. However, certain technology providers may involve international data transfers.

Where transfers outside the EEA occur, ALIVIO will apply the mechanisms provided for by law, such as adequacy decisions; standard contractual clauses approved by the European Commission; or other legally recognised safeguards. Where necessary, additional measures will be applied depending on the nature of the transfer.

12. How long do we keep the data?

Data is kept for as long as necessary for the purpose for which it was collected.

• User account: while the User retains access to ALIVIO and thereafter for the time necessary to address possible liabilities.
• Security and traceability logs: for the period necessary to ensure security, maintain traceability of actions and address possible claims.
• Contractual and financial data: for the periods required by tax, commercial and other applicable law.
• Data processed on behalf of Clients: in accordance with the Client’s instructions and the corresponding Data Processing Agreement.

Once applicable periods end, data is deleted or anonymised, unless it must remain blocked to address legal liabilities.

13. What rights do you have?

Where ALIVIO is the controller, the data subject may exercise the rights recognised by data protection law. In particular, they may request: access to their data; rectification of incorrect data; erasure where applicable; objection to certain processing; restriction of processing; portability where applicable.

Where processing is based on consent, it may be withdrawn at any time, without affecting the lawfulness of processing carried out previously.

14. How can you exercise your rights?

Requests may be addressed to:

• Email: privacidad@alivioasset.com
• Postal address: [pending]

The request must allow the data subject to be adequately identified and specify the right to be exercised. ALIVIO may request additional information where reasonably necessary to verify the requester’s identity. Exercising rights is free of charge, except in the cases legally provided.

15. What if the data belongs to a Client’s project?

If the request relates to information that ALIVIO processes exclusively on behalf of a developer, builder, asset manager or other Client, the controller is normally that organisation. In that case, ALIVIO may inform the data subject of this; forward the request to the controller; and cooperate with it to address the request.

16. Complaints to the data protection authority

If the data subject considers that their personal data has not been processed correctly, they may lodge a complaint with the competent supervisory authority. In Spain, the supervisory authority is the Spanish Data Protection Agency (AEPD). The data subject may also contact ALIVIO before lodging a complaint so that we can review the matter raised.

17. Security

ALIVIO will take appropriate technical and organisational measures to protect personal data against unauthorised access; loss; alteration; destruction; improper disclosure; or unlawful processing. Measures will be adapted to the risks associated with the processing and to the technological evolution of the Platform. Users must cooperate by keeping their credentials protected and reporting any possible security incident.

18. Automated decisions

ALIVIO does not generally make solely automated decisions that produce legal effects on Users or similarly significantly affect them. The automation of administrative tasks — such as notifications, reminders, proposed assignments, automatic display changes or report generation — does not in itself constitute an automated decision with such effects. If functionalities involving relevant automated decisions are added in the future, the legally required information will be provided.

19. Commercial communications

Creating an ALIVIO account does not automatically imply authorisation to receive commercial communications. Where ALIVIO wishes to send commercial communications requiring consent, it will request such consent separately. Communications necessary for account operation, security, issues, actions, relevant service changes or management of the contractual relationship are not commercial communications where their purpose is strictly operational or contractual.

20. Minors

ALIVIO is a platform intended for the professional management of real estate assets and is not directed at minors. Accounts must not be created for minors unless there is a legitimate need, it is legally appropriate and it has been previously authorised in the context of the relevant service.

21. Links and third-party services

The Platform may include links or integrations with third-party services. Where the User leaves ALIVIO or uses a service operated directly by a third party, the processing carried out by that third party is governed by its own terms and privacy policies.

22. Changes to this Privacy Policy

ALIVIO may update this Policy as a result of regulatory changes; changes to the Platform; the addition of new functionalities; changes to processing; or changes of technology providers. Where changes are significant, Users will be informed by appropriate means. The current version will be permanently accessible from ALIVIO.

ALIVIO Asset Management, S.L. · NIF: [pending] · Address: [pending] · Privacy: privacidad@alivioasset.com · Version: August 2026.