Privacy Policy
1. Introduction
By means of this document, AtZ Investment Partners S.L. (hereinafter, ‘AtZ’), as owner of the website atzinvestmentpartners.com and atzinvestment.com, informs about its personal data protection policy, in accordance with Regulation (EU) 2016/679 (RGPD) and Organic Law 3/2018 (LOPD-GDD).
The objective is that you, freely and voluntarily, decide whether you wish to provide your personal data when browsing our website or interacting with any type of communication you receive by us about our opportunities and/or our services. Likewise, AtZ reserves the right to modify this Privacy Policy to adapt it to new developments, legislative or jurisprudential, as well as industry/consumer practices.
2. Data Controller
2.1. Identification:
- Company name: AtZ Investment Partners S.L.
- Tax ID: B-87642955
- Registered address: Calle Poeta Joan Maragall 23, CP 28020, Madrid, Spain
- Main website: atzinvestmentpartners.com
- Contact email: admon@atzinvestment.com
- Contact phone: (+34) 676 22 71 06
2.2. AtZ, as the data controller (hereinafter, the “Controller”), informs you that your data will be processed in accordance with Regulation (EU) 2016/679 of April 27, 2016 (GDPR) on the protection of natural persons with regard to the processing of personal data and the recent Organic Law 3/2018 of December 5 (LOPD-GDD) on the protection of personal data and the guarantee of digital rights.
3. Information and Data Processed
Personal identification data (first name + last name), company, and contact information, where applicable (address, phone number, and email address). Details of your corporate preferences regarding debt services and/or M&A and/or Capital Raising, as well as the sending of opportunities in the territories where AtZ Investment Partners S.L. operates.
4. Intended Processing Operations
4.1. AtZ will collect and process your data in the following situations:
- When you browse this Website using informed cookies.
- When you interact with us on social media, blogs, etc.
- When you contact us by other means such as phone, email, postal mail, or fax.
- When you complete any form on this Website or participate in a survey.
- When you register to use any of our additional services/Demos, trials, etc.
- When you schedule a meeting with the AtZ team.
5. Intended Purposes of Processing
The data we collect in the aforementioned processing operations is used for the following purposes:
- Respond to your questions, concerns, or inquiries, and process your requests, including payment transactions.
- Provide customer support.
- Send you commercial communications about our services that you have previously requested.
- Respond to the exercise of the rights recognized under Regulation (EU) 2016/679 of April 27, 2016 (GDPR) and Organic Law 3/2018 (LOPD-GDD), as well as to inquiries and complaints.
- Manage job applications/CVs received for potential open positions at AtZ.
- Send newsletters or other commercial communications regarding services or transactions offered by AtZ.
6. What Personal Data Do We Process?
6.1. In the forms mentioned, you may provide, among others, the following personal data:
- Your name, surname, company, and contact information (address, phone numbers, and email).
- Other contact details and preferences.
- We collect your data if you contact us through the Website.
6.2. If you provide us with your personal data, it must be accurate, and you must notify AtZ of any changes. You are responsible for the accuracy of the data provided. The person providing personal data to AtZ declares to be of legal age and fully responsible for such declaration.
7. Description of Processing Activities
7.1. Sending advertising or promotional communications via email, SMS, WhatsApp, social media, or any other electronic or physical means, present or future, that allows for commercial communications. These will be sent by the AtZ Investment Partners S.L. team and may be related to AtZ’s services, or those of our collaborators or providers with whom we have established promotional agreements.
7.2. Actions requested by the user: To process requests or any type of request regarding the services offered by AtZ, whether made by you through any of the contact channels made available to you.
7.3. Data stored during your visit: When you access AtZ’s websites, our web servers may store, among other things, information about the browser and operating system used, the website from which you visited us, the pages you visit on our site, and the date of your visit. For security reasons—such as detecting potential attacks—your IP address may also be stored for seven days. Except for the IP address, personal data is only stored if you voluntarily provide it (e.g., registration, survey, customer registration, marketing). AtZ uses this data for technical administration of our CRM, customer management, service evaluation, and marketing purposes, only to the necessary extent and always with prior notice.
7.4. Newsletter subscription: If you subscribe to any of our current or future newsletters, you consent to your personal data being used for advertising and marketing.
8. Data Retention Criteria
8.1. In general, the data provided will be retained as long as there is mutual interest in maintaining the purpose of the processing. Once the data is no longer necessary for that purpose, it will be securely deleted or pseudonymized.
8.2. In particular, your personal data will be retained based on the following criteria:
- Legal obligation for data retention.
- Duration of the contractual relationship and management of any responsibilities arising from it.
- Request for deletion by the data subject when applicable.
8.3. Notable exceptions to this general rule include:
- Aggregated data: retained indefinitely without a specific deletion date.
- AtZ client data: retention period of 4 years (per Art. 66 et seq. of the Spanish General Tax Law), or 6 years (per Art. 30 of the Commercial Code regarding accounting records and invoices).
- Newsletter subscription data: retained from the moment consent is given until it is withdrawn.
- Job applicant data: resumes may be retained for up to two years for future hiring processes unless the candidate requests otherwise.
9. Data Disclosure
9.1. AtZ may share your personal data with:
- Companies, entities, or other organizations contracted by AtZ to provide services such as hosting, marketing, market research, and information society services.
- Professional service providers such as lawyers, notaries, registrars, or similar professionals, when necessary.
- Public bodies, courts, regulators, or other administrative authorities when required to comply with legal or regulatory obligations, or for the defense of rights, prevention of fraud, or for public safety or protection.
- Any third party that acquires, or to whom we transfer, all or a substantial portion of our business and assets. In the event of such a sale or transfer, we will make reasonable efforts to ensure that the receiving party uses your data in accordance with this Privacy Policy.
In all such cases, your data will only be used for purposes consistent with this Privacy Policy and proper agreements or contractual clauses will be signed (e.g., Standard Contractual Clauses), applying security measures equal to or similar to those implemented by AtZ.
9.2. International Data Transfers
On July 10, 2023, the European Commission adopted a new adequacy decision enabling the international transfer of personal data between EU entities and those in the United States under the EU-U.S. Data Privacy Framework. This decision follows the Court of Justice of the European Union’s (CJEU) Schrems II ruling of July 16, 2020, which challenged the legality of such transfers due to U.S. surveillance practices and lack of redress mechanisms for EU citizens.
The new adequacy decision confirms that the U.S. ensures a level of protection equivalent to the EU’s—but only for organizations certified under the EU-U.S. Data Privacy Framework.
Therefore, personal data can flow securely from the EU to participating U.S. organizations without requiring additional safeguards.
For other transfers to the U.S., additional legal mechanisms such as Standard Contractual Clauses or Binding Corporate Rules will still be required. A “Transfer Impact Assessment” may also be necessary if the transfer falls outside the Framework.
10. Legal Basis for Data Processing
10.1. As a general rule, before processing personal data, AtZ obtains the explicit and unequivocal consent of the data subject through informed consent clauses in all relevant data collection systems (e.g., application downloads, service contracts), or based on the client’s legitimate interest.
10.2. However, the legal bases for processing also include:
- When processing is necessary for the execution of a License Agreement or pre-contractual measures.
- When data processing is required to satisfy our legitimate interests or those of our partner companies.
- When necessary to comply with applicable legal or regulatory obligations in the sector (e.g., consumer protection, commercial regulations).
- When necessary to protect a vital interest or comply with a legal requirement.
- When we have your explicit consent (e.g., for cookies or technical data collection).
- When you interact with our social media profiles, your data is processed according to the contractual relationship and the privacy policy of the respective network: LinkedIn: AtZ LinkedIn
11. Recognized Rights
These are your rights as a data subject:
- Right of access: You have the right to obtain confirmation from the company as to whether or not your personal data is being processed. AtZ will, where applicable, provide a copy of the personal data being processed.
- Right to rectification: You have the right to obtain, without undue delay, the correction of inaccurate personal data concerning you. Considering the purposes of the processing, you have the right to have incomplete personal data completed, including by providing a supplementary statement.
- Right to erasure (“right to be forgotten”): You have the right to have your personal data deleted without undue delay where one of the following applies:
- The data is no longer necessary for the purposes for which it was collected or otherwise processed;
- You withdraw consent and there is no other legal ground for processing;
- You object to the processing and there are no overriding legitimate grounds;
- Your data has been unlawfully processed;
- The data must be erased to comply with a legal obligation;
- The data was collected in relation to the offer of information society services to children under the age of 16.
- Right to restriction of processing: When processing is restricted at your request, the data may only be processed, except for storage, with your consent or for the establishment, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest. You have the right to restrict processing if:
- You contest the accuracy of the data, for a period enabling AtZ to verify it;
- The processing is unlawful and you oppose erasure and request restriction instead;
- AtZ no longer needs the data for processing purposes, but you require it for legal claims;
- You have objected to processing while it is verified whether AtZ’s legitimate grounds override yours.
- Right to data portability: You have the right to receive the personal data you have provided to us, in a structured, commonly used, and machine-readable format, and to transmit it to another controller, where:
- The processing is based on your consent; and
- The processing is carried out by automated means.
- Right to object: You may object at any time, on grounds relating to your particular situation, to the processing of your data based on public interest or legitimate interest. If the processing is for direct marketing, you have the right to object at any time, and your data will no longer be used for such purposes.
You may withdraw your consent at any time, in the same easy manner in which it was given.
You also have the right to file a complaint with the competent supervisory authority—usually the Spanish Data Protection Agency (AEPD). For more information, visit: www.aepd.es.
Finally, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or significantly affects you in a similar way.
12. Contact Information for Exercising Your Rights
In accordance with Articles 37 and following of Regulation (EU) 2016/679 and Organic Law 3/2018 (LOPD-GDD), AtZ has designated an internal data protection officer. You may contact us at:
- Address: Calle Poeta Joan Maragall 23, CP 28020 Madrid, Spain
- Email: admon@atzinvestment.com
- Phone: (+34) 676 22 71 06
13. Nature of the Information Provided
13.1. The data collected through any of the contact forms on this Website, data provided during events or promotions, or for service management purposes, will be incorporated—depending on the purpose—into AtZ’s Internal Record of Processing Activities (Article 30 of Regulation (EU) 2016/679). This record is available to the Supervisory Authority.
13.2. By ticking the appropriate boxes and entering data in the marked fields (with an asterisk *) in the web or paper forms, you expressly and freely agree that your data is necessary for AtZ to respond to your request. Supplying data in the remaining fields is voluntary. You guarantee the accuracy of the personal data provided and agree to notify any changes.
13.3. AtZ expressly guarantees that your personal data will not be transferred to third parties unless previously and explicitly informed and your consent obtained. All fields on the website forms are required for optimal service delivery; otherwise, we may not be able to fully meet your needs.
14. Security Measures
14.1. In accordance with the current regulations on personal data protection—particularly Regulation (EU) 2016/679 of April 27, 2016, and Organic Law 3/2018 (LOPD-GDD) of December 5—AtZ complies with all applicable provisions regarding the processing of personal data for which it is responsible. This includes adhering to the principles that require data to be processed lawfully, fairly, and transparently; and to be adequate, relevant, and limited to what is necessary.
14.2. AtZ has implemented adequate mechanisms to:
- Ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services.
- Restore availability and access to personal data quickly in the event of a physical or technical incident.
- Regularly test, assess, and evaluate the effectiveness of technical and organizational measures for ensuring data security.
- Pseudonymize and encrypt personal data, where applicable.
14.3. AtZ guarantees that appropriate technical and organizational measures are in place to enforce the security obligations established by GDPR and the LOPD-GDD. These measures aim to protect your rights and freedoms and ensure you are informed so you can exercise your rights. AtZ has implemented all reasonable safeguards to prevent loss, misuse, unauthorized access, or theft of your personal data. However, please be aware that no Internet-based system is entirely secure.
14.4. Personal data included in the Internal Record of Processing Activities will be handled with the utmost confidentiality and security. The data controller may send commercial information (e.g., NEWS, UPDATES, NEWSLETTERS) offered by AtZ. In such cases, the sender will clearly indicate the advertising nature of the message and include a simple, clear, and free method to unsubscribe.
14.5. The services offered by AtZ on its Website are intended exclusively for adults.
14.6. As previously stated, the collection and automated processing of personal data is intended to maintain the business relationship with AtZ, manage and enhance the services you choose to contract, register for, or use; customize those services to your preferences, analyze your service usage, develop new services, and send service updates and commercial communications through traditional and electronic means.
15. AtZ and Social Media15.1. What do we use your data for on social media?
- To respond to your inquiries, requests, or messages.
- To manage the service you requested or process your application.
- To engage with you within our follower community.
15.2. What is the legal basis for processing your social media data?
Entering into a contractual relationship within the respective social network, in accordance with its privacy policies:
- LinkedIn: AtZ LinkedIn Profile
15.3. In all cases, AtZ is considered the data controller for its followers, fans, subscribers, commenters, and other user profiles (hereinafter, “followers”). The processing of such data will be limited to what is permitted by the respective social network for corporate profiles. AtZ may inform its followers through any channel allowed by the network about news, activities, and promotions. AtZ will not extract user data from social media unless express consent is obtained. When the exercise of data rights depends on changing your profile settings, AtZ will assist and advise you to the extent possible.
16. Right to InformationUpon request and in accordance with applicable laws, AtZ will promptly inform you in writing whether we are storing personal data about you, and if so, what data. If you are registered on our Website, you may consult and request deletion, modification, or updating of your data at any time.
17. GDPR & LOPD-GDD Compliance17.1. AtZ takes data protection seriously. In compliance with GDPR and the LOPD-GDD, AtZ confirms the following actions:
- Maintains a Record of Processing Activities (RAT) as per Article 30 of GDPR, available to authorities or data subjects.
- Has audited data entry channels and defined legal bases for processing according to Articles 6 and 9 of GDPR.
- Provides notice to all visitors/customers/employees about data use as required by Articles 13 and 14 of GDPR.
- Has procedures to handle data subject rights: access, rectification, erasure, restriction, portability (Art. 20), objection, and automated decisions.
- Evaluates and contracts only data processors that meet GDPR obligations, backed by processing agreements per Article 28.
- Conducts training and awareness for employees led by the designated Data Protection Officer (DPO).
- Has a contingency and continuity plan for data security, including secure backups.
- Implements a protocol for reporting data breaches to authorities (Art. 33) and to affected subjects (Art. 34).
- Has designated an internal Data Protection Officer, IT administrator, and a “Crisis Team.” Contact: admon@atzinvestment.com
17.2. Due to our customer volume, we cannot individually sign agreements with all data controllers. Acceptance of this Privacy Policy implies acceptance of the data access agreement, as required by GDPR. This agreement ensures that AtZ, acting as a data processor under Article 28 of GDPR, fulfills all legal obligations.
17.3. By contracting our services, you (as Data Controller) agree that AtZ will act as a data processor per GDPR Article 28.