Privacy policy
Last updated: 29 September 2026
This policy explains how Automated Investment Solutions, S.L. ("Valuat", "we") processes personal data collected through valuat.com, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). It covers visitors to the website, people who request a demo or contact us, newsletter subscribers and job applicants. The processing of data on behalf of our clients inside the Valuat platform is governed by the data processing agreement signed with each client.
Data controller
Automated Investment Solutions, S.L. · NIF B16692733 · Avenida Gregorio Peces Barba, 1, 28919 Leganés (Madrid), Spain · legal@valuat.com.
What data we collect and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Answer demo requests and prepare the demo | Name, work email, role, phone (optional), firm, country, regulator, manager and fund details you provide, priorities, current setup, scheduling details | Steps taken at your request before entering into a contract (Art. 6.1.b GDPR) | 24 months from the last contact, unless a contract is signed |
| Assess and route requests (lead score and assignment to a sales contact) | The same data, plus public register information about your firm | Our legitimate interest in handling requests efficiently (Art. 6.1.f) | As above |
| Answer contact and partnership enquiries | Name, work email, firm, message | Legitimate interest (Art. 6.1.f) | 12 months from the last contact |
| Manage job applications sent to hr@valuat.com | CV and the data you choose to send | Steps at your request (Art. 6.1.b) and your consent to keep your CV for future openings | 12 months, or until you ask us to delete it |
| Measure how the website is used | Pseudonymous usage data through analytics cookies | Your consent (Art. 6.1.a) | See the Cookie policy |
| Keep the website secure and prevent abuse | IP address, technical logs | Legitimate interest (Art. 6.1.f) | Up to 12 months |
We do not use your data for automated decisions with legal or similarly significant effects. The lead score only helps us decide who in our team replies first.
Public register data
When you choose your firm in the demo form, we show information from the public register of your regulator (for example the CNMV) to pre-fill the form. We use it only to prepare your demo, and you can edit it before sending.
Who receives your data
We do not sell your data. We share it only with service providers that process it on our behalf under a data processing agreement: website hosting and database (Lovable and Supabase), email delivery (Resend), calendar scheduling (Google) and, only with your consent, web analytics (Google Analytics). Some providers may process data outside the European Economic Area; in that case transfers are covered by an adequacy decision, such as the EU-US Data Privacy Framework, or by the European Commission's standard contractual clauses. We may also disclose data where required by law.
Your rights
You can access, rectify or erase your data, object to or restrict its processing, request its portability and withdraw your consent at any time, without affecting processing carried out before. Write to legal@valuat.com with the subject "Data protection". If you think we have not handled your request properly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).
Security
Valuat operates an information security management system certified under ISO/IEC 27001 and complies with the Spanish National Security Framework (ENS). Access to personal data is limited to the people who need it, and every access to the admin area is logged.
Changes to this policy
We may update this policy when our processing changes. The date at the top shows the latest version.