Privacy Policy
Last updated: January 2026
At CreditRatingXC, S.L. (hereinafter, "the Company"), with registered office at Calle Serrano 45, 3rd Floor, 28001 Madrid, and Tax ID B-87654321, we are committed to protecting the privacy of users of our real estate crowdlending platform. This Privacy Policy describes how we collect, use, store and protect the personal information you provide when using our services at creditratingxc.com.
1. Data controller
The data controller for your personal data is CreditRatingXC, S.L., registered in the Madrid Commercial Registry, Volume 42,891, Folio 127, Sheet M-758234. You can contact our Data Protection Officer at dpo@creditratingxc.com.
2. Data we collect
We collect identification data (name, surname, ID number), contact data (email, phone, address), financial data necessary for investment evaluation, browsing data (IP address, browser type, pages visited) and any information you voluntarily provide through contact forms.
3. Purpose of processing
We use your data to manage your registration and account on the platform, facilitate investment operations in property projects, comply with legal and regulatory obligations (anti-money laundering, CNMV regulations), send you commercial communications related to our services (only with your prior consent) and improve the functionality of our platform.
4. Legal basis
The processing of your data is based on the performance of a contract (when you invest through our platform), explicit consent (for commercial communications), compliance with legal obligations (financial, tax and anti-money laundering regulations) and the legitimate interest of the Company (service improvement and platform security).
5. Data recipients
Your data may be disclosed to collaborating financial entities necessary for investment management, regulatory authorities (CNMV, Sepblac) when required by law, technology service providers acting as data processors and external auditors within the framework of mandatory legal audits. We do not make international data transfers outside the European Economic Area.
6. Data retention
We will retain your personal data for as long as necessary to fulfil the purpose for which it was collected, as well as to comply with applicable legal obligations. Data related to investment operations will be retained for a minimum of 10 years in accordance with anti-money laundering regulations.
7. Your rights
As a data subject, you have the right to access your personal data, rectify inaccurate data, request the deletion of your data, restrict or object to processing, request data portability and withdraw your consent at any time. To exercise these rights, you can write to us at dpo@creditratingxc.com or by post to our address. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD).
8. Security
We implement appropriate technical and organisational measures to ensure the security of your personal data, including SSL/TLS encryption, restricted access controls, regular backups and periodic security audits.