Privacy Policy

This Privacy Policy applies to the website assevglobal.com, to the consultation and onboarding forms, to the investor portal and to the operational communications related to those services. This policy must be read together with our Terms and Conditions.

ASSEV Global acts as the controller of the personal data collected through those channels. For requests related to privacy you can write to inversores@assevglobal.com.

The data we process depends on the interaction you have with ASSEV. It may include:

• Identification and contact: full name, email address, telephone number, country and city.
• Consultation information: investment range, message and data you provide voluntarily in forms or communications.
• Onboarding information: broker, account number, operational reference and other data needed to assess compatibility and integrate an account into the model.
• Portal access data: email address, one-time access codes, a password if you choose to set one, and technical data associated with authentication and security.
• Technical information: IP address, browser, device, technical cookies, language preferences and certain session or local storage data needed for the site and the portal to function.
• Operational account information: data on balance, equity, snapshots, trades, movements and reports associated with accounts linked to the investor portal.

• Directly from you, when you complete forms, request a consultation, begin onboarding or use the portal.
• From providers and operational platforms linked to the provision of the service, such as brokers, trading platforms and market data synchronisation services.
• From technical records generated by the use of the site, the portal and their authentication mechanisms.

We process personal data for the following main purposes:

• To respond to requests for information, consultation or contact.
• To assess compatibility with ASSEV's operating model.
• To manage onboarding, validation and the registration of accounts.
• To enable secure access to the investor portal and protect access sessions.
• To send access codes, operational notices, confirmations and communications related to the account.
• To generate reports, account views, historical records and documents associated with the service.
• To generate analysis and informational content using artificial intelligence tools, as part of the service.
• To comply with contractual, legal, regulatory and security obligations.
• To prevent fraud, abuse of the service, unauthorised access and operational risks.

The processing of personal data is based on one or more of the following legal bases, as the case may be:

• Performance of a contract: where the processing is necessary to provide the service requested or to fulfil the agreements formalised with the investor.
• Consent: where you provide data voluntarily through consultation forms, onboarding or direct communications.
• Legitimate interest: for the security of the service, fraud prevention, operational improvement and the generation of aggregated reports.
• Legal obligation: where the processing is required by applicable regulations, competent authorities or regulators.

The site and the portal use technical mechanisms to work correctly. These include session cookies and browser local storage to remember language, the account selected in the portal and other functional preferences.

The portal uses a secure session cookie to keep the investor authenticated once the access process is complete. These technologies are used exclusively for operational and security purposes. We do not use cookies for advertising or third-party tracking purposes.

ASSEV does not sell personal data. We may share information with third parties only where necessary to operate the service or to comply with applicable obligations. The categories of third parties include:

• cloud infrastructure, web hosting and database providers;
• transactional email providers for sending access codes, confirmations and operational communications;
• security, access control and request-limiting services;
• artificial intelligence providers for the generation of analysis and informational content;
• brokers or operational counterparties related to the investor's account;
• professional advisers or competent authorities where there is a legal basis or a justified operational need.

In all cases, ASSEV endeavours to ensure that third parties with access to personal data maintain reasonable security and confidentiality measures in keeping with the nature of the information shared.

Some of our providers may process information from different jurisdictions. Where this occurs, ASSEV will endeavour to ensure that the processing is carried out under reasonable contractual, technical and organisational measures to protect personal data in keeping with the nature of the service.

ASSEV applies reasonable security measures to reduce the risks of unauthorised access, alteration, disclosure or loss of information. These measures include, among others:

• AES-256 encryption of sensitive credentials in storage;
• access controls and protected sessions;
• temporary access codes for the portal;
• limits on attempts and anti-abuse mechanisms;
• segmentation between custody, trading and information views within the architecture of the service.

No system is infallible. ASSEV cannot guarantee the absolute security of the information, but it undertakes to maintain and improve its security controls on a continuous basis.

If a security incident compromises personal data and poses a significant risk to the data subjects, ASSEV will notify those affected and the competent authorities within the time limits set by the applicable regulations, stating the nature of the incident, the data affected, the measures taken and the recommended actions.

We retain personal data for as long as necessary to fulfil the purposes described in this policy. As a general reference:

• Consultation data: up to 12 months after the last contact, unless a formal relationship is established.
• Data of active investors: for the duration of the relationship and up to 5 years after its termination, in accordance with record-keeping and documentation obligations.
• Technical and session data: up to 12 months, unless it is needed to investigate security incidents.
• Accounting and tax records: in accordance with the periods set by the applicable regulations.

At the end of the retention periods, the data is deleted or anonymised in such a way that the data subject cannot be identified.

Depending on the regulations applicable to your case, you may exercise the following rights in respect of your personal data:

• Access: to request confirmation of whether we process your data and to obtain a copy of it.
• Rectification: to correct inaccurate or incomplete data.
• Cancellation / erasure: to request the deletion of your data when it is no longer necessary for the purposes of the processing.
• Objection: to object to the processing of your data in certain circumstances.
• Portability: to receive your data in a structured and commonly used format, where technically feasible.
• Restriction: to request that the processing be restricted in the cases provided for by law.

To exercise any of these rights, write to inversores@assevglobal.com. To protect the security of the information, ASSEV may ask you for reasonable details to prove identity, ownership or standing before dealing with the request. The response time will be the one set by the applicable regulations.

This site and ASSEV's services are not directed at minors. We do not seek to intentionally collect personal data from minors without the involvement of whoever holds parental authority or guardianship, where legally applicable.

ASSEV operates globally and may receive requests from different jurisdictions. If you are in a jurisdiction that grants additional rights over personal data, such as the General Data Protection Regulation (GDPR) of the European Union, the California Consumer Privacy Act (CCPA) or other local laws, ASSEV will endeavour to respect the rights applicable to your case.

If you consider that the processing of your data infringes your rights, you have the right to lodge a complaint with the competent data protection authority in your jurisdiction.

ASSEV may update this Privacy Policy to reflect legal, regulatory, operational or technological changes. The version in force will be the one published on this site, stating the date of its last update. If there are material changes, ASSEV will endeavour to notify active investors through the usual channels.

For questions related to privacy, data processing or requests connected with this policy, you can write to inversores@assevglobal.com or use the channels published on assevglobal.com.