Privacy Policy

At URBANPAY X SL ("UrbanPay", "we", "us") we take the protection of your personal data seriously. This Privacy Policy explains what information we collect, why we collect it, how we process it and what rights you have over it. It is drafted in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spain's Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).

Where UrbanPay acts as data controller (see below), its details are:

• Company name: URBANPAY X SL
• Tax ID (NIF): B26885491
• Registered address: Calle Velázquez 31, 6D, 28001 Madrid, Spain
• Contact email: privacy@urbanpayx.com
• Data Protection Officer (DPO): dpo@urbanpayx.com

Our role under the GDPR

• Data controller: for the data of visitors to our website, prospective clients, contact persons and users of our clients (platform operators), and our own staff. In these cases we decide why and how the data is processed.
• Data processor: for the data of investors, tenants and other end users that we process on behalf of our clients (for example identity verification, contract signing or payments). In these cases we act on the documented instructions of the client, who is the controller, and under the data processing agreement signed with them.

This policy mainly describes the processing for which we are the controller. If you are an end user of a client platform, the applicable privacy policy is that of the platform, and you should exercise your rights with it; we will help it respond to your request.

If you have any questions about how we process your data, write to the privacy address above.

We collect different categories of data depending on how you interact with us:

Basic identification data. First name, surname, email address, phone number, job title and company when you fill in a form, sign up as a client or write to us.

Identity and KYC/KYB verification data. If you use the UrbanPay platform as an investor, tenant or representative of a legal entity, we collect the data required by anti-money laundering rules: identity document (DNI, NIE, passport), proof of address, beneficial ownership data, information about your economic activity and, where applicable, facial biometrics for liveness verification. We process this data through regulated identity providers.

Financial and transaction data. IBAN, data from bank accounts accessed via Open Banking with your PSD2 consent, amounts, dates, recipients and payment references. We only access the information strictly necessary to process your transaction.

Usage and browsing data. Technical information about your device (IP address, browser type, operating system), cookies and behavioural metrics on our website (pages visited, time on page, traffic source) collected through web analytics tools, only if you accept them in the cookie banner.

Dashboard sign-in data. When you or a member of your team signs in to the UrbanPay dashboard, or tries to, we record the date and time, whether it succeeded, the sign-in method, the IP address and the browser and operating system reported by the device.

Communications data. The content of your emails, messages sent through web forms, chat conversations, or call recordings if you contact us by phone and give your explicit consent.

We process your data for specific and legitimate purposes:

Providing the service. Letting you use the UrbanPay platform, processing your payments, executing A2A transfers, holding funds in escrow accounts, executing mass disbursements, managing your account and supporting you as a client.

Complying with legal obligations. Identity verification (KYC), verification of legal entities (KYB), transaction monitoring, reporting suspicious transactions to SEPBLAC (the Spanish Financial Intelligence Unit) and record keeping under Spanish Law 10/2010 on the prevention of money laundering and terrorist financing, PSD2 and, from its application in July 2027, the 2024 EU anti-money laundering package (Regulation (EU) 2024/1624, AMLR, and Directive (EU) 2024/1640, AMLD6).

Account security. Detecting and investigating unauthorised access to dashboard accounts. You can see your own sign-in history in your security settings, and the owner of the client account you belong to can see the sign-in history of every member of that team.

Improving the service. Aggregated analysis of platform usage to detect errors, optimise performance and develop new features.

Commercial communications. Sending information about our products, blog content and news. We only send commercial communications if you have given us your explicit consent or if there is a prior contractual relationship. You can unsubscribe at any time from the link included in every email.

Regulatory compliance and legal defence. Responding to requests from supervisory authorities (Banco de España, CNMV, AEPD, courts) and, where applicable, defending our rights in legal proceedings.

Each purpose has a clear legal basis:

• Performance of a contract (Art. 6(1)(b) GDPR): for the data needed to provide the service to you.
• Legal obligation (Art. 6(1)(c) GDPR): for KYC/KYB data, anti-money laundering and regulatory reporting.
• Consent (Art. 6(1)(a) GDPR): for analytics cookies that are not strictly necessary and for commercial communications.
• Legitimate interest (Art. 6(1)(f) GDPR): for aggregated analysis of platform usage without non-essential cookies, fraud prevention, the security of dashboard accounts (including the sign-in history) and service improvement. We balance interests case by case and you can always object to processing based on this interest.

Biometric data. Where identity verification includes facial biometrics to check that you are a real person and match your document, this is a special category of data (Art. 9 GDPR). We process it for reasons of substantial public interest set out in anti-money laundering law (Art. 9(2)(g) GDPR in conjunction with Spanish Law 10/2010) or, where the verification process says so, with your explicit consent (Art. 9(2)(a) GDPR).

We only share your data with third parties when strictly necessary and always under a data processing agreement in accordance with Article 28 GDPR. The categories of recipients are:

Regulated payment partners. The licensed entities that settle your payments (payment institutions, electronic money institutions, banks holding escrow accounts). UrbanPay operates as technology middleware through partners authorised under PSD2 and the corresponding licences.

Identity verification providers. To carry out KYC and KYB, we work with specialised providers that apply the most demanding security and privacy standards.

Technical infrastructure providers. Cloud hosting and content delivery services, transactional email, web analytics and customer support tools. All are bound by data processing agreements.

Public authorities. Where required by anti-money laundering, tax or fraud prevention rules or by court proceedings, we disclose data to the competent authorities (SEPBLAC, the Spanish Tax Agency, law enforcement, courts).

We do not sell your personal data to third parties under any circumstances.

Some of our technology providers are located outside the European Economic Area (EEA), mainly in the United States. When this happens, we ensure an adequate level of protection through:

• European Commission adequacy decisions (for example, the EU-US Data Privacy Framework for certified providers).
• Standard Contractual Clauses approved by the European Commission.
• Transfer impact assessments (TIAs) where necessary.

You can request more information or a copy of the applicable safeguards by writing to privacy@urbanpayx.com.

We keep your data for as long as necessary to fulfil the purposes for which it was collected and the applicable legal obligations:

• Active client data: for the duration of the contractual relationship.
• Access requests that do not lead to a contract: 12 months from the request.
• KYC/KYB data and anti-money laundering records: ten years from the end of the relationship, in accordance with Spanish Law 10/2010.
• Accounting and tax data: six years, in accordance with the Spanish Commercial Code and tax rules.
• Marketing and commercial communications data: until you withdraw your consent or two years from your last interaction, whichever comes first.
• Dashboard sign-in history: 12 months from each sign-in attempt.
• Browsing data and cookies: until each cookie expires or you withdraw your consent from the "Cookie settings" link in the footer.

Once these periods have passed, we delete or irreversibly anonymise the data.

You have the right to:

• Access your personal data and obtain a copy.
• Rectify inaccurate or incomplete data.
• Erase your data when it is no longer needed for the purpose for which it was collected, subject to legal retention obligations.
• Restrict processing in the specific circumstances provided for in the GDPR.
• Portability of your data in a structured, commonly used and machine-readable format.
• Object to processing based on legitimate interest and to automated decisions, including profiling, that produce legal effects concerning you.
• Withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal.
• Complain to the Spanish Data Protection Agency (AEPD) if you consider that the processing does not comply with the law. You can do so through its electronic office at sedeagpd.gob.es.

To exercise any of these rights, write to privacy@urbanpayx.com stating clearly which right you want to exercise. If we have reasonable doubts about your identity, we may ask you for the additional information needed to confirm it. We will respond within one month of receiving the request, which may be extended by two further months in particularly complex cases.

In accordance with Article 22.2 of Spain's Law 34/2002 on Information Society Services (LSSI), we distinguish between:

• Technical cookies: strictly necessary for the website and platform to work, for example to keep you signed in or remember your language. They do not require consent.
• Analytics cookies: let us measure how the website is used, including browsing analysis, in order to improve it. Some are set by third-party providers. They are only set if you accept them.

You can accept or reject analytics cookies in the banner shown on your first visit, and change or withdraw your choice at any time from the "Cookie settings" link in the footer. Rejecting them does not affect how the website works.

The Cookie Policy lists each cookie we use, its provider, purpose and duration.

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss, alteration or destruction. These measures include encryption in transit and at rest, role-based access control, regular security audits, team training, and partners certified to recognised standards (ISO 27001, SOC 2 Type II, among others).

If we detect a security breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, in accordance with Article 34 GDPR. We will also notify the breach to the AEPD within 72 hours of becoming aware of it, in accordance with Article 33 GDPR.

Some UrbanPay processes include automated assessments, particularly in anti-money laundering (transaction monitoring, alert systems) and fraud prevention. These automated decisions do not on their own produce significant legal effects: relevant cases are reviewed by a person on our compliance team before any final action is taken.

You have the right to obtain human intervention, express your point of view and contest any decision that affects you. To exercise this right, write to privacy@urbanpayx.com.

We may update this Privacy Policy to reflect changes in our practices, in the law or in the services we offer. When the changes are material, we will notify you by email or through a visible notice on the platform at least 30 days in advance. The version in force at any time is always available at this URL.

The "Last updated" date at the top of this policy reflects the current version.

If you have any questions about this Privacy Policy or about how we process your data, write to us: