Privacy Policy

Wio Capital S.L. ("the Company," "we," "us," or "our") provides an AI-native back-office platform that independent financial advisors use to automate portfolio rebalancing, generate client reports, and prepare meeting summaries. This Privacy Policy explains how the Company processes personal data in connection with wiocapitalhq.com and the Wio Capital platform. It applies to visitors to our website, prospective customers, and registered advisor accounts.

Because we are headquartered in Madrid, Spain and serve customers across the European Union, this Policy is governed by Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR").

1. Data Controller

Wio Capital S.L. ("the Company") (Calle de Fuencarral 123, Planta 4, 28004 Madrid, Spain) is the data controller for personal data processed through wiocapitalhq.com and the Wio Capital platform. You may contact us regarding any data-protection matter, including to exercise the rights described in Section 6, at [email protected].

2. What We Process

The Wio Capital platform is a tool used by independent financial advisors to manage their own advisory practices. The personal data we process falls into two streams:

Data you provide directly

• Identity and contact data: name, email address, phone number, and practice details submitted when you create an advisor account or contact us;
• Communications content: messages, support requests, and demo enquiries you send to us;
• Billing data: subscription and payment details, processed by our payment processor under their own data terms.

Data collected automatically when you use the platform

• Technical data: IP address, browser type and version, operating system, pages visited, session duration;
• Usage data: features accessed, rebalancing queue actions taken, reports generated -- used solely to operate and improve the platform for advisors;
• Analytics data: anonymised or aggregated usage patterns, collected only with your prior consent (see Section 8).

Client financial data uploaded by advisors

When an advisor imports portfolio data into Wio Capital (for example, via CSV or custodian feed), that data is processed strictly on the advisor's behalf to deliver the rebalancing, reporting, and meeting-prep features. The Company acts as a data processor for that data under the advisor's instructions; the advisor remains the data controller and responsible fiduciary for their clients' information. We do not use uploaded client portfolio data to train machine-learning models or share it with third parties beyond infrastructure providers bound by GDPR-compliant data-processing agreements.

3. Purposes and Legal Bases (Article 6 GDPR)

Purpose	Legal basis
Providing and operating the Wio Capital advisor platform, including processing rebalancing queues, generating client reports, and preparing meeting summaries	Contract performance (Art. 6(1)(b))
Responding to enquiries, demo requests, and support tickets	Pre-contract steps or legitimate interest (Art. 6(1)(b)/(f))
Securing the platform and preventing fraud or unauthorised access	Legitimate interest (Art. 6(1)(f))
Invoicing and subscription management	Contract performance and legal obligation (Art. 6(1)(b)/(c))
Legal compliance, including Spanish and EU regulatory obligations	Legal obligation (Art. 6(1)(c))
Analytics cookies to understand platform usage and improve the product	Consent (ePrivacy Directive + Art. 6(1)(a))

4. Recipients and Transfers

Personal data is shared only with processors acting on our behalf under Article 28 GDPR data-processing agreements. These include hosting and infrastructure providers, email delivery services, and, where you have consented, analytics providers. We do not sell personal data.

Where data is transferred outside the EU/EEA, we rely on the European Commission's Standard Contractual Clauses (Art. 46 GDPR) and assess supplementary safeguards as required following the Court of Justice ruling in Data Protection Commissioner v. Facebook Ireland Limited (Schrems II).

5. Retention

We retain personal data only for as long as necessary for the purposes described in this Policy. Specifically: advisor account data is retained for the duration of the active subscription and for a maximum of 36 months following account closure. Inquiry-form and email correspondence is retained for 24 months after last contact. Server access and security logs are retained for 90 days. Portfolio data imported by advisors is deleted within 30 days of account closure unless the advisor requests earlier deletion. Billing records are retained for the period required by Spanish tax law.

6. Your GDPR Rights

As a data subject under the GDPR, you have the following rights regarding personal data the Company holds about you:

• Right of access (Art. 15) -- to confirm whether the Company processes your personal data and to obtain a copy of it;
• Right to rectification (Art. 16) -- to have inaccurate personal data corrected without undue delay;
• Right to erasure (Art. 17) -- to request deletion of your personal data, subject to limited exceptions (for example, where we must retain data to comply with a legal obligation);
• Right to restriction of processing (Art. 18) -- to request that we limit how we use your personal data in certain circumstances;
• Right to data portability (Art. 20) -- to receive personal data you have provided to us in a structured, commonly used, machine-readable format;
• Right to object (Art. 21) -- to object to processing based on legitimate interests; you may object to direct marketing at any time without giving a reason;
• Right not to be subject to automated decision-making (Art. 22) -- the Company does not make decisions with legal or similarly significant effects based solely on automated processing.

To exercise any of these rights, email us at [email protected]. We will respond within one calendar month of receiving your request. For complex or numerous requests, we may extend this period by up to two further months and will notify you accordingly.

7. Right to Lodge a Complaint

If you believe the Company has not handled your personal data in accordance with the GDPR, you have the right to lodge a complaint with a supervisory authority. In Spain, the competent authority is the Agencia Espanola de Proteccion de Datos (AEPD), reachable at aepd.es. You may also contact the supervisory authority in your country of residence or place of work. A list of EU/EEA authorities is maintained by the European Data Protection Board at edpb.europa.eu.

8. Cookies

The Company uses cookies and similar technologies on wiocapitalhq.com and in the Wio Capital advisor platform. Strictly necessary cookies are set without consent as they are required for the Service to function (for example, session management and the record of your cookie preference). Non-essential cookies -- including analytics cookies that help us understand how advisors navigate the platform -- are set only after you give prior consent through our cookie banner.

For full details of the categories of cookies used, their lifetimes, and how to manage your preferences, see our Cookie Policy.

9. Security

The Company implements technical and organisational measures appropriate to the risk, including TLS encryption in transit, encrypted storage at rest, strict access controls, and regular security reviews. Advisor portal authentication requires credentials and the platform logs access activity. In the event of a personal data breach that presents a risk to your rights and freedoms, the Company will notify the AEPD within 72 hours and, where required, notify affected individuals without undue delay.

10. Changes

The Company may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Last updated" date at the top of this page. Where changes materially affect how we process personal data for which you have given consent, the Company will seek renewed consent before applying them.

11. Contact

Wio Capital S.L.
Calle de Fuencarral 123, Planta 4
28004 Madrid, Spain
Email: [email protected]
Phone: +34 91 060 4820