Privacy Policy.

Last updated · 10 July 2026

Fundaro collects as little personal data as it can get away with. This policy explains, in plain language, what we do collect, why, who helps us process it and how you stay in control of it.

1. Who we are

This website, fundaro.capital, is operated by Fundaro Ltd. ("Fundaro", "we", "us"), a P2P real estate lending platform operating from Málaga, Spain. For the personal data described in this policy, Fundaro Ltd. acts as the data controller within the meaning of the EU General Data Protection Regulation (GDPR).

You can reach us about anything privacy-related at hi@fundaro.capital.

2. The data we collect

2.1 Waitlist data

When you join the waitlist we collect the email address you submit, together with the date and time you joined. That is all the form asks for, and all it sends.

2.2 Correspondence

If you email us, we keep the correspondence and your contact details for as long as needed to deal with your enquiry and any follow-up.

2.3 Usage data (cookie-free analytics)

We measure website traffic with Plausible Analytics, a privacy-first tool that works without cookies and without persistent identifiers. It records aggregated events - page viewed, referrer, browser and device class, and country derived from the IP address. The IP address itself is not stored and individual visitors are not profiled or tracked across sites. See our Cookie Policy for details.

2.4 Identity and verification data (when the platform opens)

When lending goes live, participants will be asked for identity documents, proof of address and, where warranted, information on the source of funds. This is required by anti-money-laundering law and is described in our AML & KYC Policy. A dedicated privacy notice will accompany onboarding.

3. Why we collect it, and the legal bases

• To run the waitlist and send you occasional updates about cohort openings, loan listings and the Fundaro lender note - based on your consent (Art. 6(1)(a) GDPR). Every email contains an unsubscribe link; withdrawing consent is one click.
• To respond to your enquiries - based on our legitimate interest in communicating with people who contact us (Art. 6(1)(f) GDPR).
• To operate, secure and improve the website - based on our legitimate interest in running a reliable, safe service (Art. 6(1)(f) GDPR).
• To meet legal obligations, including anti-money-laundering and counter-terrorist-financing rules once lending operations begin - a legal obligation (Art. 6(1)(c) GDPR).

4. Who processes it

We do not sell personal data, and we do not share it with advertisers. Data is handled by a short list of service providers acting on our instructions:

• Brevo (Sendinblue GmbH, Germany) - stores waitlist contacts and sends our emails.
• Our hosting provider - serves the website and its server logs.
• Plausible Analytics - processes the aggregated, cookie-free usage statistics described above.

We may also disclose data where the law requires it - for example to courts, regulators or supervisory authorities - or to professional advisers under confidentiality obligations.

5. International transfers

We keep personal data inside the European Economic Area wherever possible. If a provider processes data outside the EEA, we rely on an adequacy decision of the European Commission or on Standard Contractual Clauses, together with any additional safeguards needed.

6. How long we keep it

• Waitlist data - until you unsubscribe, or after 24 months without any engagement from you, whichever comes first.
• Correspondence - for as long as reasonably needed to handle the matter and to evidence what was agreed.
• KYC records (once lending operations begin) - ten years from the end of the business relationship, as required by Spanish Law 10/2010.

7. Your rights

Under the GDPR you can, at any time and free of charge:

• request access to the personal data we hold about you;
• have inaccurate data rectified and, in the situations foreseen by law, have data erased;
• restrict or object to processing based on legitimate interests;
• receive your data in a portable format (data portability);
• withdraw consent for the waitlist emails - the unsubscribe link in each email does exactly this.

To exercise any of these rights, email hi@fundaro.capital. You also have the right to lodge a complaint with a supervisory authority - in Spain, the Agencia Española de Protección de Datos (www.aepd.es), or the authority of your own country of residence.

8. How we protect it

All traffic to fundaro.capital is encrypted in transit (TLS). Access to personal data is limited to the people who need it to do their job, and our providers are bound by data processing agreements. No system is perfectly secure, but we treat your data with the same care we expect for our own.

9. Children

Fundaro is a platform for adults. The website and waitlist are not directed at anyone under 18, and we do not knowingly collect data from minors. If you believe a minor has given us personal data, contact us and we will delete it.

10. Changes to this policy

If we change this policy in a meaningful way - for example when lending operations open - we will update this page and the date at the top, and where the change is material we will notify waitlist subscribers by email.

← All legal documents