This Privacy Policy explains how Club de Inversión Deusto (acting as Deusto Investment Club) («we», «us», or «our») collects, uses, and protects personal information when you interact with our website at https://deustoinvestmentclub.com/, our products, or any related services (collectively, the «Services»). We are committed to safeguarding your information and handling it responsibly in accordance with applicable data protection laws.

Our business is located at Calle Hermanos Aguirre 2, 48014, City of Bilbao, Vizcaya, Spain.

If you have questions about this Privacy Policy or the way we process personal information, you can contact us at info@deustoinvestmentclub.com or via post to the address indicated below.

Depending on the context, we act as both a data controller and a data processor.

As a data controller, we determine how and why personal information is processed when we operate our website, manage user accounts, provide customer support, or carry out other core activities related to offering our Services.

As a data processor, we may process personal information on behalf of other organizations and according to their instructions when our Services are used to store, manage, or handle data that belongs to those organizations.

I. Information we collect

II. How we collect information

III. How we use your information

IV. How we process your information

V. Automated decision-making and profiling

VI. Cookies & tracking technologies

VII. How we share information

VIII. International transfers

IX. How long we retain information

X. How we keep information safe

XI. Your rights

XII. Children’s privacy

XIII. Updates to this policy

XIV. How to contact us

We collect personal information that you provide directly, information generated automatically when you use our Services, and information obtained from third-party tools that support our operations. The specific personal information we collect depends on how you interact with our Services, the features you use, and the choices you make.

Personal information we receive directly from you or collect automatically includes:

Identifiers

• Name
• Email address
• Phone number

Technical and Device Data

• IP address
• Device identifiers
• Browser type and operating system
• Technical logs and system data

Usage Data

• Pages visited
• Actions taken
• Features used
• Navigation patterns

Analytics and Tracking Data

• Cookie data
• Usage logs

Communication Data

• Messages or information provided through forms or support

Preferences and Localization Data

• Language settings
• Time zone
• City-level location (if available)

Some features of our Services require specific personal information to function.

All personal information you provide must be accurate, complete, and up to date. You are responsible for notifying us if any of your information changes so we can maintain accurate records.

We collect personal information through a combination of information you provide directly, information gathered automatically when you use our Services, and information supplied by third-party providers that support our operations.

INFORMATION YOU PROVIDE DIRECTLY

We collect personal information that you choose to provide when you interact with our Services. This includes information submitted when you:

• Create an account or update profile details
• Complete forms, make purchases, or engage with customer support
• Respond to surveys, request information, or communicate with us

This information typically includes identifiers (such as name, email, phone number), account details, and any other information you voluntarily provide as part of your use of the Services.

INFORMATION COLLECTED AUTOMATICALLY

When you visit our website or use the Services, we automatically collect certain technical and usage information. This data does not usually reveal your identity but may include:

• IP address and device identifiers
• Browser type, operating system, and device characteristics
• Language settings and time zone
• Pages viewed, links clicked, and navigation patterns
• Error logs, performance data, and diagnostic information
• Cookie data, analytics events, and usage logs

This information helps us operate, secure, and optimize the Services, and supports internal analytics, reporting, and service improvement.

INFORMATION FROM YOUR INTERACTIONS

We collect information related to your actions within the Services, including:

• Features you use
• Content you view
• Settings or preferences you configure
• Interactions with user interfaces or in-app tools

This data helps us personalize the experience and understand how users engage with our platform.

We only process personal information when we have a valid legal basis under applicable data protection laws. This means we process data when it is necessary to provide our Services, fulfill our contractual obligations, comply with legal requirements, protect important interests, or pursue legitimate business purposes that do not override your rights.

LEGAL BASES WE RELY ON

We may rely on the following legal bases to process personal information:

• Contract. When processing is necessary to provide the Services or take steps at your request.
• Consent. When you voluntarily provide information for a specific purpose; you may withdraw consent at any time.
• Legitimate interests. When processing is necessary for our business operations and does not override your rights.
• Legal obligation. When we must process data to comply with applicable laws.
• Vital interests. When necessary to protect the safety or vital interests of an individual.

PORPUSES FOR WHICH WE PROCESS PERSONAL INFORMATION

We use personal information to provide customer support, answer inquiries, and resolve issues.

• Legal basis: to comply with legal obligations
• We may send newsletters, updates, or promotional content. Users can opt out at any time.
• Legal basis: based on our legitimate interests (e.g., Service Improvement)
• Our legitimate interests include service improvement.
• Legal basis: based on our legitimate interests (e.g., Service Improvement)
• Our legitimate interests include service improvement.
• We may process personal information to detect, prevent, or investigate fraud, abuse, or security incidents.
• Legal basis: to comply with legal obligations.

We process personal information in ways that are appropriate to the nature of the data and the purposes for which it is collected. This includes storing, organizing, using, transmitting, and deleting information when it is no longer required. We apply principles of data minimization, purpose limitation, and accuracy to ensure that personal information is processed only when necessary and for clearly defined purposes.

Access to personal information is limited to authorized personnel who require it to perform their job duties and who are bound by confidentiality obligations. We implement technical and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, or misuse. These measures may include access controls, authentication procedures, logging, encryption in transit and at rest (where appropriate), monitoring, and routine security assessments.

We may combine information collected from different sources when this is necessary to operate the Services or when required to meet a lawful purpose, such as preventing fraud or maintaining the security of our platform.

We retain personal information only for as long as needed for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. For more details, see the «How Long We Retain Information» section.

Where required by applicable laws, we provide users with the ability to access, update, delete, restrict, or withdraw consent to the processing of their personal information. Additional rights may apply depending on your location; see the «Your Rights» section for more information.

We do not use automated decision-making or profiling in a way that produces legal or similarly significant effects. If this changes in the future, we will update this Policy and provide any required notices or options.

We use cookies and similar tracking technologies (such as web beacons, tags, and pixels) to operate our website, understand how it is used, improve performance, and enhance your experience. These technologies help us maintain platform security, remember your preferences, prevent errors, and support essential site features.

We may use the following categories of cookies:

• Necessary / Essential Cookies: Required for the website to function properly and to provide services explicitly requested by the user.
• Analytics / Performance Cookies: Collect aggregated or behavioral data to help website owners understand usage and improve performance.
• Social Media Cookies: Set by social networks when content is embedded or social-sharing features are used.

Some cookies are set directly by us («first-party cookies»), while others may be placed by third-party providers that support our operations (“third-party cookies”), such as analytics, advertising, or customer support tools.

Where required by law, we display a cookie banner or notice to obtain consent and to give users control over cookie settings.

Necessary/Essential cookies are always active, while Analytics/Performance, Advertising/Marketing, and Functional/Preference cookies are used only with consent where required by law. You can manage your preferences at any time through the Cookie Banner or settings page.

We do not share personal information with third parties, except when required by law or to protect our legal rights.

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, comply with legal and regulatory requirements, resolve disputes, and enforce our agreements. We do not keep personal information longer than needed, and retention periods may vary depending on the type of data and the reason it was collected.

When we no longer have a legitimate business need to process personal information, we will delete or anonymize it. If deletion is not immediately possible (for example, due to technical constraints or backup systems), we will securely store the information and isolate it from further processing until deletion is feasible.

We retain personal information for the following periods:

• Account information: 1 year after account deletion.
• Profile and preferences: Until users terminate their accounts.
• Usage logs and activity data: 1 year.
• Cookies and tracking data: Session only (deleted when browser closes).
• Legal and regulatory records: 5 years.
• Customer support records: 1 year after resolution.
• Marketing communications: 1 year after user unsubscribes.
• User-generated content: Until deleted by the user or until the account is closed.

With regard to cookies and tracking data, we retain personal information according to the durations listed in the Cookie Policy. If no specific retention period applies, we delete or anonymize personal information once it is no longer necessary for the purpose collected.

We implement appropriate technical and organizational measures to protect personal information from unauthorized access, disclosure, alteration, or destruction. These measures are designed to provide a level of security appropriate to the risks associated with processing personal information.

Our safeguards may include:

• Encryption of data in transit and at rest
• Access controls to limit who can view or handle information
• Monitoring and logging of system activity to detect potential issues
• Regular security assessments and updates to our systems
• Secure data storage and transmission practices
• Employee training on data protection and security

While we take reasonable steps to safeguard personal information, no system or method of transmission over the internet is completely secure. Because of this, we cannot guarantee absolute security.

If we identify a data breach that affects your personal information, we will notify you and any applicable supervisory authorities when required by law.

We implement appropriate technical and organizational measures to protect personal information from unauthorized access, disclosure, alteration, or destruction. These measures are designed to provide a level of security appropriate to the risks associated with processing personal information.

Our safeguards may include:

• Encryption of data in transit and at rest
• Access controls to limit who can view or handle information
• Monitoring and logging of system activity to detect potential issues
• Regular security assessments and updates to our systems
• Secure data storage and transmission practices
• Employee training on data protection and security

While we take reasonable steps to safeguard personal information, no system or method of transmission over the internet is completely secure. Because of this, we cannot guarantee absolute security.

If we identify a data breach that affects your personal information, we will notify you and any applicable supervisory authorities when required by law.

Individuals have certain rights regarding their personal information. These rights vary depending on where they live, but we aim to provide clear and accessible options for all users.

RIGHTS FOR USERS IN THE EUROPEAN UNION

If you are located in the EU/EEA, you have the following rights under the GDPR:

• Right of access: Request a copy of the personal information we hold about you.
• Right to correction: Request that we correct inaccurate or incomplete information.
• Right to deletion: Request deletion of your personal information in certain circumstances.
• Right to restrict processing: Request that we limit how your data is used.
• Right to object: Object to processing based on legitimate interests or direct marketing.
• Right to data portability: Request your information in a structured, commonly used format.
• Right to withdraw consent: Withdraw consent at any time when processing is based on consent.

If you believe your personal data is being processed unlawfully, you have the right to lodge a complaint with a data protection authority. You can usually contact the authority in your country of residence, place of work, or where you believe a violation has occurred.

RIGHTS FOR USERS IN THE UNITED KINGDOM

If you are located in the United Kingdom, you have the following rights under the UK GDPR:

• Access
• Correction
• Deletion
• Restriction of processing
• Objection
• Data portability
• Withdraw consent

If you believe we are processing your personal information unlawfully, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

RIGHTS FOR USERS IN SWITZERLAND

If you are located in Switzerland, you have the following rights under the Swiss Federal Act on Data Protection. This section supersedes any other possibly divergent or conflicting information contained in this Privacy Policy. Further details regarding the categories of data processed, the purposes of processing, the categories of recipients of the personal data, if any, the retention period and further information about personal data can be found in the relevant sections within this document.

You may exercise certain rights regarding your personal information within the limits of the Swiss Federal Act on Data Protection, including the following:

• Right of access to personal data;
• Right to object to the processing of your personal data (which also allows you to demand that processing of personal data be restricted, personal data be deleted or destroyed, specific disclosures of personal data to third parties be prohibited);
• Right to receive your personal data and have it transferred to another controller (data portability);
• Right to ask for incorrect personal data to be corrected.

Any requests to exercise user rights can be directed to us through the contact details provided in this document. Such requests are free of charge and will be answered by us as early as possible, providing you with the information required by law.

RIGHTS FOR USERS IN THE UNITED STATES

Your privacy rights under US state laws.

You may exercise certain rights regarding your personal information. In particular, to the extent permitted by applicable law, you have:

• The right to access personal information: the right to know. You have the right to request that we confirm whether or not we are processing your personal information. You also have the right to access such personal information;
• The right to correct inaccurate personal information. You have the right to request that we correct any inaccurate personal information we maintain about you;
• The right to request the deletion of your personal information. You have the right to request that we delete any of your personal information;
• The right to obtain a copy of your personal information. We will provide your personal information in a portable and usable format that allows you to transfer data easily to another entity – provided that this is technically feasible;
• The right to opt out from the sale of your personal information;
• The right to non-discrimination; We will not discriminate against you for exercising your privacy rights.

In addition to the rights listed above common to all users in the United States, as a user residing in Virginia, Colorado, Connecticut, Texas, Oregon, Nevada, Delaware, Iowa, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Montana, Indiana, Kentucky and Rhode Island, you have

• The right to opt out of the processing of your personal information for targeted advertising or profiling in furtherance of decisions that produce legal or similarly significant effects concerning you;
• The right to freely give, deny or withdraw your consent for the processing of your sensitive personal information. Please note that certain exceptions outlined in the law may apply, such as, but not limited to, when the collection and processing of sensitive personal information is necessary for the provision of a product or service specifically requested by you.

In Minnesota, users also have the right to obtain a list of the specific third parties to which the controller has disclosed the consumer’s personal data.

Note that in some states like Minnesota, in addition to the rights listed above common to all users in the United States, you have the following specific rights connected to profiling:

• The right to question the results of the profiling.
• The right to be informed of the reason that the profiling resulted in the decision; if feasible.
• The right to be informed of what actions you might have taken to secure a different decision and the actions that you might take to secure a different decision in the future.
• The right to review your personal data used in the profiling.
• If inaccurate, the right to have the data corrected and the profiling decision reevaluated based on the corrected data.

ADITIONAL RIGHTS FOR USERS IN CALIFORNIA

If you are a resident of California, in addition to the rights listed above common to all users in the United States, you have the following rights under the CCPA/CPRA:

• Right to know the categories of personal information we collect and how it is used.
• Right to access specific pieces of information we hold.
• Right to deletion of your personal information, with certain exceptions.
• Right to correct inaccurate information.
• Right to opt out of the sale or sharing of personal information.
• Right to limit the use and disclosure of sensitive personal information.
• Right to non-discrimination for exercising your rights.

We do not use sensitive personal information for inferring characteristics or for purposes other than those that are reasonably necessary to provide the requested services. Sensitive personal information is not sold or shared for cross-context behavioral advertising.

In addition, California residents may exercise their rights through the following clearly-labeled links provided on this website:

• «Do Not Sell or Share My Personal Information»«Limit the Use of My Sensitive Personal Information»

These links allow users to opt out of cross-context behavioral advertising, targeted advertising, or the use of sensitive personal information.

How to exercise your privacy rights under US state laws

To exercise the rights described above, you need to submit your request according to the details in the «How To Contact Us» section of this document.

For us to respond to your request, we must know who you are. We will not respond to any request if we are unable to verify your identity and therefore confirm the personal information in our possession relates to you. You are not required to create an account with us to submit your request. We will use any personal information collected from you in connection with the verification of your request solely for verification and shall not further disclose the personal information, retain it longer than necessary for purposes of verification, or use it for unrelated purposes.

If you are an adult, you can make a request on behalf of a child under your parental authority.

How to exercise your rights to opt out

In addition to what is stated above, to exercise your right to opt-out of sale or sharing and targeted advertising you can also use the cookie banner, consent management options or privacy choices link provided on this website.

If you want to submit requests to opt out of sale or sharing and targeted advertising activities via a user-enabled global privacy control, such as for example the Global Privacy Control, you are free to do so and we will abide by such request in a technically frictionless manner.

How and when we are expected to handle your request

We will respond to your request without undue delay, but in all cases within the timeframe required by applicable law. Should we need more time, we will explain to you the reasons why, and how much more time we need.

Should we deny your request, we will explain to you the reasons behind our denial. Afterwards, you may at your option then contact the relevant regulatory authority to submit a complaint.

We will not charge a fee to process or respond to your request unless such request is manifestly unfounded or unduly excessive and in all other cases where it is permitted by the applicable law. In such cases, at our discretion, we may charge a reasonable fee or refuse to act on the request. In either case, we will communicate our choices to you and explain the reasons behind them.

RIGHTS FOR ALL USER

Regardless of where you live, we provide all users with the ability to:

• Request access to the personal information we hold.
• Request corrections or updates.
• Request deletion where appropriate.
• Withdraw consent where processing is based on consent.

You can submit a request to exercise your rights by contacting us using the details provided in the «How To Contact Us» section. Users in jurisdictions requiring consent for cookies and tracking (e.g., EU/EEA) may withdraw consent at any time via the cookie banner, privacy settings page, or by contacting us. Withdrawal does not affect the lawfulness of processing performed before withdrawal. We may need to verify your identity before processing your request.

Our Services are not directed to children, but may be used by, or made available to, individuals under the age of 16. We do not knowingly collect personal information from children, but when we do so it is unsolicited, incidental or in accordance with applicable child data protection laws.

If you are a child, please do not attempt to register for the Services or send any personal information about yourself to us.

We may collect personal information from users under 16 without parental consent where this is permitted by applicable law and limited to what is necessary to provide our Services.

Parents or guardians who believe we may have mistakenly or unintentionally collected personal information of a child without appropriate consent may contact us to review, update, or request deletion of their child’s personal information by using the contact details provided in the «How To Contact Us» section.

We may update this Privacy Policy from time to time to reflect changes in our practices, operational needs, or applicable laws. When we make changes, we will update the “Last Updated” date at the top of this Policy.

We use the following method(s) to notify users of significant changes to this Privacy Policy:

• Posting a notice on our website

We encourage you to review this Privacy Policy periodically to stay informed about how we collect, use, and protect your personal information.

If you have questions, concerns, or requests related to this Privacy Policy or our handling of personal information, you may contact us using the details below:

• Legal Name: Club de Inversión Deusto
• Commercial Name: Deusto Investment Club
• Contact Email: info@deustoinvestmentclub.com
• Adress: Calle Hermanos Aguirre 2
• ZC: 48014
• City: Bilbao
• Region: Vizcaya
• Country: Spain

info@deustoinvestmentclub.com

C/ Hermanos Aguirre 2, Bilbao, Vizcaya

© 2026 Deusto Investment Club. All Rights Reserved

The content provided on this website is intended solely for educational and informational purposes and should not be construed as financial, legal, tax, or investment advice. No information contained herein constitutes a recommendation, solicitation, or offer to buy, sell, or hold any financial instrument, security, or strategy.

Trading and investing involve a substantial risk of loss and may not be suitable for every investor. Past performance is not indicative of future results. The authors of this content are not registered financial advisors. Users should conduct their own due diligence and consult with a certified financial professional before making any investment decisions. The creators of this website and Deusto Investment Club expressly disclaim any and all liability for decisions made or actions taken based on the information provided herein.