Privacy notice

The data controller is [Fabaía Co. legal entity name], [registered address]. Privacy questions and data-rights requests: hola@fabaia.co. [EU/UK representative, if required.] [Data protection officer, if appointed.]

Information you submit. Through the Base Camp and investor inquiry forms we collect: name, professional email, company or firm, region or geography, likely engagement type, and the challenge or question you describe. Investor inquiries may additionally include investment stage, sector, transaction timeline, number of brands and whether an NDA is required. We also record your consent and the interface language you were using.

Information collected automatically. Our hosting and database providers process technical request data such as IP address, timestamp, user agent and error logs for security, abuse prevention and reliability.

What we do not do. The site sets no advertising or tracking cookies and runs no third-party analytics or marketing pixels. Your language selection is stored locally in your browser and is never sent to us as an identifier. Because we set no non-essential cookies, no cookie consent banner is required. If analytics or marketing tooling is added later, this notice and a consent mechanism will be added before it goes live.

Please do not submit special-category data, confidential deal information or material non-public information through the web form. Use email or an executed NDA instead.

• Responding to your inquiry — lawful basis: steps taken at your request prior to entering a contract (Art. 6(1)(b)), and your consent (Art. 6(1)(a)) where you tick the consent box.
• Assessing fit and scoping an engagement — legitimate interests (Art. 6(1)(f)) in operating a professional advisory practice.
• Security, fraud prevention and service reliability — legitimate interests (Art. 6(1)(f)).
• Legal and record-keeping obligations — legal obligation (Art. 6(1)(c)) where applicable.

We do not sell personal data, and we do not use it for automated decision-making or profiling that produces legal or similarly significant effects.

We use a small number of processors under written data-processing terms. They act only on our instructions:

• Application hosting and content delivery — [provider, hosting region].
• Managed database and backend storing inquiry submissions — [provider, hosting region].
• Business email used to correspond with you — [provider].

Where a processor operates outside the EEA or UK, transfers are made under appropriate safeguards such as the European Commission's Standard Contractual Clauses together with the UK Addendum, supported by a transfer risk assessment. [Confirm current providers, regions and transfer mechanism before publication.]

Inquiry submissions are retained for up to 24 months from your last contact with us, so we can follow up on a conversation you started, and are then deleted or anonymised. Records connected to a signed engagement are retained for the period required by our professional, contractual and tax obligations. Technical and security logs are retained for the short periods set by our hosting and database providers. You can ask us to delete your inquiry sooner at any time.

Inquiry data is stored in a managed database with row-level security configured so that the public website can submit an inquiry but cannot read, edit or delete stored submissions. Data is encrypted in transit over HTTPS and encrypted at rest by our database provider. Access to submitted inquiries is limited to Fabaía Co. personnel who need it to respond. No system can be guaranteed absolutely secure; we do not claim end-to-end encryption or any security certification.

Subject to the conditions in applicable law, you may request access to your data, correction, erasure, restriction of processing, portability, and you may object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time without affecting processing carried out before withdrawal.

To exercise a right, email hola@fabaia.co. We respond within one month and may ask for information needed to verify your identity. If you are unhappy with our response you can complain to your local supervisory authority [name the lead supervisory authority once the establishment is confirmed].

To report a suspected vulnerability or data incident, email hola@fabaia.co with the subject line "Security". Please do not include exploit details or personal data of third parties in your first message. Where a personal-data breach is likely to result in a risk to individuals, we notify the competent supervisory authority and, where required, affected individuals.

The site is a business-to-business service intended for professional audiences. It is not directed at children and we do not knowingly collect data from them.

We update this notice when our practices or providers change, and revise the "last updated" date above. Material changes affecting how we use your data will be communicated by email where we hold a business relationship with you.