Privacy Policy

We may update this Privacy Policy at any time. The current version will always be available on https://chvmpionmind.com.

12. Professional contacts, investor relations and partnerships

CHVMPION MIND Technology S.L. may process limited professional contact information concerning investors, advisers, potential partners and other business representatives when evaluating a possible professional relationship or communicating about a relevant corporate, financing or partnership matter.

Categories of data. We may process your name, professional role, employer or affiliated organisation, professional email address, professional profile or company-page URL, geographic and investment-focus information, the public or referral source from which the information was obtained, our communication history, and your response or communication preferences. We do not intentionally collect special-category data for this purpose.

Sources. Data may be obtained from publicly accessible professional profiles, company or fund websites, professional directories, business publications, referrals made by professional contacts, and information you provide during correspondence.

Purposes. We use this information to assess whether a professional investment, advisory, referral or partnership conversation may be relevant; conduct proportionate one-to-one business outreach; manage correspondence and follow-up; maintain accurate CRM records; and record objections, unsubscribe requests and do-not-contact instructions.

Legal basis. Where applicable, the legal basis for processing is our legitimate interest in developing and financing our business and communicating with professional contacts whose role appears relevant, under Article 6(1)(f) GDPR. We apply data minimisation, relevance, role and source checks, limited outreach frequency, human review, and immediate suppression after an objection. We document a legitimate-interest assessment and do not rely on this basis where the individual’s interests, rights or reasonable expectations override our interest.

The legality of sending each electronic communication is assessed separately under the rules applicable to electronic marketing and the recipient’s jurisdiction. A legitimate interest under the GDPR does not automatically permit an unsolicited commercial email.

Internal prioritisation. We may use professional role, organisation, geography and publicly stated investment focus to prioritise contacts for human review. We do not make solely automated decisions that produce legal or similarly significant effects concerning you.

13. Recipients, transfers and retention of professional-contact data

Recipients and processors. Access is limited to authorised CHVMPION MIND personnel and service providers supporting email, hosting, CRM, security and professional advice, acting under appropriate contractual and confidentiality obligations. Data may also be disclosed where required by law.

International transfers. Where a service provider processes data outside the European Economic Area, CHVMPION MIND uses an applicable adequacy decision, Standard Contractual Clauses or another legally recognised safeguard, as appropriate. Information about relevant safeguards may be requested using the contact details in this policy.

Retention. Prospect and correspondence records are retained only for the relevant financing or business-development cycle and are reviewed no later than 12 months after the last meaningful interaction. Records may be retained longer where an active relationship, legal obligation or legal claim requires it. A minimal suppression record, normally the email address, date and reason for suppression, may be retained for as long as necessary to ensure that an objection or unsubscribe request is respected.

14. Information and rights of professional contacts

Where personal data was not obtained directly from you, we will provide the information required by Article 14 GDPR within the applicable legal period and, at the latest, in our first communication. You may request access, rectification, erasure or restriction, and you may object at any time to processing for direct-marketing purposes. When you object to direct marketing, we will stop using your personal data for that purpose.

You may exercise your rights by contacting [email protected] or by replying “Unsubscribe” to an outreach message. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) or another competent supervisory authority.

15. Request deletion of your ChVmpionMind account

If you have a ChVmpionMind app account, you can request account closure and erasure of your data by writing to [email protected] — request account deletion. You can use this channel after uninstalling the app. State the email used to register the account and the right you wish to exercise. Do not send passwords or identity documents; only where there are reasonable doubts about your identity may we request additional information strictly necessary to verify it.

The GDPR requires us to inform you of action taken on your request without undue delay and, generally, within one month of receipt. If the complexity or number of requests requires extending the period by up to two further months, we will explain the reasons within the first month. If a request cannot be fulfilled, we will explain why and your complaint options. Erasure is handled under Article 17 GDPR; where certain data must be retained for a legal obligation or to establish, exercise or defend legal claims, we will explain the relevant categories, reasons and retention periods. The response periods concern handling of the request; the response will explain the outcome, any exceptions and the applicable periods.

Account deletion and subscription cancellation are separate processes. Check the account and subscription terms to manage renewal through the relevant purchase channel.

16. App infrastructure and locations

According to the technical configuration confirmed on 8 October 2026, the ChVmpionMind app uses the following Firebase services:

• Primary database: Cloud Firestore is hosted in eur3, a European multi-region location.
• Backend functions: The deployed configuration reviewed on 14 October 2026 includes Cloud Functions in europe-west1 and europe-west3, in Europe, and in us-central1, in the United States. Deployment location does not, by itself, establish which functions process a particular person’s data.
• Files and media: Firebase Storage is currently hosted in the central United States.

Files stored. The technical confirmation received on 9 October 2026 identifies additional documents, reports and coach images, as well as programme cover images and company and consultancy logos associated with content created or managed by users. Storage is not limited to ChVmpionMind’s own resources. Depending on their content, these files may include personal data, for example, if an image identifies a person or a document contains information about them.

These files are used to provide documentation, present programmes and organisations, and store images and reports related to the services. Where they contain personal data, the purposes, legal bases, transfer safeguards and rights described in this policy apply. Requests to access or erase personal data contained in files can be made through the channel described in section 15. An image no longer being displayed or linked to a record does not by itself confirm that it has been deleted from storage.

A migration of files and media to a European location is planned. Until that migration is completed and verified, their storage remains in the United States. This notice will be updated when the new configuration has been confirmed.

These locations relate to the listed services and do not mean that all data processing takes place exclusively in the European Union. Authentication, AI, subscriptions, communications, diagnostics and support services may have their own locations and terms. In particular, Google states that Firebase Authentication processes data exclusively in the United States; changing the Storage location does not change that characteristic of the authentication service.

For information on international transfers and the applicable safeguards, see section 7 and contact [email protected]. Rights requests and account deletion are explained in section 15.