In accordance with Regulation (EU) 2016/679, of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, this Privacy Policy contains information to help you clearly and easily understand what type of personal data we collect, what we use them for and what your rights are.



The controller of the personal data you provide us is KATEGORA INVESTMENTS, S.L. (“Kategora”), a company with registered office at Gran Vía Don Diego López de Haro 2 – 8º izq., 48001 Bilbao (Bizkaia). You can find our contact information on our website


Data categories

Browsing the website does not require user registration; therefore, people visiting the website do not need to give us any personal data to browse through it and consult the information published on it.

Kategora will only collect the personal data that data subjects voluntarily provide us when they fill out the contact form, subscribe to our newsletter or send us any requests or questions through our contact channels. In general, the personal data that we process is limited to identification or contact information (such as your email address when you subscribe to our newsletter) or your name, email address and phone number when you fill out the contact form. Kategora will only ask you for personal data that is necessary for properly managing and responding to your requests and questions. The mandatory data will be marked on the form.

If you decide to hire our services, we may request your personal data that, in each case, may be necessary for the provision of our services, to manage our relationship with you as a client for administrative and invoicing purposes and to comply with our legal obligations and internal procedures. These data my include your first and last name, marital status, ID number [DNI] and/or economic data. The personal information that we process will vary depending on the scope of the consulting services we provide and will also depend on if you are hiring our services personally as a natural person or if you are doing so as a businessperson or acting on behalf of a company.

If you wish to work for us and decide to send us your CV, we will process the personal data in the job application and will include your identification and contact information as well as information about your education and professional experience.


Purposes and legitimate basis

How we use your data will depend on the purpose for which you have provided them to us in each case. Below, we explain the purposes for which we will use your data in each case and the legal legitimate basis:

  • Questions and contact: When you contact us, we will use your identification and contact information to handle your requests, answer the questions you communicate to us or send you the information requested. In this case, the legitimate basis is the consent you give us by voluntarily providing us with your data, and our legitimate interest in properly responding to all the questions and requests we receive.
  • Newsletter and commercial communications: When you subscribe to our newsletter or, when filling out the contact form, you indicate your interest in receiving our commercial and informative communications, we will use your contact information on the basis of your consent to periodically send you information by email on our services, promotions and activities and keep you updated on news and developments related to our business that might be of interest to you. In any case, you can decide at any time to unsubscribe from our newsletter by clicking the “unsubscribe” option included in all the communications we send you.
  • Job applications: If you decide to send us your CV, we will use the data you provide us to evaluate your profile, assess your possible incorporation into our company and notify you of any open selection processes or future vacancies. In this case, the legitimate basis is the consent you give us when voluntarily providing us with your data, and our legitimate interest is assessing if your profile and training fit any vacancies we have at that time or may have in the future.
  • Clients: If you hire our professional services, we will use your data to manage the contractual relationship that you, as a client, initiate with Kategora (i.e. to provide our services and manage our relationship with you) for internal administrative and operational purposes, invoicing and charging for our services, to fulfill the legal obligations to which we are subject and to keep you informed about our services, promotions, news and activities similar to the services you have contracted with us. In this case, the legitimate basis is the execution of the contractual relationship established with us when becoming our client, fulfillment of the legal obligations derived from said relationship and our legitimate interest in keeping our clients informed about our activities and services. In the latter case, you may object at any time to receiving our commercial communications by email by clicking the unsubscribe option in the communications we send or by sending an email to with “unsubscribe newsletter” in the subject line.


Data storage

We will only process your personal data for as long as we need it to comply with the purposes for which you have provided us with them, in each case, as described in this Privacy Policy or to comply with the legal obligations to which we are subject. When we no longer need to use your information, we will delete it or keep it properly blocked while we need to store it for compliance with our legal obligations or defense against legal claims.

If you send us your CV and we have no vacancies that fit your profile at that time, we can keep it for a maximum period of two years (unless you request us to delete it before) to keep you in mind or inform you of future selection processes. Once that period has elapsed, or at the moment you notify us of your request (whichever occurs first), we will delete your CV and any other information that you have provided us.

If you are or have been our client, we will process your personal data while our contractual relationship is in force and we will keep them as long as legal or contractual responsibilities may arise from said relationship or the legislation in force in each case so requires (for example, to fulfill our accounting and fiscal obligations). For the commercial and informative communications we send, we will only use the contact information until the data subject decides to unsubscribe.



Kategora will not transfer personal data to third parties, unless the data subject expressly authorizes it or when it is mandatory for compliance with a legal obligation or a court order. If mandatory, we may occasionally share certain personal data with our clients when it is necessary for the proper performance of the services hired: for example, depending on the nature of the professional assignment entrusted to us, it may be necessary to send some personal information to notary publics, registrars, lawyers, financial entities or other companies or professionals involved in the operation or matter related to the services we provide. In such cases, we will be limited to sharing only the data that are strictly necessary to fulfill our obligations within the framework of the services we provide. If we provide professional services for operations related to assets located outside of Spain, the personal data may be transferred to said countries (in an international transfer), provided that it is necessary for the execution of the professional assignment entrusted to us.

On the other hand, like any other company, Kategora needs to use outside suppliers that may potentially have limited access to some of Kategora’s business information, which may include personal data. In any case, these suppliers will only access said information in order to provide us with their services (for example, document management and storage services, email services or external audit services) and will process such data under our instructions and in a confidential manner. If we use suppliers located outside of the European Economic Area, we take additional measures to use suppliers located in countries that adhere to standards (such as the Privacy Shield between the US and the EU) that the European authorities deem comparable to the guarantees offered in the European Union (such as Hubspot, a US entity that adheres to the Privacy Shield and provides us with CRM and email marketing tools).



When you provide us with your data, you must give us lawful, correct and up-to-date information. Kategora rejects any type of liability derived from the contribution of false, inaccurate or outdated information. You must refrain from providing us with the personal data of third parties and, if you do, you must notify them, in advance and under your sole responsibility, of the points set out in this Privacy Policy and obtain their consent to do so. In no way will we be liable for the possible consequences should you fail to do so.



You may at any time exercise the rights granted to you in the current legislation, sending a written request to our mailing address together with a copy of your DNI or equivalent official document.

These rights include the following possibilities:

  • Request access to your personal data, update them or rectify them if they are inaccurate;
  • Object to us processing your information for certain purposes;
  • Request the restriction of processing in certain cases;
  • Request their erasure if the data are not necessary for the purposes for which they were collected; and
  • Under certain circumstances, request the portability of the personal data.

You also have the right to object, at any time, to receiving our commercial communications by clicking on the unsubscribe option included in all the communications we send by email or by sending an email to with “unsubscribe newsletter” in the subject line.

Likewise, you have the right to file a claim before the Spanish Data Protection Agency [Agencia Española de Protección de Datos] ( if you believe the applicable regulations have been breached.



We do not voluntarily collect or process the personal data of minors unless they prove that they have the authorization of their parents or legal guardians. Given that we do not have the means to verify the age of those who provide us with their data, we assume that, by giving us your data, you guarantee that you are over the age of 18. In any case, we may request that you prove your age if we have reasonable doubts or suspicions.