Privacy policy

Balestra Real Estate Debt, a subsidiary of Balestra, attaches great importance to the protection of your personal data and undertakes to comply with the applicable regulations, in particular the General Data Protection Regulation (GDPR) and the French Data Protection Act.

Article 1 — Data controller

The controller of the data collected through the Platform is:

• Company name: Spada Capital (trading name: Balestra Real Estate Debt)
• Legal form: Société par actions simplifiée (SAS)
• SIREN: 999 600 471 — RCS Paris
• Address: 39 avenue Pierre 1er de Serbie, 75008 Paris
• Email: contact@balestra-red.fr

For processing linked to regulatory obligations (AML/CFT, AMF compliance), Balestra, the parent company and a management company authorised by the AMF, may act as joint controller in accordance with Article 26 GDPR.

Article 2 — Data collected

In connection with the use of the Balestra Real Estate Debt Platform, we collect the following categories of data:

Identification data

• Surname, first name, gender
• Email address
• Telephone number
• Postal address

Data about your project

• Company information (SIREN, legal form, share capital)
• Description of the real estate project
• Financial data (amounts, ratios, forecasts, accounts)
• Address and characteristics of the project

KYC data (know your customer)

• Date and place of birth, nationality
• Type and number of identity document
• Percentage held in the company
• PEP status (politically exposed person)
• Results of compliance checks (sanctions, PEP)

Documents

• Financial, legal and administrative documents uploaded (original files)
• Data extracted automatically from those documents by the AI systems

AI conversation data

• Messages exchanged with the intelligent assistant
• Summaries and analyses generated by the AI

Banking data

• Bank details (IBAN, BIC) in connection with loan management

Technical and connection data

• IP address, user agent
• Connection timestamps
• Audit logs of actions carried out on the Platform

Geolocation data

• Geographic coordinates of real estate projects (for market analysis)

Article 3 — Purposes and legal bases

Your data is processed for the following purposes:

Article 4 — Artificial intelligence and automated processing

• Your documents and conversations are processed by artificial intelligence systems in order to extract information, classify it and provide analyses.
• This processing is carried out by third-party providers (OpenAI, Anthropic) as part of the delivery of the Services.
• No legal or financial decision is taken automatically on the sole basis of this processing. Every financing decision is taken by human analysts at Balestra Real Estate Debt.
• You may request human intervention, express your point of view or contest an analysis by contacting contact@balestra-red.fr.
• Data is transmitted in pseudonymised form wherever technically possible.

Article 5 — Recipients and processors

Your data may be disclosed to the following categories of recipient, strictly to the extent necessary to deliver the Services:

Technical processors

• Upsun (Platform.sh SAS) — Application hosting — France/EU
• Amazon Web Services (AWS) — Secure document storage — EU (eu-west-3 region, Paris)
• Google Cloud (Places API) — Geolocation and address completion for real estate projects — United States (head office), EU processing
• Cloudflare, Inc. — Protection of public forms against robots (Turnstile: registration, forgotten password, financing enquiry) — United States; processing governed by Cloudflare's Turnstile Privacy Addendum (https://www.cloudflare.com/turnstile-privacy-policy/)

AI processors

• OpenAI, L.P. — Document analysis and conversational assistance — United States
• Anthropic, PBC — Alternative AI provider — United States

Compliance processors

• Refinitiv (LSEG) — Sanctions and PEP checks (WorldCheck) — United Kingdom
• INPI — French national business register — France

Additional technical processors

• Brevo (Sendinblue SAS) — Transactional emails and MFA codes — France
• Sentry (Functional Software, Inc.) — Technical error monitoring — United States (technical data only, no identifying personal data)

Authorities

• AMF, TRACFIN — Where there is a legal reporting obligation

Article 6 — International data transfers

Some of our processors are located outside the European Economic Area (EEA), in particular in the United States (OpenAI, Anthropic, Sentry, Google Cloud) and in the United Kingdom (Refinitiv).

These transfers are framed by the following safeguards:

• The standard contractual clauses (SCCs) adopted by the European Commission.
• The European Commission’s adequacy decision for the United Kingdom.
• The EU-US Data Privacy Framework where the processor is certified under it.

Balestra Real Estate Debt undertakes to put data processing agreements (DPAs) in place with all of its processors.

You can obtain a copy of the safeguards framing these transfers by contacting contact@balestra-red.fr.

Article 7 — Retention periods

Your data is retained for as long as is strictly necessary for the purposes for which it was collected:

Article 8 — Data security

We put the following technical and organisational measures in place to keep your data secure:

• Multi-factor authentication (MFA) mandatory for account access
• Encryption of communications (HTTPS/TLS) between your browser and our servers
• Secure sessions (HttpOnly cookies, SameSite=Strict, limited to 1 hour)
• Role-based access control (RBAC) — each user sees only the data matching their profile
• Audit trail with cryptographic integrity — a hash chain guaranteeing that logs cannot be altered
• Account lockout after failed login attempts
• HTTP security headers (HSTS, CSP, X-Frame-Options)
• Hosting on secure infrastructure within the European Union

Article 9 — Your rights

Under the GDPR, you have the following rights:

• Right of access: obtain confirmation that your data is being processed and receive a copy of it
• Right of rectification: request correction of inaccurate or incomplete data
• Right to erasure: request deletion of your data (subject to legal retention obligations)
• Right to object: object to processing of your data based on legitimate interest
• Right to restriction: request restriction of processing in the cases provided for by the GDPR
• Right to portability: receive your data in a structured, commonly used and machine-readable format
• Right not to be subject to an automated decision: request human intervention for any AI analysis concerning you
• Right to lodge a complaint: bring a complaint before the CNIL (Commission Nationale de l’Informatique et des Libertés), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07

To exercise your rights, contact us at contact@balestra-red.fr. We undertake to reply within one month of receiving your request.

Article 10 — Cookies

The Balestra Real Estate Debt Platform uses only essential cookies (session cookies) strictly necessary for the service to work.

These cookies are used to:

• Maintain your login session
• Keep your browsing secure (CSRF protection)

Duration: these are session cookies, deleted automatically when you close your browser.

No analytics, advertising or tracking cookie is used on the Platform. As these cookies are strictly necessary for the service to work, they do not require your consent, in line with CNIL guidance.

Article 11 — Amendment of this policy

This privacy policy may be amended at any time to reflect regulatory developments or changes in our practices. In the event of a substantial amendment, Users will be informed by email or by notification on the Platform. We invite you to consult it regularly.