Privacy Notice

This Privacy Notice explains how personal data is used when you use Lend2Friend.

Lend2Friend processes data to operate the Platform (account, interface, matching software, operational logs). Partner Firm, S.L. (the “Firm”) processes data as the crowdfunding service provider (customer relationship, investor protection steps, credit decisions, complaints). Payment Firm, S.L. (the “Payment Firm”) processes data to provide payment, safeguarding, payout, direct-debit, and hosted identity services.

Each party may be a controller for its own purposes, or a processor for another, as set out in contracts between them. Where Lend2Friend processes data solely on the Firm’s documented instructions for the crowdfunding service, it acts as a processor under GDPR Article 28.

Identity and contact data: name, email, password hash, country of residence, role (lender or borrower), business or trade name for borrowers.

Legal acceptance data: the version of the Terms of Use and Privacy Notice you accepted, the time of acceptance, and which acknowledgments you confirmed.

Onboarding and compliance data: identity-check status and session identifiers from the Payment Firm; verified legal name and identity-document type, number, and issuing country returned by the Payment Firm’s check (document images stay with the Payment Firm); Spanish IBAN tokens and masked account details; knowledge-test and loss-simulation outcomes and timestamps; Article 21 acknowledgments; credit-file information (legal form, tax id, sector, turnover band, purpose, attestations) for borrowers; Firm credit status and notes.

Transaction and loan data: orders, matches, schedules, instalments, collection attempts, ledger copies, payout statuses, payment references, and related operational incidents.

Technical data: device/browser metadata, IP address, logs needed for security, fraud prevention, and digital operational resilience.

Creating and securing your account — contract performance (GDPR Art. 6(1)(b)).

Providing the Platform and matching software — contract performance.

Enabling the Firm’s crowdfunding service and the Payment Firm’s payment services — contract performance and legal obligation of the Firm / Payment Firm (including AML, investor-protection, and payment-services rules).

Credit assessment for business borrowers — legitimate interests of the Firm and legal obligation / public interest where financial regulation requires; you will be told if automated aspects are used and of any human-review path the Firm provides.

Preventing fraud, abuse, and ICT incidents; reconciliation; audit — legitimate interests and legal obligation (including DORA-related operational resilience for the Firm).

Sending service messages, contracts, risk warnings, and required regulatory notices electronically — contract performance and legal obligation.

Optional marketing from Lend2Friend only if you opt in separately — consent (Art. 6(1)(a)), withdrawable at any time.

The Firm (Partner Firm, S.L.) and the Payment Firm (Payment Firm, S.L.), as required to run the service.

Infrastructure providers (for example hosting and database) acting as processors under written contracts.

Professional advisers, auditors, and competent authorities (including the CNMV or other supervisors) where required by law or for the Firm’s authorisation.

We do not sell your personal data.

Data is primarily processed in the EEA (this deployment targets EU regions). If a processor outside the EEA is used, appropriate safeguards (such as Standard Contractual Clauses) will be applied as required by GDPR Chapter V.

Account and loan records are kept for as long as needed to operate the service and to meet legal retention duties. Crowdfunding and AML rules often require retention for several years after the end of the business relationship or after loan maturity (commonly five years or more for certain records — the Firm’s policy prevails for regulated records).

When you delete an account and no live obligations remain, we delete or anonymise Platform copies that we are not required to keep. Payment Firm and Firm retention may continue independently.

Under GDPR you may have rights of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent where processing is consent-based. You also have the right to lodge a complaint with the Agencia Española de Protección de Datos (AEPD).

To exercise rights concerning Platform accounts, contact Lend2Friend. To exercise rights concerning the crowdfunding customer relationship or credit file, contact Partner Firm. To exercise rights concerning payment identity or bank details held by the Payment Firm, contact Payment Firm, S.L. or use the path the Firm publishes. We will help route your request where needed.

We apply technical and organisational measures appropriate to the risk (access control, encryption in transit, least-privilege operations, logging, and a kill switch for payment rails). No method of transmission or storage is perfectly secure. Report suspected account compromise immediately.

The Platform is not directed at persons under 18. We do not knowingly collect data from children.

We may notify you of material changes to this Privacy Notice in the Platform or by email. Service and regulatory messages described in the Terms of Use may also be sent electronically.

We may update this Privacy Notice. The version (2026-10-28a) and effective date (28 October 2026) will change when we do. Material changes will be notified in the Platform or by email.

By ticking “I have read and accept the Privacy Notice” when you create an account, you confirm that you have read this notice (version 2026-10-28a) and understand how Lend2Friend, the Firm, and the Payment Firm process your personal data as described here.

Lend2Friend — privacy contact as published on the Platform. Firm: Partner Firm, S.L.. Payment Firm: Payment Firm, S.L.. Supervisory authority: Agencia Española de Protección de Datos (aepd.es).