Privacy Policy

Last updated: 7 October 2026

1. Data controller

This Policy explains how TOQEN KÂPITAL, S.A. (hereinafter, ‘Toqen’ or the ‘Company’) processes the personal data of those who request information, register on its platform or participate in its issues of bonds represented using distributed ledger technology (DLT).

Controller: TOQEN KÂPITAL, S.A.

NIF: A27577618.

Registered office: Calle Gabriel Miró 3, 3º, Oficina 10, 41704 Dos Hermanas (Sevilla), Spain.

Platform: toqenkapital.com

Privacy contact: rgpd@toqenkapital.com

Data Protection Officer: dpd@toqenkapital.com

Toqen owns the Platform and is the sole issuer of the bonds offered through it. It acts as data controller both in managing accounts and in preparing, formalising and performing the investment relationship. Selecting an issue does not entail the disclosure of data to another issuing company.

This Policy applies in accordance with Regulation (EU) 2016/679 (GDPR), Organic Law 3/2018 (LOPDGDD) and the sector-specific legislation applicable to each processing activity.

2. Collection of data

At the contact stage, we collect first name, surnames, telephone number, email address and, where applicable, the content of the enquiry. It is not necessary to provide identity documents or information about assets to request general information.

At registration, we collect the data necessary to create and protect the account. To enable investment, we also request the relevant information and documentation concerning identification, economic activity, source of funds and investor profile. The form will distinguish mandatory fields from optional fields and explain the consequences of not providing the former.

When an issue is selected, we process the data necessary to process the reservation and, where applicable, the subscription, keep a record of the informational and contractual documentation provided and manage the rights arising from the bonds. Creating an account does not constitute subscribing to an issue.

Making this Policy available and recording that it has been read do not constitute general consent to any processing. Each purpose relies on the legal basis indicated below.

3. Data, purposes and legal bases

3.1. Contact and user support

Data: first name, surnames, telephone number, email address, content of the enquiry and communications necessary to follow it up.

Purpose: to handle requests for information, respond to enquiries about the Platform or the issues and provide user support.

Legal basis: pre-contractual steps requested by the data subject where the enquiry concerns a potential contract; performance of the contract where support relates to an existing relationship; and a legitimate interest in handling other communications and general enquiries.

Retention: while the enquiry is being handled. Once it has been resolved, only the information necessary to demonstrate that it was dealt with or to address liabilities will be retained for the applicable limitation period. A request for information does not in itself result in the data subject being added to a marketing list.

3.2. Registration and account management

Data: identification and contact details, protected credentials, evidence of acceptance of the terms and of provision of information, IP address, and logs of access and security incidents.

Purpose: to create and maintain the account, authenticate the user, provide the contracted functionalities and send operational, contractual and security notices.

Legal basis: performance of the contractual relationship governing use of the Platform. The detection of unauthorised access, security and the prevention of impersonation are based on the legitimate interest in protecting users and systems, without prejudice to statutory security obligations.

Retention: for as long as the account remains active. Following account closure, only the data necessary for outstanding obligations and to address liabilities will be retained. Technical logs will be retained for a period proportionate to their security purpose; if they document an incident, for as long as necessary to investigate it and manage its consequences.

3.3. Commercial communications

Data: first name, surnames, email address and communication preferences; telephone number only where the corresponding channel is authorised.

Purpose: to send updates, promotional information on Toqen issuances and commercial communications relating to the Platform.

Legal basis: specific and optional consent, separate from registration and contracting. Refusing or withdrawing consent does not prevent you from requesting information, maintaining your account or managing an investment.

Retention: until consent is withdrawn. Thereafter, where necessary, evidence of consent being given and withdrawn will be retained to demonstrate compliance, together with the minimum suppression information required to prevent further communications.

Each electronic communication will offer a simple and free-of-charge unsubscribe mechanism. Unsubscription may also be requested at rgpd@toqenkapital.com. Essential notices concerning an investment, its payments or its contractual documentation are not for advertising purposes.

3.4. Investment management

Data: identification and contact details, representation, necessary economic and financial information, bank account ownership, proof of payment, investment amount and orders, reservation and subscription documentation, evidence of signature and acceptance, returns, redemptions and tax data.

Purpose: to process applications to participate in issuances, facilitate and evidence delivery of the information document or white paper, formalise reservations and subscriptions, manage collections, payments, tax obligations and the exercise of bondholders' rights.

Legal basis: pre-contractual steps requested and performance of the corresponding contracts; compliance with applicable tax, accounting and securities registration obligations.

Retention: during the processing and term of the investment and, subsequently, for the periods required by applicable legislation or necessary to deal with claims. Closure of the account does not extinguish the rights and obligations arising from bonds that have yet to be redeemed.

3.5. Appropriateness assessment

Data: responses concerning knowledge and experience of financial products and services, education and occupation where relevant, previous transactions, understanding of the bonds and their risks, assessment date, result and warnings communicated.

Purpose: to assess whether the user has the knowledge and experience necessary to understand the risks of the product, communicate the result and keep a record of the warnings and actions taken. This assessment does not constitute a personalised investment recommendation or guarantee returns or recovery of capital.

Legal basis: pre-contractual steps requested by the user to assess their access to the product and, where required of the entity carrying out the assessment, compliance with the corresponding sector-specific obligation.

Retention: during the processing and term of the investment relationship and, subsequently, for the retention and liability periods applicable to the assessment. The assessment will not be used as a source of data for commercial campaigns.

The necessary fields will be identified in the questionnaire. If the information is insufficient or the result is unfavourable, its consequence for the transaction will be communicated in accordance with the applicable access procedure. The assessment and review of its results are described in section 7.

3.6. Identity verification and prevention of money laundering

Data: identification details, date and place of birth, nationality and residence, identity document and its validity; professional or business activity; purpose and anticipated transactions; source of funds and, where justified by the risk, wealth and supporting documentation; representation, ownership structure and beneficial ownership; politically exposed person status and relevant connections; results of checks and transaction monitoring.

Purpose: to identify the investor, representatives and beneficial owners, cross-check the information provided, apply due diligence, assess and review the risk of money laundering and terrorist financing (AML/CTF), detect inconsistencies or relevant matches and respond to requests from the competent authorities.

Legal basis: compliance with the legal obligations for the prevention of money laundering and terrorist financing applicable to Toqen Kâpital, S.A., as an obliged entity by virtue of its property development activity, pursuant to Law 10/2010..

If an additional check is carried out exclusively for fraud prevention purposes, its scope will be limited to what is necessary and it will rely on the corresponding legitimate interest, following a balancing assessment. The AML/CTF retention regime will not automatically be extended to that processing.

Where Article 25 of Law 10/2010 applies, documentation will be retained for ten years from the termination of the business relationship or the execution of the occasional transaction. After five years, access will be restricted to internal control bodies, including technical prevention units, and, where applicable, those responsible for legal defence. At the end of the period, it will be deleted, unless a different, specifically applicable retention obligation exists.

Data obtained specifically for AML/CTF purposes will not be used for commercial campaigns or to target advertising. Failure to provide necessary information or the inability to complete the checks satisfactorily may prevent investment from being enabled or a transaction from being executed.

Identity verification is carried out through a specialist provider and includes facial recognition and a liveness check. Before images, videos or biometric data are captured, specific information will be provided on the procedure, the data processed, the legal basis, retention and rights. This Policy does not, in itself, authorise biometric facial matching.

3.7. Securities registration using DLT

Data: digital wallet address, technical identifiers, holdings, transaction records and data necessary to link the holder to their bonds.

Purpose: to manage the representation, entry, ownership and traceability of securities, their movements and events associated with the issuance.

Legal basis: performance of the investment relationship and compliance with the corresponding legal entry and registration obligations. The necessary data may be processed by the entity responsible for entry and registration (ERIR) within its own sphere of responsibility.

The Polygon network, a public blockchain, is used for TQK1. Wallet addresses, transactions and other recorded identifiers can be viewed through the network and its explorers, including by third parties unconnected with Toqen. The fact that data is public does not mean that it is anonymised.

Identifiers and wallet addresses may constitute personal data where they enable a person to be identified or linked to them, even if they do not include that person's name. Pseudonymisation is not equivalent to anonymisation.

Identification documents, contact details and KYC and anti-money laundering and counter-terrorist financing (AML/CTF) files will be kept off the blockchain. The link between identity and wallet address will be retained in separate systems with restricted access. The distributed ledger will be limited to the elements necessary to represent and manage the securities.

Records published on the network may persist and may not be technically capable of being erased. Toqen will give effect to rights in respect of data under its control and will coordinate with the ERIR (entity responsible for registration and record-keeping) on legally and technically appropriate actions. This characteristic does not entail a general waiver of data protection rights, nor does it permit any promise to erase public records.

3.8. Social media

Data: profile name or identifier, information visible to Toqen and interactions, comments and messages addressed to its corporate profiles.

Purpose: to manage those profiles, publish information about Toqen's activities, interact with users and respond to enquiries.

Legal basis: legitimate interest in maintaining a corporate presence and managing interactions, and pre-contractual steps or performance of the contract where the message relates to a specific request or service. Following a profile does not constitute consent to receive marketing communications through other channels.

Retention: for as long as the interaction remains available and is necessary for its management; enquiries transferred to Toqen's own systems will be retained in accordance with the purpose of handling them. Posts and profiles hosted on the social network are also governed by its operator's terms and conditions.

Toqen will not add followers' data to marketing databases merely because they follow its profiles. Where audience statistics or other functions involve joint controllership, the relevant agreement and specific information will be provided.

4. Sources of the data

The data come primarily from the data subject and their use of the Platform. Where the data subject acts through a representative or is a legal person, data concerning their representatives, directors and beneficial owners may be received through them.

For checks justified by their purpose and legal basis, legally accessible official registers may be consulted, including the Central Register of Beneficial Ownership where appropriate, applicable sanctions lists, sources concerning politically exposed persons and verification providers. Adverse news will be examined with regard to its reliability, currency and relevance; a match does not in itself amount to a finding of unlawful conduct.

Anyone providing data concerning other persons must limit such data to what is necessary and pass this Policy on to them. Toqen will provide the requisite information where data are not obtained directly from the data subject, in accordance with Article 14 GDPR and subject to the legally applicable exceptions.

5. Recipients

Data may be accessed by hosting and technological support, identity verification, electronic signature and communications providers acting on behalf of Toqen, subject to a data processing agreement and documented instructions.

Credit or payment institutions, the ERIR (entity responsible for registration and record-keeping) and other necessary participants may process the data as independent controllers where they determine their own purposes and obligations. They will be provided only with the data necessary for their involvement, on the basis of carrying out the investment or the applicable legal obligations. The ERIR is also involved in issues that are not listed on a market.

The TQK1 issue involves URSUS-3 CAPITAL, A.V., S.A., as ERIR (entity responsible for registration and record-keeping); José María Manzanares EAFN, in the validation and supervisory functions described in the Issuance Document; and the Commissioner of the Bondholders' Syndicate, for collective representation and the exercise of the rights of its holders. Their access will be limited to what is necessary for their functions. The project company, Las Laderas del Pinillo, S.L., does not receive investors' personal files merely by virtue of being financed.

Data may also be disclosed to the competent administrative, tax, judicial and supervisory authorities, including SEPBLAC in the circumstances provided for by law, as well as to professionals whose involvement in the defence of claims is justified.

The existence of corporate or commercial links with Toqen does not in itself authorise access to data. Each disclosure will be limited to the data and recipients necessary for its purpose.

6. International transfers

Where processing involves transferring data outside the European Economic Area, Toqen will apply the appropriate valid mechanism, such as an adequacy decision or standard contractual clauses accompanied, where necessary, by supplementary measures. It will not be presumed that using a European provider rules out access from third countries.

Information about destinations and a copy of or reference to the safeguards applied may be requested via rgpd@toqenkapital.com.

7. Profiling and review of results

AML/CTF checks may generate a risk classification based on identity, activity, residence, beneficial ownership, source of funds and consistency of transactions. The appropriateness assessment separately evaluates the user's knowledge and experience to assess their understanding of the risks. These results will not be used to target advertising.

The result of the appropriateness assessment is reviewed by a person before the corresponding decision on access to the investment is taken; that decision is not based solely on automated processing. KYC results will be assessed and reviewed manually by Toqen personnel, who will analyse the questionnaire and the documentation provided and, where necessary depending on the risk, request additional information or documentation before deciding whether to accept or continue the Business relationship.

The user may request a review of the results, express their point of view and rectify inaccurate data through the privacy contact, without prejudice to statutory restrictions on information in relation to AML/CTF. If decisions based solely on automated processing are taken which produce legal or similarly significant effects, specific information will be provided on the logic involved, its significance, its consequences and the available safeguards, including human intervention where appropriate.

8. Retention, security and rights

Once the purpose has been fulfilled, the data will be erased or, where appropriate, blocked for the period necessary to address specific liabilities. Blocking does not authorise continued use of the data or entail retaining the entire file indefinitely. Special retention periods will apply only to the documentation covered by them.

Toqen will adopt technical and organisational measures proportionate to the risk to protect the confidentiality, integrity and availability of the data, restrict access and manage incidents.

You may request access, rectification, erasure, restriction, objection and portability in the circumstances provided for by law, and withdraw your consent without retroactive effect. To do so, contact rgpd@toqenkapital.com or the address indicated, identifying yourself and specifying your request. Additional identification information will be requested only where necessary to resolve reasonable doubts about your identity.

You may object to processing based on legitimate interests on grounds relating to your particular situation and request information on the balancing of those interests. An objection to processing for direct marketing purposes will bring that processing to an end.

Requests will generally be dealt with within one month, which may be extended by a further two months due to the complexity or number of requests, with notification of the extension and the reasons for it provided within the first month. You may lodge a complaint with the Spanish Data Protection Agency via www.aepd.es.

These rights are subject to the limitations applicable by law, including retention obligations and the confidentiality of certain anti-money laundering and counter-terrorist financing (AML/CTF) measures. Opting out of commercial communications does not affect the processing necessary to manage bonds already subscribed for.

9. Cookies and policy updates

The use of cookies and similar technologies will be detailed in the Cookie Policy and in the Platform’s preferences system. Technologies requiring consent will remain disabled until consent is obtained. Reading this Policy does not replace that choice.

Toqen will update this Policy when processing activities change and will communicate material changes in an appropriate manner. If a new processing activity requires consent, it will request that consent separately before commencing it.