Your data matters

Last updated: November 17, 2025

1. Who is the data controller?

The controller of the personal data processed through this Website is:

Niara Estates S.L.(trading as UpWise Consulting)
Registered address: Calle Río Duero 14–28, 28660 Boadilla del Monte, Madrid, Spain
Tax ID (CIF): B10956290
E-mail: montecelos@upwise.es

In this Privacy Policy, “UpWise Consulting”, “we”, “us” or “our” refers to Niara Estates S.L. trading as UpWise Consulting.

2. What data do we collect and how?

We may collect and process the following categories of personal data when you interact with the Website:

• Identification and contact data: name, surname, professional e-mail address, phone number, company name, job title or role.
• Communication data: information you provide in the body of a message when you contact us (for example, the content of your enquiry).
• Technical and usage data: IP address, browser type and version, time zone settings, pages visited, clickstream data and other data generated by cookies and similar technologies (as described in our Cookie Policy).

We collect this data in the following ways:

• Directly from you, when you fill in a contact form, send us an e-mail, subscribe to updates or otherwise interact with us.
• Automatically, through cookies and similar technologies when you browse the Website (see our Cookie Policy).

We do notintentionally collect any special categories of data (such as health data, political opinions, religious beliefs or other sensitive data) through this Website. Please refrain from sharing such type of data.

3. For what purposes do we use your data?

We process your personal data for the following purposes:

1. To respond to your enquiries and manage your relationship with us
• Handling contact requests, meeting requests or other questions submitted via the Website.
• Managing relationships with clients, prospective clients and other professional contacts.
2. To send you professional information and communications related to our services
• Providing you with information about our services, events, insights or updates that may be relevant to you in your professional capacity.
3. To operate, secure and improve the Website
• Monitoring the performance and security of the Website.
• Producing aggregated statistics and analytics on how visitors use the Website, in order to improve its content and usability.
4. To comply with legal obligations and defend our rights
• Complying with obligations arising from applicable laws and regulations.
• Managing potential claims, complaints or legal proceedings.

4. What is the legal basis for processing your data?

We primarily rely on legitimate interest under Article 6(1)(f) of the General Data Protection Regulation (“GDPR”) to process your data, specifically:

• Our legitimate interest in responding to your enquiries and maintaining professional and business relationships.
• Our legitimate interest in promoting our services to existing and potential corporate clients in a proportionate and non-intrusive manner.
• Our legitimate interest in ensuring the security, proper functioning and improvement of the Website.
• Our legitimate interest in defending our legal rights and interests.

Where required by law (for example, for certain types of electronic marketing communications in specific jurisdictions), we may also rely on your consentfor sending you such communications. In those cases, you will be clearly informed and given the choice to provide or withhold consent.

You may object at any time to processing based on our legitimate interests (see section 9).

5. How long do we keep your data?

We retain your personal data for as long as there is an ongoing or potential commercial relationship or legitimate business interest, and in any case:

• For contact and relationship management data: for as long as we reasonably consider that there is a legitimate interest in maintaining contact with you or your organisation, and until you object or request deletion.
• For technical and analytics data: for the periods indicated in our Cookie Policy or as required by applicable regulations.

In all cases, we may retain data for longer where necessary to comply with legal obligations or for the establishment, exercise or defence of legal claims.

When data is no longer required for the purposes described above, it will be securely deleted or anonymised.

6. Who do we share your data with?

We may share your personal data with:

• Service providers who support us in operating the Website and our business (e.g. hosting providers, IT and security services, analytics tools, e-mail delivery platforms, CRM systems). These providers act as processors and are bound by data processing agreements.
• Professional advisers (such as lawyers, tax advisers or auditors), where necessary to protect our rights or comply with legal obligations.
• Public authorities or courts, where required by applicable law or in order to exercise or defend legal claims.

In certain cases, and only where it is relevant to your enquiry or request, we may share your contact details with trusted strategic partners who offer complementary professional services (for example, insurance brokerage services or incentive plan administration tools). These partners will act as independent data controllers and will process your data solely for the purpose of assessing and responding to the specific request or service you have asked us to facilitate. You will be informed whenever such a referral is made, and each partner will provide its own privacy information in accordance with applicable law

We do not sell your personal data.

7. International transfers of data

As of the date of this Privacy Policy, we do not intentionally transfer personal data collected through the Website to countries outside the European Economic Area (“EEA”).

If in the future we were to use service providers or tools that involve transfers of personal data outside the EEA, we will:

• Inform you in an appropriate manner, for example by updating this Privacy Policy; and
• Ensure that suitable safeguards are in place, such as the European Commission’s Standard Contractual Clauses or equivalent mechanisms, in accordance with applicable data protection laws.

8. Security of your data

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction or damage. These may include encryption in transit (TLS), access controls, logging and other safeguards proportionate to the nature of the data and the risks involved.

However, no method of transmission over the internet or method of electronic storage is completely secure. While we strive to use reasonable measures to protect your data, we cannot guarantee absolute security.

9. What are your rights?

Under the GDPR and applicable national laws, you may have the following rights in relation to your personal data:

• Right of access: to obtain confirmation as to whether we process your personal data and to receive a copy of such data.
• Right to rectification: to request correction of inaccurate or incomplete data.
• Right to erasure: to request deletion of your data in certain circumstances.
• Right to restriction of processing: to request limitation of processing in certain cases.
• Right to data portability: to receive the data you have provided in a structured, commonly used and machine-readable format and to transmit it to another controller, where applicable.
• Right to object: to object at any time to processing based on our legitimate interests, including profiling. In such case we will stop processing unless we can demonstrate compelling legitimate grounds or the processing is necessary for legal claims.
• Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of processing prior to withdrawal.

To exercise your rights, you may contact us at: ralas.niara@upwise.esindicating “Data protection” in the subject line and specifying the right you wish to exercise.

You also have the right to lodge a complaint with the competent data protection authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD).

10. Cookies and similar technologies

We use cookies and similar technologies on the Website. For detailed information on the types of cookies we use, the purposes for which we use them and how you can manage your preferences, please read our Cookie Policy.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example to reflect changes in the law, our practices or the technologies we use. The updated version will be posted on the Website with an indication of the last updated date.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.