Privacy Policy

made pursuant to artt. 13 and 14 of EU REGULATION N. 2016/679 (“GDPR”)

The objective of UCapital24 S.p.A. (the “Company,” the “Data Controller”, or “We”) ") is to connect all economic and financial operators and business users on a global scale by serving as an “aggregator” between supply and demand and making available through the web platform of the same name fintech services and content, including an innovative platform, also usable through an App, which enables UCapital24 to be positioned in the market as the world’s leading Social Media fintech company.

1. Introduction:

Within the UCapital Social are available the typical features of a social network. Our Registered Users of the Social (“Users”) share the personal information entered within their profile as outlined below and in the Terms and Conditions of Use of the platform, interact with their network, exchange information, and may post and view content, exchange messages and create groups, public or private. Content and data published in the Social are visible to external users because a guest version is planned.

The sections Sharks, Academy, Media, and Brand have been integrated into the social platform, through which multiple services—both free and paid—are made available, as governed by the Terms and Conditions of Service.

The UCapital Sharks section is designed to connect and foster networking between investors and companies. It provides access to an extensive database of investors from around the world, including Family Offices, Venture Capital firms, Asset Managers, and Business Angels, along with a Marketplace featuring commercial listings addressed to parties seeking acquisitions, capital investments, or strategic partnerships.

The Academy section offers a financial education service, enabling users to acquire the skills, knowledge, and confidence necessary to succeed as professional traders.

The Media section may be regarded as a genuine news outlet, providing economic and financial information. Users may publish content within this section only upon prior authorization by the Data Controller.

The Brand section offers the opportunity to gain visibility within the social platform through sponsored advertisements, which, when clicked, redirect users to the respective Brand’s website.

The Business Desk is the reserved area through which the owners of a professional profile, a business page or a deal manage contacts, services, bookings and the statistics of their activity on the platform, including the “Who viewed you” feature described in section 4, letter o).

As part of the services offered, the platform also provides a financial Ai system designed to analyze aggregated data, generate statistical indicators, and suggest informational content. These systems do not replace human judgment and do not make automated decisions that produce legal effects or similarly significant impacts on Users. Any processing of personal data carried out through AI tools is conducted in compliance with the principles of transparency, proportionality, and data minimization under the GDPR, and with the adoption of appropriate technical and organizational measures to safeguard Users’ rights and freedoms.

In this context, this Privacy Policy, to be consulted in conjunction with the Cookie Policy, applies to Data Subjects’s use of our Services and how their data is collected and processed. Specifically, this Privacy Policy applies to the UCapital App as well as to other websites, applications, communications, promotional landing pages, sponsorships, and services related to the Data Controller UCapital24 (collectively, the “Services”), unless expressly stated otherwise in a dedicated privacy policy…

Where not otherwise specified, this Policy applies as a disclosure - pursuant to Articles 13 and 14 of Regulation (EU) No. 2016/679 (hereinafter the “GDPR”") - made to those who interact with the above sites (“Users”, “Interested Parties”, or “You”).

2. Data controller. Data Processors.

In relation to the personal data collected that is the object of this Privacy Policy, the Data Controller is UCapital24 S.p.A., with registered office at Via dei Piatti 11, 20123, Milan (MI), C.F. and P.IVA 10144280962, e-mail privacy@ucapital.com. The updated list of data processors is available upon request at the Data Controller’s office.

3. Data Protection Officer.

The Data Controller has appointed a Data Protection Officer (“DPO” or “RDP”), pursuant to Article 37 of the GDPR, who is responsible for supervising compliance with data protection regulations and acting as a point of contact for data subjects and who can be contacted for any needs pertaining to the processing of personal data by writing to the following e-mail address: dpo@ucapital.com.

4. Categories of personal data processed, source from which they originate, and why we use Data Subjects’ data. Purposes and legal basis of the processing. Consequences if data is not provided.

Following is a list of all the purposes for which we collect personal data from Users of the App covered by this policy, legal basis of processing and Legitimate interests pursued.

Personal data collected will be processed: a) For the navigation within the App, websites and activities related to their functioning and operation:

Purposes of processing: to enable the navigation and the use of the App and, in the case of computer crimes, to ascertain possible liability.
Processed data: In the course of the normal operation of the applications and web pages, the IT systems and software procedures responsible for their functioning automatically acquire certain personal data, the transmission of which is implicit in the use of Internet communication protocols. This category of data may include, by way of example: IP addresses, domain names, URLs (Uniform Resource Identifiers), connection timestamps, number of active sessions, date of first access, device name, operating system, unique user identifier for notification management, installed app version, selected language, approximate geographic area, cookie IDs and advertising identifiers; with consent to analytics cookies (Settings › Cookies & data), the account identifier, e-mail, name and licence level associated with the usage statistics of the site and its features.
Legal basis: the processing is based on: i. the provision of services aimed at enabling users to navigate the websites and to use the App, execution of contractual or pre-contractual measures pursuant to Art. 6 c. 1 lett. b) of the GDPR; ii. legitimate interest consisting in ensuring the proper functioning of computer systems and to proceed with the investigation of possible crimes (possibly also based on the existence of a legal obligation) pursuant to Art. 6 c. 1 lett. f) of the GDPR. iii. compliance with cybersecurity obligations pursuant to Article 6, c. 1, lett. c) GDPR; iv. consent for non-essential cookies and SDKs pursuant to Article 6. c. 1, lett a) GDPR.
Data retention period: 30 days after the date of collection, unless legal provisions or orders of Public Authorities impose a different retention time in connection with investigations related to possible computer crimes; technical logs: 6 months; anonymised or aggregated analytics data: 14 months; usage statistics associated with the account under consent to analytics cookies are deleted at our processor when the account is closed (letter b), item 4) and, after consent is withdrawn, no new ones are collected; cookies: as specified in the Cookie Policy. The Business Desk visit statistics and the “Who viewed you” feature are described in letter o) of this section.
Provision of personal data: The provision of such data is mandatory, as in the absence of this information (automatically collected by the systems during the use of web pages or the app, being implicit in Internet communication protocols), the service would be technically unavailable.

b) Registration to the restricted area on the Social that also makes it possible to access the Shark portal and the Media portal through a single sign-on system:

Purposes of processing: creation of a restricted area (“account”) that will allow Users to use the related Social Network services, as well as the sections dedicated to Shark, Media, Academy and Brand according to the terms and conditions governing their access and use.
Processed data: identification, contact, and login data. The personal data required on the sign-up page for account registration are listed below. i. The following data are required during registration: first name, last name, email and password. The provision of these data is mandatory; not providing them does not allow the account registration to be completed. The aforementioned data, with the exception of email, will be public on Users’s social profiles. ii. Subsequent to registration, additional data are collected, at optional provision and completion of the personal profile within the Social Network only. In fact, it is possible for each User to enrich their personal profile with the following information: gender, location, employer, job position, cell phone number. The aforementioned data, which are given optionally, with the exception of the mobile phone number, when included in one’s profile will be public and therefore visible to all Users within the Social Network. It is not necessary for Users to publish or upload such additional personal data, however, not completing one’s profile could limit the ability of Users to expand and interact with their network and make the most of the services offered. It is up to individual Users to choose whether to include sensitive information on their profile. Users are urged not to post or add personal information to their profile that they do not wish to make publicly available.
Legal basis: the processing is based on: i. performance of the registration contract to the Social Network, which includes making the platform’s social features available and enabling access to the services offered within the Sharks, Academy, Media, and Brand sections, pursuant to Article 6 (1)(b) GDPR; ii. compliance with legal obligations under Article 6(1)© GDPR (e.g., retention of tax-related data); iii. consent of the data subjects for optional data pursuant to Article 6(1)(a) GDPR.
Data retention Period: We will retain Users’s personal data as long as they keep their accounts open or as necessary to provide our Services. This includes both data that Users provide directly and data that other people have provided to us with reference to them and data generated by the use of our Services. If you choose to close your social account, your personal data will no longer be visible within the UCapital social generally within 24 hours and will normally be deleted within 30 days. Users are warned that this action is irreversible, consequently, it will not be possible to recover their account and profile contents. In case the User still has active subscriptions and still wants to use them, deletion from the Social is discouraged because after that any subscription license will no longer be usable. We may retain Users’s personal information even after accounts are closed where necessary to fulfill legal obligations, meet regulatory requirements, resolve disputes, maintain security, and prevent fraud and abuse. Information that Users have shared with third parties (posts, interactions, comments) will be permanently deleted. Posts by Users who have deleted their accounts will be deleted, including any comments or interactions by other Users.
Provision of personal data: The provision of personal data is optional, but necessary (with regard to the data defined as mandatory and highlighted with an asterisk) for the use of our services: therefore, in the absence of the provision of this information we will not be able to make available the service requested by the User.

c) Social Features:

Purpose of processing: To enable Users of the Social UCapital to take advantage of the features made available. i. Our Services allow you to view and share information by publishing posts, (can be written text, photos, videos), following other users, and commenting on content. When Users share a post, they should be aware that it can be viewed by all and shared again anywhere where it is set as visible to all. The possibility is given to create content by setting the visibility of the same only to connections. It should be noted that any Social User may post content that includes information about other Users, (as part of posts, comments and videos) as part of

our Social Services and will assume any resulting responsibilities as governed in the Terms of Service.

ii. Users may create communities, within which posts are visible to other members of the same community. Communities may be either public or private, depending on the settings defined by the founder. In private communities, the founder may designate one or more members as “admins”, a status that allows them to add or remove members from the community.

iii. Our services allow Users to stay connected and up-to-date with their network by sending connection requests or choose to accept the connection sent by other Users. When Users follow a person or organization, that information is visible to other Users and the “page owner” as a connection.

iv. We send notifications to alert our Users of connection requests, of receiving messages, of other Users’s reactions on their content (shares, likes, comments), of being added to a community and other notifications that will be explained below. Social actions are associated with individual Users and thus with their name, profile, and photo, if uploaded.

v. An internal chat system within the Social is made available to Users, on which it is possible to exchange messages and also create group chats, both public and private.

vi. It is possible to launch polls that are customizable in terms of the number of options that can be voted on and to which a duration can be assigned that is also customizable.

vii. Users are given the opportunity to save content of their interest, which will then be collected in a dedicated section of the personal profile.

viii. Users are granted the ability to report posts and, more generally, content published by other users by selecting from a dropdown menu the reason why the content is considered inappropriate.

Processed data: identification data, User-generated content and preferences, specifically: Users’ posts (photos, written texts, videos), information about Users’ social actions as described above, and any other information added and uploaded by Users.
Legal basis: the processing is based on:

i. execution of the Social Network registration contract, which includes that of making available the Social functions of the platform in accordance with Art. 6 (1)(b)lett. b) of the GDPR;

ii. legitimate interest of the Controller in ensuring the proper functioning of the platform pursuant to Article 6(1)(f) GDPR.
Data retention Period: personal data about individual Users will be retained as long as their respective accounts are active. Users are informed through this Privacy Policy that deleting their account is irreversible. The data will generally be deleted within 30 days of the account deletion.
Provision of personal data: the provision of such additional data related to the social actions of Users is optional, it will therefore depend on the ways in which Users will interact within the platform and take more or less full advantage of the features made available to them.

d) Management of notifications related to social interactions between Users of the UCapital Social Network:

Purpose of processing: for sending notifications about the interactions of Users registered with the social UCapital. Such notifications are always received within the notification center of Users’ profile. It is also possible to send push notifications in the App depending on the settings of individual users’s devices, and, again at the discretion of users, email notifications can also be enabled.
Data processed: username, account ID, email address or device token, interaction history, and notification preferences. For some notifications may be processed the data of users’ location, detected through the geolocation system of individual devices, (if active). Notifications may relate to the following actions:

i. Connection requests;

ii. Receipt of single/group messages;

iii. Post and articles engagements (like, comments, reactions, share);

iv. Connection anniversaries;

v. Communities activities (invitations, posts, interaction within the Floor); vi. Events invitation; vii. Platform updates;

Legal basis: the processing is based on: i. execution of the contract for signing up and maintaining an account within the Social Network, which includes making available the social features of the platform in accordance with art. 6 c. 1 lett. b) of the GDPR regarding notifications within the app. ii. Consent given regarding push notifications and email notifications through the activation of notifications in the App, of the geolocation function and the activation of email notifications from the personal area pursuant to Art. 6, c. 1, lett. a) of the GDPR, which can be revoked at any time by deactivating the notifications and the geolocation from your device or by changing your settings from the personal area. iii. legitimate interest in maintaining social engagement pursuant to Article 6(1)(f) GDPR.
Data retention Period: We will retain Users’s personal data as long as they keep their accounts open or as necessary to provide our Services. This includes both data that Users provide directly and data that other people have provided to us with reference to them and data generated by the use of our Services. If Users choose to close their account, their personal data will no longer be visible within the Social generally within 24 hours and will normally be deleted within 30 days. Users are warned that this action is irreversible, consequently, it will not be possible to recover their account and profile contents. We may retain Users’s personal data even after accounts are closed where necessary to comply with legal obligations, meet regulatory requirements, resolve disputes, maintain security, and prevent fraud and abuse.
Provision of personal data: the provision of such additional data related to the social actions of Users is optional, it will therefore depend on the ways in which Users will interact within the platform and take more or less full advantage of the features made available to them.

e) Informational Communications to Social UCapital Users:

Purpose of processing: to send app notifications regarding the availability of our services, support messages on the use of services and security, notices about new services available and legal notices.
Data processed: username, account ID, e-mail address or device token, language and communication preferences.
Legal basis: the processing is based on: i. legitimate interest of the Data Controller to inform members of the Social about new services offered, useful communications for the purpose of the usability of existing services and legal notices such as informing users about new documents uploaded within the platform (privacy / terms and conditions updates) pursuant to Art. 6, c. 1, lett. f) of the GDPR; ii. performance of the contract pursuant to Article 6(1)(b) GDPR (information necessary for the provision of the services); compliance with legal obligations (mandatory notices) pursuant to Article 6(1)© GDPR; iii. consent for optional communications regarding new services pursuant to Article 6(1)(a) GDPR.
Data retention Period: for the duration of the existing relationship with the User, i.e. as long as the account is active. Notification-related data: 24 months; delivery logs: up to 6 months; for as long as the account remains active.
Provision of personal data: the provision of data is mandatory: it is not possible for Users to refuse to receive service messages such as those indicated in this section from the Data Controller.

f) Online purchase of products and services offered within the Social platform (Sharks, Academy, Ai, Markets, Brand):

Purpose of processing: Administrative, technical, and contractual management of the subscription licenses required to access the purchased services. The processing includes registering, renewing, or terminating the license; issuing invoices and verifying payments; fulfilling online purchase orders and performing all related operational activities (including sending purchase confirmation emails and, subsequently, assisting with service activation, invoicing, payment management, and handling any refund requests).
Data processed identification, accounting/tax, and transactional data: first name, last name, email address, phone number, and billing details such as residential address, tax identification number, VAT number, and recipient code (SDI), payment method, transaction history, subscription ID, activation/deactivation logs, card data processed through the payment gateway, purchase history. We do not process data related to the payment method selected by customers (e.g., payment card number and security code), which are collected exclusively by the chosen payment service provider which transmits to the Controller only “derived” information, namely: transaction outcome, transaction ID, payment token, and success or error status.
Legal basis: the processing is based on: i. performance of a contract to which the data subject is a party, or of pre-contractual measures taken at the data subject’s request, pursuant to Article 6(1)(b) GDPR; ii. compliance with legal obligations under Article 6(1)© GDPR, including tax and accounting requirements; iii. processing of special category data pursuant to Article 9(2)(g) GDPR, where applicable (e.g., disabilities for training-related discounts); iv. legitimate interest in managing accounting operations and preventing fraud pursuant to Article 6(1)(f) GDPR
Data retention period: for the time necessary to comply with contractual and legal obligations relating to the sale of products and services (e.g., tax regulations), normally for a period of 10 years from the date of purchase; technical data: until the end of the subscription plus 12 months.
Provision of personal data: the provision of personal data is optional but necessary to process and respond to data subjects’ requests and to fulfil the Data Controller’s contractual obligations. Failure to provide such data will result in the inability of the Data Controller to perform said obligations.

g) Provision of Training Courses (E-Learning) through the Academy Service:

Purpose of processing: Users’ personal data are processed to enable the delivery of online training courses offered by the Controller, to manage course registrations and learning activities, to monitor participation and usage of training content, and to issue attendance or completion certificates, where applicable. The data may also be processed for administrative and organizational purposes connected to the management of the e-learning platform and to improve the quality of the training offering, including through analysis of course usage statistics.
Data processed: Identification and training-related data. The data processed include: first name, last name, email address, platform login credentials, test or assessment results, course history, certificates issued, and any other information necessary for the delivery and management of the training program.
Legal basis: the processing is based on: i. performance of the training contract to which the data subject is a party, pursuant to Article 6(1)(b) GDPR; ii. as well as for the Controller’s legitimate interest (Article 6(1)(f) GDPR) in ensuring proper course management, improving the quality of the training services, and protecting the security of the digital platforms used.
Data retention period: personal data relating to course participation and certificates will be retained for five (5) years from the completion of the course, unless longer periods are required under applicable law or in the event of disputes or specific administrative obligations.
Provision of personal data: providing the requested personal data is necessary for the proper management and use of the training courses. Failure to provide such data will make it impossible to complete the registration process and participate in the training activities offered by the Controller.

h) Creation of listings on the Sharks Marketplace:

Purpose of processing: Following the purchase of a subscription license, Users may create cards, i.e., “company,” “investor,” or “advisor” profiles, to be published within the Marketplace, allowing investors and companies to connect by creating business profiles and identifying matching opportunities. These cards may include personal data of natural persons, for example when individuals hold executive positions within a company, or where advisors are natural persons themselves.
Data processed: identification, professional, and contact data: personal data included in the cards, such as first name, last name, professional position within the company, email address, company name, descriptive profile information, image or logo if uploaded, corporate data, investor profiles, investment amount, and sector preferences. Note: The User holding the license assumes full responsibility for the data entered in the cards, as governed by the Terms and Conditions of Use of the platform. The email address is visible in investor profiles, but not in company profiles.
Legal basis: the processing is based on: i. performance of the contract for the purchase of products or for the implementation of pre-contractual measures taken at the request of the data subject, pursuant to Article 6(1)(b) GDPR; ii. legitimate interest of the Controller in ensuring visibility and the proper functioning of the marketplace and in facilitating investment opportunities pursuant to Article 6(1)(f) GDPR; iii. consent for any additional or publicly shared data voluntarily provided by the user pursuant to Article 6(1)(a) GDPR.
Data retention period: cards created by Users will remain on the platform even after the subscription has expired or the account has been deleted, serving as an informative resource for the benefit of other platform users, unless the data subject exercises their rights to erasure or objection (Articles 17 and 21 GDPR).
Provision of personal data: the provision of personal data is optional but necessary for the performance of the contract. Failure to provide such data will make it impossible for the Data Controller to fulfil the licensing contract concerning the creation of cards and listings.

i) Completion of contact forms to request communication with the desired advertiser within the Sharks platform:

Purpose of processing: by completing the form available under each listing or card in the Sharks section, data subjects may contact the advertiser who created the listing in which they have an interest. Upon submission, an email is also sent to a dedicated UCapital account.
Data processed: first name, last name, email address, phone number, and free-text message.
Legal basis: The processing is based on: i. performance of a contract for the sale of products or for the implementation of pre-contractual measures taken at the request of the data subject, pursuant to Article 6(1)(b) of the GDPR; ii. the Controller’s legitimate interest in ensuring the proper functioning of the contact system and the security of communications pursuant to Article 6(1)(f) GDPR.
Data retention period: up to two years from the date of form submission or until a deletion request is submitted. 5. Provision of personal data: the provision of personal data is optional but necessary to manage and respond to the data subjects’ requests. Failure to provide such data will result in the Data Controller being unable to process such requests.

j) Web TV and Multimedia Content Management:

Purpose of the processing: Users’s personal data are processed to enable access to multimedia content and streaming services provided by the Controller through the Web TV. The processing includes accessing content, monitoring the proper functioning of the service, tracking views and user interactions with the content, and analyzing preferences and technical data necessary to ensure service quality, security, and continuity. The data may also be used, based on the Controller’s legitimate interest, to improve platform performance, resolve technical issues, prevent abuse or abnormal use, and ensure the security of the streaming systems.
Data processed: Identification, technical, and usage data. Specifically, this includes: IP address and technical data of the device used; platform access logs; duration and manner of content viewing; and usage preferences.
Legal basis: The processing is based on: i. performance of the contract relating to access to multimedia content and streaming services pursuant to Article 6(1)(b) GDPR; ii. the Controller’s legitimate interest in ensuring the quality, efficiency, security, and continuous improvement of the Web TV and related technological services pursuant to Article 6(1)(f) GDPR.
Data retention period: technical data (e.g., access logs, IP addresses, usage data) are retained for 12 months.
Provision of data: providing the data necessary to access the Web TV is mandatory in order to access multimedia content and streaming services. Failure to provide the required technical and identification data will make it impossible for the Controller to grant access to the content or ensure service quality.

k) “Brand” Advertising System:

Purpose of the processing: Users’s personal data are processed to manage the advertising spaces available on the platform and to display ads that are relevant and aligned with their interests. The processing includes: collecting user preferences through cookies and tracking tools; creating basic audience segments based on interest categories; measuring advertising campaign performance (impressions, clicks, engagement); managing advertisers and campaigns delivered through the “Brand” service; and sharing the data necessary with advertising partners involved in the technical delivery of ads. The data may also be used, based on the Controller’s legitimate interest, to ensure the security, quality, and proper functioning of advertising placements and to prevent potential misuse of the system (e.g., invalid traffic).
Data processed: The data processed include identification, usage, and marketing data. Specifically: online identifiers (e.g., cookie ID, pixel ID, device ID); viewing preferences and interest categories; data related to platform usage and the areas where ads are displayed; data on interactions with ads (views, clicks, impressions); and technical information transmitted by the browser or device.
Legal basis: the processing is based on: i. the user’s consent for advertising profiling activities through cookies or similar tools (provided via a TCF 2.2-compliant Cookie Banner/CMP) pursuant to Article 6(1)(a) GDPR; ii. the Controller’s legitimate interest in delivering contextual advertising that does not rely on granular profiling pursuant to Article 6(1)(f) GDPR. It is clarified that non-essential cookies or tracking tools are not activated without consent.
Data retention period: cookies and advertising identifiers are retained for the duration specified in the Cookie Policy and, in any case, no longer than 24 months. Aggregated analytics and statistical data (no longer attributable to the user) may be retained for longer periods for analysis and reporting purposes. After the applicable periods, data are deleted or anonymized.
Provision of data: providing data through cookies or similar technologies is optional and subject to the user’s consent. Refusal to provide consent simply prevents the Controller from displaying personalized advertising, analyzing user preferences to improve ad relevance, and measuring advertising campaign effectiveness. The use of the UCapital Social platform and its main services is not affected in any way by the user’s decision not to accept marketing cookies.

l) Use of Artificial Intelligence Systems:

Purpose of the processing: The Platform uses artificial intelligence systems to provide informational and support features, such as: analysis of news and content, generation of market indicators, creation of simulations, personalized suggestions, statistical analyses, and predictive surveys. Users are clearly and transparently informed when interacting with automated systems (Article 52 AI Act) and may request clarification at any time. AI systems are used for non-decisive purposes; they do not produce automated decisions with legal or similarly significant effects on the User and always operate under human oversight (Article 14 AI Act). Additional information is available in the dedicated AI Transparency Notice, in the Platform’s Terms and Conditions, and within the disclaimers displayed across the Platform.
Data processed: Depending on the specific functionality used, AI systems may process: technical and interaction data (searches, clicks, usage time); preferences and interaction history with content and services; information from external sources (e.g., news providers, market data) where integrated; and aggregated or anonymized data generated by the AI for statistical analysis. Special categories of data are not used unless explicit consent is provided and appropriate safeguards are applied. The language model provider (Anthropic) receives the conversation with the assistant in order to generate the answers, acting as a data processor. To answer requests and draft content, the AI assistant may also query third-party web search engines (the model provider’s search service, Exa, Serper and, where activated, Tavily): the search services receive only the search string generated automatically by the system, not the conversation, your profile or your identifier; before it is sent, the string is automatically cleaned of e-mail addresses, phone numbers, IBANs, tax codes, dates of birth and references to personal profiles, and the system is instructed not to include the names of private individuals. We nevertheless ask you not to include in conversations with the assistant personal data of third parties that are not necessary for your request.
Legal Basis: The processing is based on: i. performance of the contract and provision of the Platform’s informational services pursuant to Article 6(1)(b) GDPR; ii. the Controller’s legitimate interest in improving services and analyzing user interactions pursuant to Article 6(1)(f) GDPR; iii. explicit consent where required for specific activities (e.g., advanced personalization, non-essential profiling) pursuant to Article 6(1)(a) GDPR; iv. article 10 AI Act – requirements relating to dataset quality, integrity, and representativeness; v. articles 5, 6, 25, and 32 GDPR – principles of data minimization, privacy by design, and security of processing. No automated decisions producing legal or similarly significant effects are made pursuant to Article 22 GDPR.
Data retention period: Data processed by AI systems are retained as follows: interaction and preference data: 12 months; identification data processed for AI functionalities: for the duration of the contractual relationship; aggregated or anonymized data: retained without specific limitations, as they cannot be traced back to the User; data potentially used for model improvement: always stored in anonymized form, without any possibility of re-identification. After the applicable retention period, the data are deleted or irreversibly anonymized.
Provision of data: Providing the data necessary to use AI functionalities is not mandatory, but failure to provide such data may limit access to certain AI-based analyses or informational features. Providing data for non-essential AI features requires consent and may be withdrawn at any time without affecting access to other services.

m) Support/Customer Care Service:

Purpose of processing: Management of requests, tickets, complaints, and abuse reports. The Data Controller provides Users with a dedicated support and assistance area within the UCapital Platform, through which Users can submit requests by selecting the relevant topic from a dropdown menu and describing the issue or need via a free-text field. Additionally, a live chat support service is available within landing pages and promotional campaigns relating to the services offered by the Data Controller.
Data processed: data necessary to respond to the requests submitted to our Support team identification data, communications, metadata, and any other information necessary to respond to requests submitted to our Support team (such as first name, last name, email address, user ID, and message content).
Legal basis: the processing is based on: i. performance of the service contract or of pre-contractual measures taken in response to a request, including the obligation to provide a reply, pursuant to Article 6(1)(b) and © GDPR; ii. legitimate interest in protecting and ensuring the proper functioning of the service pursuant to Article 6(1)(f) GDPR.
Retention period: for the time strictly necessary to fulfil the data subjects’ requests and in any case no longer than 24 months from the support request, unless different or additional legal obligations apply.
Provision of personal data: the provision of personal data is optional but necessary to manage and respond to Users’ requests. Failure to provide such data will result in the Data Controller being unable to process such requests.

n) Content Moderation and “Notice & Action” Procedures under the Digital Services Act:

Purpose of the processing: Personal data are processed to manage reports concerning content deemed illegal or in violation of the Platform’s Terms and Conditions. The processing includes: receiving and assessing reports submitted by users or qualified entities; reviewing the reported content and adopting moderation decisions (removal, blocking, access restriction, account suspension, etc.); retaining digital evidence necessary for evidentiary, transparency, and audit purposes; recording the decisions taken and the related reasoning; and complying with the obligations established by the Digital Services Act (DSA), including transparency requirements, tracking of reports, and cooperation with the competent authorities. The processing is also necessary to protect users, prevent abuse, ensure platform security, and safeguard the integrity and reputation of the service.
Data processed: Identification, contact, usage, and user-generated content data. Specifically: identification data of the reporting user and the reported user (account ID, username, email address); activity logs and published content; content subject to the report; reasons for the report and categories of alleged illegality or violation; report ID and status information; final moderation decision and timestamps of moderation actions; and any associated digital evidence (screenshots, logs, metadata).
Legal basis: the processing is based on: i. compliance with legal obligations established by the Digital Services Act (Regulation (EU) 2022/2065, Articles 14–20) pursuant to Article 6(1)© GDPR; ii. performance of the platform usage contract and enforcement of community rules pursuant to Article 6(1)(b) GDPR; iii. the Controller’s legitimate interest in ensuring user safety, preventing abuse, and protecting the platform pursuant to Article 6(1)(f) GDPR.
Data retention period: Evidence and documentation: 5 years, to comply with the DSA’s audit, accountability, and transparency obligations; operational and moderation logs: 12 months; data relating to unchallenged reports: 30 days. After the applicable retention period, the data are deleted or anonymized in accordance with internal retention policies.
Provision of data: Providing the requested data is necessary for the Controller to manage reports submitted by users or authorized entities, enforce the platform’s moderation rules, comply with the Digital Services Act, and protect users, the Controller, and third parties from illegal or harmful content. Failure to provide the required data prevents the evaluation of the report and the proper handling of moderation and safety procedures.

o) Business Desk: visit statistics and the “Who viewed you” feature:

Purpose of the processing: The Business Desk is the area through which the owners of a professional profile, a business page or a deal follow the performance of their activity on the platform. For this purpose we record visits to published profiles, business pages and deals and show them to their owners in two forms: (i) aggregate counts (visits, visitors, source, professional category and country of the visitors), for all visitors; (ii) the “Who viewed you” feature, which shows by name only those visitors who are registered and signed in and have not turned on “Private browsing”, so that the owner can recognise who is interested in their activity and, if they wish, start a professional contact, as is customary on the main professional social networks. We do not send the owner any notification, e-mail or alert when someone visits their profile, page or deal: the list can be consulted only by opening the Business Desk. Visits made before 26 October 2026 are not attributed to any user.
Data processed: for registered visitors signed in and in visible mode: account identifier, name, profile photo, headline, professional category and country as stated in the profile (data already public on the profile), number of visits and date and time of the last visit to each profile, page or deal and, where the visitor is already a contact in the owner’s Business Desk CRM, the indication that they appear there. For non-registered visitors and for users in Private browsing we process only a daily pseudonymous code generated from the IP address and the browser with a secret key that changes every day and is destroyed: the IP address is neither stored nor transmitted to our processor, and the code does not allow the person to be identified or visits on different days to be linked; these visitors are associated only with device type (desktop, mobile, tablet), country and referring site. For this purpose we do not process e-mail address, phone number, clear-text IP address, device identifiers, content read or reading time. Visits by the owner and the administrators to their own surfaces are neither counted nor shown. On confidential deals the visitor’s name appears to the owner only after the visitor has expressed interest in the deal. The number of visitors shown by name may be limited by the owner’s plan: beyond the limit only category, country and day of the visit appear, without a name.
Legal basis: the processing is based on: i. the legitimate interest of the Controller in offering the owners of profiles, business pages and deals a professional networking tool, and the legitimate interest of those owners in knowing who is interested in their activity, pursuant to Article 6(1)(f) GDPR, following a documented balancing assessment available on request at privacy@ucapital.com; ii. for the aggregate counts, the Controller’s legitimate interest in the operation and improvement of the platform pursuant to Article 6(1)(f) GDPR. Right to object (Article 21 GDPR). You may object at any time, free of charge and without giving reasons, by turning on “Private browsing” in Settings › Cookies & data, card “Privacy & visibility · Business Desk” (also reachable from the “Privacy & visibility” entry of your profile menu), or by writing to privacy@ucapital.com. From that moment your visits — including those already recorded — appear to owners only in the aggregate counts and never with your name; for new visits the effect is active within one minute. Symmetrically, while Private browsing is on, you too see only aggregate counts of the visitors of your profile, pages and deals. The choice can be changed at any time and does not affect your use of any other service of the platform.
Data retention period: visitors are shown by name for a maximum of 12 months from the visit; after that period the visit events referring to you are no longer accessible to owners and are deleted periodically. The visibility setting is kept for as long as the account is active. The service table linking the opening of a shared link to the following visit is kept for 30 days; the indication of the visit’s source (the content or shared link you came from) stays attached to the visit event and follows the retention indicated above. When the account is closed, your person and all visit events referring to you are deleted at our processor within the time limits indicated in letter b), item 4. Aggregate counts and pseudonymous codes that cannot be traced back to a person may be kept longer for statistical purposes.
Provision of data: the data are collected automatically while browsing as a signed-in user. The choice to appear by name can be freely changed at any time through “Private browsing” and is not a condition for the use of any service.

Recipients and processor: the owner of the profile, business page or deal visited; for business pages and deals, also the administrators of the page or deal and, where the owner belongs to an organisation on the platform, the organisation’s supervisors, read-only (visits to a personal profile are visible only to its owner). For the collection and analysis of visits we rely on PostHog, Inc. as processor pursuant to Article 28 GDPR, with data hosted on infrastructure in the European Union (PostHog Cloud EU); any remote access for support activities takes place with the safeguards provided for by Chapter V of the GDPR (the European Commission’s standard contractual clauses or an adequacy decision), as provided for in the data processing agreement and as indicated in section 6.

5. Recipients and possible categories of recipients of personal data.

Personal data may be made accessible to, brought to the attention of, or communicated to the following parties, who are appointed by the Data Controller, as appropriate, as data processors or persons authorised to process data, or who act as autonomous data controllers:

employees and/or collaborators in any capacity of the Data Controller, duly authorised and trained in accordance with the GDPR;
suppliers and partners of the Data Controller who provide services and all activities related to the Sites/Apps (hosting and cloud infrastructure, e-mail and notification delivery, payments, chat, statistical analysis — including PostHog, Inc. for the Business Desk and website statistics), appointed as data processors through a written contract;
the providers of the artificial intelligence systems described in letter l): Anthropic, PBC (language model and its web search service), Exa Labs, Inc., Serper and, where activated, Tavily, Inc. (web search engines), LangChain, Inc. (technical tracing of AI processing, European Union region), appointed as data processors;
the other Users of the platform, only within the limits described in section 4 (for example the owners, administrators and supervisors of profiles, business pages and deals for the “Who viewed you” feature, letter o);
freelancers and consultants for the legal, financial and accounting management of the Data Controller’s activities (such as accounting, administrative and legal professionals) and credit institutions and insurance companies, acting as autonomous data controllers;
public authorities or police forces, where access to the data is provided for by law, regulation or EU legislation.

The updated list of data processors is available on request by writing to privacy@ucapital.com.

6. Transfer of data to countries outside the European Union.

Personal data are processed and stored mainly within the European Union. The Business Desk statistics data are hosted on infrastructure in the European Union (PostHog Cloud EU).

Should personal data be transferred outside the European Union, the Data Controller undertakes that the transfer will take place in compliance with Regulation (EU) 2016/679. In particular, data will be transferred only after signing the Standard Contractual Clauses approved by the European Commission with Decision 2021/914/EU or to countries covered by an adequacy decision of the European Commission.

In this respect, please note that the sites and apps covered by this policy currently use analytics cookies from Google Ireland Ltd. Any data transfers to the United States rely on Article 45 GDPR, an adequacy decision having been in force since July 2023 for companies adhering to the Data Privacy Framework, under which Google is certified. As stated in the Cookie Policy, such cookies are activated only with the Users’ consent.

Some of the Controller’s suppliers (for example PostHog, Inc.) are established in the United States: in such cases the data remain hosted in the European Union and any access from the United States, for example for support activities, takes place on the basis of the safeguards provided for by Chapter V of the GDPR, namely the adequacy decision on the Data Privacy Framework for suppliers that adhere to it (Article 45 GDPR) or the standard contractual clauses approved by the European Commission (Article 46 GDPR), as provided for in the respective data processing agreements.

The providers of the artificial intelligence systems listed in section 5 (Anthropic, Exa, Serper and, where activated, Tavily) are established outside the European Union: they receive only the search strings and the content necessary for processing, under the safeguards of Chapter V of the GDPR (the adequacy decision on the Data Privacy Framework for providers that adhere to it, Article 45, or the standard contractual clauses, Article 46). The technical traces of AI processing are hosted in the provider’s European Union region.

Where the Controller promotes its services through advertising campaigns on third-party platforms (for example Meta Platforms), the data that Users provide on those platforms are collected by their operators as independent controllers, under their own privacy notices; any data transmitted to the Controller are processed in accordance with this policy and with the safeguards indicated above. Data Subjects may obtain information on the safeguards applied to each transfer, and a copy of them, by writing to privacy@ucapital.com.

7. Rights of the Data Subjects.

Data Subjects may exercise the rights guaranteed by the GDPR, set out in Articles 7(3) and 15 to 22, by sending an e-mail to privacy@ucapital.com or, alternatively, a communication by registered letter with return receipt to the registered office of UCapital24 S.p.A., Via dei Piatti 11, 20123, Milan (MI). They may also contact the Data Protection Officer at the address indicated in section 3.

In particular, the Data Subject may exercise the following rights:

Right of access: to obtain confirmation as to whether personal data concerning them are being processed and, where that is the case, a copy of the data and information on: the origin of the data, the categories of data processed, the recipients, the purposes, the existence of automated decision-making (including profiling), the retention period and the rights provided by the GDPR;
Right to rectification of inaccurate personal data and to completion of incomplete personal data;
Right to erasure of personal data where one of the conditions of Article 17 GDPR applies, for example where the data are no longer necessary or the Controller no longer has grounds to process them;
Right to restriction of processing under Article 18 GDPR: where the accuracy of the data is contested, for the time needed to verify it; where the processing is unlawful and the Data Subject requests restriction instead of erasure; where the Controller no longer needs the data but the Data Subject needs them to establish, exercise or defend a legal claim; pending the verification of an objection;
Right to data portability, under the conditions of Article 20 GDPR: to receive the personal data concerning them in a structured, commonly used and machine-readable format and to have them transmitted to another controller, where technically feasible;
Right to withdraw consent for processing based on it, without affecting the lawfulness of processing carried out before withdrawal, by writing to privacy@ucapital.com or by changing the settings in the personal area;
Right to object to processing based on legitimate interest (Article 21 GDPR). Each Data Subject has the right to object at any time, on grounds relating to their particular situation, to the processing of their personal data carried out for the purposes of a legitimate interest of the Controller or of third parties. In the event of an objection, the data will no longer be processed for that purpose unless the Controller demonstrates compelling legitimate grounds that override the interests, rights and freedoms of the Data Subject, or the need to establish, exercise or defend a legal claim. For the “Who viewed you” feature (section 4, letter o) the objection is exercised directly by turning on “Private browsing” in Settings › Cookies & data › Privacy & visibility · Business Desk and is always upheld, including with effect on visits already recorded;
Right to object to direct marketing: the Data Subject may object at any time to processing for direct marketing purposes, including related profiling, in which case the data will no longer be processed for such purposes;
Right not to be subject to a decision based solely on automated processing which produces legal effects or similarly significantly affects them (Article 22 GDPR); the Controller does not take decisions of this kind;
Right to lodge a complaint with the Supervisory Authority. Each Data Subject may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) if they consider that their rights under the GDPR have been infringed, without prejudice to any other administrative or judicial remedy.

The Controller responds to requests without undue delay and in any event within one month of receipt, extendable by two further months in the cases provided for by Article 12 GDPR.

8. Changes to this policy.

This policy may be updated or amended (including as a result of new legislation or new features). Users are encouraged to check this document regularly. Substantive changes — such as the introduction of new processing operations concerning Users — will be highlighted through our services and, where possible, also by e-mail, to give Users the opportunity to review them, exercise their rights and, should they not wish to accept them, close their account.

Date of last revision: 29/10/2026