Data controller
ALTIVALIS GROUP LTD, Fawwara Building, Unit S043, Triq L-Imsida, Gżira, GZR 1401, Malta, acts as the controller of personal data collected through the website. Contact: [email protected].
Data that may be collected
- Identification and contact data: surname, first name, email, telephone number if requested, country or place of residence, language of communication.
- Simulation data: age or year of birth, investment horizon, savings amount, initial capital, duration, stated objectives and parameters required for calculations.
- Professional data: employment status, business sector, country of activity and general information relevant to the simulation.
- Financial and wealth data provided voluntarily: income bracket, savings capacity, available capital, declared financial assets, relevant financial commitments, objectives and risk preferences where necessary.
- Technical data: IP address, security logs, browser/device information and data required for the operation of the service.
- Consent data: choices relating to cookies and, where applicable, marketing communications.
Data not to disclose in the public simulator
Unless legally necessary in a separate, secure process, users must not submit health data, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, data about sex life or sexual orientation, genetic or biometric data, criminal convictions, banking passwords, PINs or banking login credentials.
Purposes and legal bases
Altivalis processes data to: provide the requested simulation or document and follow up on it; respond to contact requests; ensure the security and operation of the website; comply with its legal obligations; and, only where the required legal basis exists, send marketing communications.
Depending on the processing, the legal basis may be steps taken at the user’s request before a possible contract is entered into, Altivalis’s legitimate interests, a legal obligation or consent. Consent is not used as the default basis where another legal basis is more appropriate.
Simulator and artificial intelligence
Some features may use algorithmic or artificial intelligence systems to assist in producing simulations, scenarios, explanations, charts or educational reports. Altivalis applies the principle of data minimisation: where possible, directly identifying data (name, email, telephone number, address) is not sent to the AI service, and only the information necessary for the analysis is used.
Unless specific information and an appropriate legal basis are provided, the simulator is not intended to make a decision based solely on automated processing that produces legal effects or similarly significantly affects the user. Results do not automatically constitute regulated financial advice, an eligibility decision or contractual acceptance.
Hosting and location
The website’s main infrastructure is hosted on an OVHcloud virtual private server (VPS) located in a data centre in Strasbourg (SBG), France, within the European Union. Data stored on this main infrastructure is therefore hosted in the European Union.
Separate providers may be involved in email, backup, document generation, security, analytics or artificial intelligence. Their identities and locations must be documented in the internal record of processing activities. Where processing involves transferring data outside the European Economic Area, Altivalis implements the legal mechanism required by the GDPR, in particular an adequacy decision or standard contractual clauses where applicable.
Recipients
Data is accessible to authorised Altivalis staff and, to the extent necessary, its technical processors, hosting providers, cloud providers, email, maintenance, document generation, security and artificial intelligence providers, as well as professional advisers and authorities where required by law. Altivalis does not sell its users’ personal data.
Retention periods
- Simulation with no subsequent relationship: up to 12 months, subject to a shorter period where possible.
- Prospect who has requested contact: up to 24 months after the last active exchange, unless a contractual relationship or a different legal obligation applies.
- Consent-based marketing communications: until consent is withdrawn or the user unsubscribes, with periodic removal of inactive contacts.
- Technical and security logs: a period proportionate to security, diagnostic and incident prevention needs.
- Data subject to a legal obligation: for the period required by applicable law.
Security
Altivalis implements technical and organisational measures proportionate to the risks, which may include HTTPS/TLS encryption of communications, access controls, restricted privileges, secure authentication, backups, logging, security updates and server and application protection measures.
Direct marketing
Providing an email address to receive a requested simulation or document does not automatically constitute consent to receive marketing communications. Where consent is required, it is collected separately through a positive action, with no pre-ticked box, and may be withdrawn at any time.
Your rights
Under the conditions set out in the GDPR, individuals may exercise their rights of access, rectification, erasure, restriction, objection, portability and withdrawal of consent, as well as applicable rights relating to automated individual decisions. Requests may be sent to [email protected]. Altivalis may request information reasonably necessary to verify the requester’s identity.
Complaints
Anyone may lodge a complaint with the Office of the Information and Data Protection Commissioner (IDPC) in Malta or, where the GDPR permits, with the competent data protection authority in their Member State of residence or work.
Minors
The simulator intended for adults is not designed to knowingly collect data concerning minors. Any future service specifically intended for children or families will be subject to appropriate information, consent and protection rules.
Changes
This policy may be updated to reflect changes in services, providers, processing, technologies or regulations. The update date is shown at the top of the document.