Privacy policy

Last updated: 27 October 2026

This policy describes how personal information is handled through the297.com, the website presented under the BIG / BNZSA Investment Group brand.

Data controller

Legal name

BNZSA Investment Group, S.L.U

Tax identification number (NIF)

ESB88636048

Address

Calle Arroyo del Soto, 2, 28914 Leganés, Madrid, Spain

Privacy contact

privacy@the297.com

Information collected

When you submit an enquiry, we receive your name, organisation, email address, enquiry category, any venture selected and the message you provide. The form also creates a request reference and timestamp to manage delivery and recognise retries.

Hosting and security services process technical information such as IP addresses, request times, browser information and signals used to detect automated requests. Please do not include sensitive personal information or unnecessary details about other people in your message.

Why we process it

We use enquiry details to assess and respond to professional communications, provide requested information and manage related correspondence. Responding to these communications and protecting the service serve our legitimate interests. Where you personally request steps towards a contract, the corresponding processing may be necessary to take those steps at your request. We also retain information where required by applicable legal obligations.

The website uses technical controls to prevent abuse and duplicate submissions. Sending a form or acknowledging the cookie notice does not give consent to advertising.

Service providers and recipients

IONOS hosts the website and processes the form. Cloudflare Turnstile provides security checks. Brevo sends the enquiry notification and confirmation email and stores the submitter’s email address in our enquiry contact list. The list registration supports enquiry management; the form does not include a marketing subscription choice.

Our corporate email service is used to receive and manage enquiries and replies. Providers receive information needed for their services, including email recipients and message content where relevant. Information may also be disclosed where a legal obligation requires it.

Service providers and their subprocessors may process information outside the European Economic Area. You can request information about the destinations and applicable transfer safeguards at privacy@the297.com.

Storage and retention

We retain enquiries and related correspondence while needed to handle the request and any resulting relationship, and for applicable legal obligations or claims. Retention in corporate mailboxes, Brevo, hosting records and backups depends on the relevant service and retention settings.

The website’s duplicate-prevention records expire after 25 hours and rate-limit counters after 10 minutes. Expired server records are removed on a subsequent access, rather than by a scheduled deletion at the exact expiry time. Error logs contain request references, failure stages and status codes; the application log is limited by file size rather than a fixed number of days.

The form uses session storage in your browser. The cookie notice acknowledgement is recognised for up to 180 days. See the Cookie policy for details and browser controls.

Your rights

Subject to the applicable conditions, you may request access, correction, erasure, restriction or portability of your personal information and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw that consent without affecting earlier lawful processing.

Send requests to privacy@the297.com. We may request proportionate information to verify your identity. You may also lodge a complaint with the competent supervisory authority, including the Spanish Data Protection Agency (AEPD).

Analytics and external websites

Google Analytics, Google Tag Manager and advertising tags are not installed in this website build. Following an external link takes you to a separate service with its own privacy practices.

Updates

This policy will be updated when the website’s processing changes. New purposes requiring consent will need a separate choice before they are enabled.