Privacy policy for the CAPVERIANT platform

This Privacy Policy describes how CAPVERIANT GmbH (“CAPVERIANT GmbH” or “we”) processes your personal data when you use the platform (the “Platform”) accessible at www.capveriant.com (the “Website”) and the services it provides.

According to the EU General Data Protection Regulation 2016/679 (the “GDPR”), personal data is data which directly or indirectly identifies a natural person (e.g. a name, e-mail address, phone number). Data relating to a company or a public entity is not considered personal data and is not covered by this Privacy Policy.

1. Contact details of the data controller and data protection officer

The data controller of the Platform is:
CAPVERIANT GmbH
Parkring 28
85748 Garching bei München
Germany

For questions regarding the collection and use of your personal data or to exercise your rights, as described in section 8 below, please contact our data protection officer:
IBS data protection services and consulting GmbH
Marc Neumann
Zirkusweg 1y
20359 Hamburg
Germany
Telephone: +49 40 540 90 97 – 80
E-mail: dsb@ibs-data-protection.de

2. How we obtain your personal data – Your obligation as user of the Platform

The Platform offers intermediation services to investors and public entities. We therefore collect personal data relating to individuals working and/or acting for such investors and public entities:

Either directly, from the individuals using the Platform (“users”);
Or indirectly, when users provide us with personal data relating to individuals other than themselves working and/or acting for an investor or public entity.

If you are a Platform user and provide us with personal data relating to other individuals working/acting for your entity (e.g. by uploading identification (ID) documents of third parties on the Platform), you are hereby obliged to forward this Policy (and any update thereto) to these individuals as soon as possible and no later than upon providing their personal data to us. In any case, you undertake to provide us with accurate and up-to-date information when using the Platform.

3. Categories of personal data we collect about you and why

When you use the Platform and the services provided on the Platform, CAPVERIANT GmbH collects and processes personal data about you for the purpose and on the legal basis described below. Unless explicitly provided otherwise, all the information required in the data collection forms we provide you is compulsory.

Providing and managing the Platform and the services offered on the Platform

For the purpose of providing and managing the Platform and the services it offers, we collect and process your personal data, either directly (if you are a user of the Platform), or indirectly (if you work/act for an investor or public entity using the Platform and another user provides us with your personal data). For the purpose of providing and managing the Platform and the services offered on the Platform, we will process your personal data in the following circumstances:

If you request a demo to gain an introduction to the Platform or if you register a company on the Platform (as a public entity or investor), we collect your personal information as a user (e.g. contact information, position, IP address, and the date and time of your registration) or as a person authorized for representation (e.g. contact information, position, copy of IDs (including date and place of birth, nationality, picture, etc.), politically exposed person status, approvals (including subscription limits), signature). The processing of this data is necessary for the fulfilment of the user contract pursuant to Art. 6 para. 1 lit. b GDPR. The provision of this data is necessary for the conclusion of the contract. If the data is not made available, the conclusion of a contract and the use of the platform is not possible;
Whenever you visit or use the Platform, we collect information about your end device and the way you use our Platform by using cookies. Further information on how we use cookies can be found in Section 5. The processing of this data is also based on our legitimate interest pursuant to Art. 6 Para. 1 lit. f GDPR.

Know Your Customer

We also process all personal data obtained during the registration process on the Platform (e.g. personal data of the user registering the investor or public entity, as well as personal data of authorized representatives of these entities) for the purpose of our Know Your Customer (“KYC”) requirements. We do so, based on our legitimate interest to conduct the KYC process in accordance with Art. 6 para. 1 lit. f GDPR.

Postal advertising

We process your personal data such as title, first and last name and address for the purpose of sending advertising information from CAPVERIANT, market events and interesting facts about public financing by post. We do this on the basis of our mainly legitimate interest in sending direct advertising in accordance with Art. 6 Para. 1 letter f GDPR.

Answering customer requests

When you contact us via e-mail, we will collect and process your e-mail address and any other relevant personal data you provided to us for the purpose of answering your requests. We do so, based on our legitimate interest to answer our users’ requests in accordance with Art. 6 para. 1 lit. f GDPR.

Newsletter dispatch

When you subscribe to our newsletter, we process your e-mail address, title, first name and surname for the purpose of sending CAPVERIANT advertising information, market events and interesting facts about public financing. We do this on the basis of your consent pursuant to Art. 6 para. 1 lit. a GDPR, which you give us by registering for the newsletter and confirming your registration in a two-stage procedure. You have the right to revoke this consent at any time with effect for the future by unsubscribing from the newsletter via a link provided in the e-mails.

Invitation function

Users of our platform have the opportunity to inform other persons („invited person“) of individual invitations to tender by e-mail using an invitation function.
In this case, we collect the e-mail address of the invited persons from the users for the purpose of inviting them to a tender. This processing takes place on the basis of our legitimate interest and the legitimate interest of the respective user in the electronic invitation to the respective tender in accordance with Art. 6 Para. 1 letter f GDPR.

If, as an invited person, you also wish to be informed by us of other, future invitations to tenders, we will process your e-mail address for the purpose of a general invitation to tenders on the basis of your consent in accordance with Art. 6 Para. 1 letter a GDPR, which you give to us in a two-stage procedure by registering separately and confirming your registration. You have the right to revoke this consent at any time with effect for the future by sending us an informal communication by e-mail or by unsubscribing via a link provided in the invitations.

4. How we share and transfer your personal data

Personal data we collect about you is processed by authorised employees of CAPVERIANT GmbH.
In addition, we will transfer your personal data to the following recipients:

Deutsche Pfandbriefbank AG (our mother company), acting as our processor for the purpose of our KYC process and as a fronting bank for our users (in cases where an investor and public institutions authorize a fronting bank);
SaarLB acting as a fronting bank for our users (in cases where an investor and public institutions authorize a fronting bank);
Other users (investors or public entities) of the Platform, if there is a match between their request for funding and your loan offer or vice-versa (processing of your personal data by these users will then be covered by their own privacy policies);
Competent authorities, where required by law;
Matomo and Hotjar (service providers), for the purpose of its analytics cookie as described in section 5 below;
IBS Data Protection Services and Consulting GmbH (external data protection officer). We will only transfer your personal data outside the European Economic Area (EEA) if you have given us your explicit consent to do so (see Section 5 – Hotjar) or if we are required to do so by a contractual agreement with you or by law.

5. Cookies

Cookies are small text files that are stored in the user’s browser and through which certain information is processed by CAPVERIANT GmbH.

The website and platform use session cookies and permanent cookies to ensure the security and provision of the website (“Necessary”, technically necessary cookies). These cookies are processed to protect our legitimate interests in accordance with Art. 6 Para. 1 lit. f GDPR, whereby ensuring the security of user registrations is our predominant legitimate interest.

The session cookies contain a so-called session ID, which can be used to assign various browser requests to a session. In this way, the user’s computer can be identified when returning to the website at a later date. The session cookies are automatically deleted when the user logs out or when the browser is closed.

Permanent cookies contain anonymous information about the visit to the website and are automatically deleted after a predetermined time, which may vary depending on the cookie.

Please note that you can always counteract the use of session cookies by adjusting your browser settings. In this case, your visit to our website or platform may be partially or completely restricted. There is no right of objection in accordance with Art. 21 GDPR due to the technical necessity of these cookies and to ensure security when visiting the website or platform in accordance with Art. 21 Para. 1 Clause 1 GDPR.

In addition, we also use cookies using the web analysis services „Matomo“ and „Hotjar“, which enable us to analyse access to our website and optimise content and displays (“Statistics”, not necessary cookies). In this way we can improve our offer and adapt it to the needs of the user. These cookies are only processed after consent has been granted in accordance with Art. 6 para. 1 lit. a GDPR, which can be revoked at any time with effect for the future.

Consent is given on our „cookie banner“ by clicking on the button „Allow all cookies“ or by ticking the box next to „Statistics“ in the „Manage cookies“ section. In addition, consent can also be given in the section „Cookie settings“ by ticking the box. A so-called content cookie (technically necessary cookie, see above) is then set, which enables us to trace the existence of consent.

The non-essential cookies only store information as long as the content cookie is set. You can revoke your consent at any time by unchecking the box in the „Cookie settings“ section. This will also delete the content cookie.
When using the „Matomo“ and „Hotjar“ services, no unique cookie ID number is assigned to the computer for web analysis to avoid aggregation and analysis of the data collected on this website. We also use the „AnonymizeIP“ extension, which shortens IP addresses so that they no longer identify a particular user. The IP address transmitted by the user’s browser via our web analysis services is not aggregated with any other data collected by CAPVERIANT GmbH.

The use of the analysis service „Hotjar“ may involve a transfer outside the EU. By consenting to all cookies or by activating the statistics cookies, the consent also includes permission to transfer the data to recipients outside the EU for which there is no adequate level of data protection. The risks to the rights and freedoms of natural persons may consist in the fact that an equivalent assertion of data subject rights is not possible in these states. If you do not consent to the processing of your data within „Hotjar“ as analytics service, including the transfer of your data to third countries without an adequate level of data protection, we ask you not to give consent for „all cookies“ or for the „statistics“ category.

Creation of logfiles when you visit the Platform and Website

Each time you access the Website or use the Platform as a registered user, CAPVERIANT GmbH will collect the following data:

Browser type and version;
Operating system;
The website from which you are accessing the Website and/ or the Platform;
The websites which are accessed from the Website and/ or the Platform;
Date and time of access to the Website and/ or the Platform;
IP address;
Internet service provider;
For audit log storage – CRUD (Create, Read, Update, Delete) actions related to an organisation, user, tender and bid (e.g. login/ logout data of a user, creation of a tender, creation of a bid).

This information is used to (1) correctly deliver the contents of the Website, (2) optimise the contents of the Website and (3) guarantee the long-term functionality of the information technology systems and technology of the Website. The data in the server log files is stored separately from other personal data. Server log file date is processed in order to protect our legitimate interests in accordance with Art. 6 Para. 1 lit. f GDPR, whereby our predominant legitimate interest is the correct/error-free mediation of the website, the optimisation of the presentation of page contents as well as long-term assurance of the functionality of the IT systems and technologies of the website. There is no right of objection in accordance with Art. 21 GDPR due to the technical necessity of providing the website or platform in accordance with Art. 21 Para. 1 Clause 1 GDPR.

6. No automated individual decision-making

We do not use your personal data for automated individual decision-making.

7. Data retention periods

We will only store your personal data for the processing period. Afterwards, we will delete such data.

Purpose	Initial data retention period	Archiving period
Providing and managing the platform	Until the end of the calender year following the termination of our contractual relationship with the entity registered on the platform	10 years (pursuant to §147 (3) of the German Fiscal Code) (equivalent to Art. L123-22 of the French Commercial Code)
KYC	For the duration of our contractual relationship with the entity registered on the platform	5 years (pursuant to §8 (4) of the German Anti-Money Laundering Act) (equivalent to Art. L123-22 of the French Commercial Code)
Customer requests	Until the query is closed	5 years (pursuant to §8 (4) of the German Anti-Money Laundering Act) (equivalent to Art. L123-22 of the French Commercial Code)

Cookies	Data retention period
Logfiles (when a user visits the platform)	No longer than 90 days
Logfiles (when a registered user uses the platform)	No longer than 18 months
Matomo (web analytics cookie)	13 months
Hotjar	365 days

CAPVERIANT GmbH may also process and keep personal data as part of the assessment, management and follow-up of litigation and disputes with users. In case of a pre-litigation dispute, personal data will be deleted in a secured manner as soon as the dispute is amicably resolved or, failing, as soon as the corresponding action is time-barred. In case of a litigation, personal data will be deleted in a secured manner as soon as appeal is no longer possible.

8. Your rights in respect of your personal data

To exercise these rights or for other questions or concerns about data protection, please contact us at the address provided in section 1.

Right to withdraw consent

If the processing of your personal data is based on your consent, you have the right to revoke it at any time with effect for the future.

Right of access and data portability
According to art. 15 GDPR, § 34 BDSG you have the right of information, i.e. the right to receive confirmation from us whether we are processing your personal data and, if so, to receive the information and a copy of your personal data, without prejudice to the rights and freedoms of others.

Irrespective of the information provided, you also have the right to data transfer in accordance with Art. 20 GDPR, with reference to the automated processing of your personal data which you have provided us with and which we process on the basis of your consent or for the fulfilment of a contract with you.

Right of rectification

You have the right to request the correction of your personal data in accordance with Art. 16 GDPR.

Right of erasure
Under the conditions of Art. 17 GDPR you have the right to have your personal data deleted:

When your personal data is no longer necessary in relation to the purpose for which it is processed by us;
If the processing of your data is based on consent and you have withdrawn your consent;
You object to the processing of your personal data and we have no overriding legitimate interest to keep such data;
Your personal data has been unlawfully processed;
This is required by law.

If we have made your personal data public and we are required to erase your data, we will, taking account of available technology and cost of implementation, take reasonable steps to perform their erasure.
Please note that we will not be able to erase your data if we need to keep processing it for exercising the right of freedom of expression and information, to comply with a legal obligation or for the establishment, exercise or defence of legal claims.

Right to restrict processing
In accordance with Art. 18 GDPR, you have the right to restrict the processing of your personal data:

When you contest the accuracy of your personal data, for a period enabling us to verify the accuracy of such data;
If the processing of your personal data is unlawful;
If we no longer need such personal data for the purpose of the processing and you need such data for the establishment, exercise or defence of legal claims;
Pending the verification whether we have an overriding legitimate interest to keep processing your personal data when you have exercised your right to object.

Right to object
You have the right to object to the processing of your personal data, which is based on our legitimate interest, under the conditions of Art. 21 GDPR. We will then stop processing the data relating to you unless we can prove that we have an overriding legitimate interest in its further processing.

Right to lodge a complaint
You have the right to lodge a complaint with a supervisory authority, in particular the EU authority where you have your habitual residence, or where an alleged infringement of the GDPR has occurred. The list of EU data protection authorities is available here: https://edpb.europa.eu/about-edpb/board/members_en.

9. Amendment of this Privacy Policy

CAPVERIANT GmbH reserves the right to change this Privacy Policy from time to time in compliance with legal requirements, for example to be compliant with new laws or to add new services. You can find the most recent version of this Privacy Policy on www.capveriant.com.