1. Who we are
This website, www.bondstone.ventures (the "website"), is operated by Bondstone Ventures, SCR, S.A., a venture capital company (sociedade de capital de risco) with registered office at Rua Castilho, 39, 10C, 1250-068 Lisboa, Portugal, and single registration and tax number 519208978 ("Bondstone Ventures", "we", "us"). Bondstone Ventures is the controller of the personal data described in this Privacy Policy.
You can contact us about this Privacy Policy or your personal data at ventures@bondstone.com or by post to the address above.
2. What this Privacy Policy covers
This Privacy Policy explains how we use personal data when you visit the website, submit a pitch, request information about our fund or otherwise contact us.
It does not cover personal data that we process in the course of our investment and fund-management activities, for example about investors, portfolio companies or their representatives, for which we provide separate information. Reports made through our whistleblowing channel are covered on the Whistleblowing page.
Our use of cookies and similar technologies is explained in our Cookies Policy, which should be read together with this Privacy Policy.
3. How we use your personal data
| Purpose | Personal data | Legal basis | How long we keep it |
|---|---|---|---|
| Assessing pitches submitted through the pitch submission form or by email | Company name, founder name, email address, sector, deck link or uploaded deck, one-line description and any other information you provide | Our legitimate interest in identifying and assessing investment opportunities (Article 6(1)(f) GDPR) | Up to 24 months after our last contact with you. If we invest, the information becomes part of our investment records, which are covered by separate information |
| Responding to requests for information about our funds | Name, email address, organisation, indicative investment amount and message | Taking steps at your request before a possible investment (Article 6(1)(b) GDPR) and our legitimate interest in responding to potential investors (Article 6(1)(f) GDPR) | Up to 24 months after our last contact with you. If you become an investor, your data is covered by the separate information we provide to investors |
| Replying to other messages you send us | Name, email address, the content of your message and any attachments | Our legitimate interest in answering and following up on enquiries (Article 6(1)(f) GDPR) | Up to 24 months after our last contact with you |
| Operating the website and keeping it secure | IP address, browser and device information, date and time of access, pages requested, error and security logs | Our legitimate interest in providing a secure and functioning website (Article 6(1)(f) GDPR) | Up to 12 months from the date the information is recorded |
| Website analytics | Online identifiers and information about how you use the website, as described in our Cookies Policy | Your consent (Article 6(1)(a) GDPR and Article 5(1) of Law No. 41/2004 of 18 August) | Analytics data: 14 months. Cookies durations are set out in our Cookies Policy |
| Establishing, exercising or defending legal claims and complying with legal obligations | Any of the above, as relevant | Our legitimate interest (Article 6(1)(f) GDPR) or compliance with a legal obligation (Article 6(1)(c) GDPR) | For the applicable limitation period or as long as required by law |
Fields marked as mandatory on our forms are needed for us to reply to you. You are not under any legal or contractual obligation to provide personal data, but if you do not, we may be unable to respond.
Please do not send us special categories of personal data (such as health data) unless we specifically ask for them.
Where we rely on legitimate interests, you can ask us for more information about how we balanced those interests against your rights.
We do not sell personal data. We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
4. Where your personal data comes from
We collect personal data directly from you when you submit a form or contact us, and automatically from your browser or device when you use the website (see our Cookies Policy). If someone else sends us a pitch or enquiry that mentions you, for example as a co-founder, we receive your personal data from that person.
5. Who we share your personal data with
We share personal data only where necessary for the purposes described above, with:
- service providers that process personal data on our behalf and under our instructions, under contracts that meet Article 28 GDPR: website hosting and development, email and IT services, and website analytics (Google);
- other Bondstone group companies, where needed to deal with your pitch or enquiry;
- professional advisers, courts, supervisory authorities and other public authorities, where required by law or needed to establish, exercise or defend legal claims.
Further information about our analytics provider is set out in our Cookies Policy.
6. International transfers
We generally process your personal data within the European Economic Area (EEA). Information collected through Google Analytics may be transferred to Google LLC in the United States. These transfers rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework, under which Google LLC is certified, and, where applicable, on the standard contractual clauses included in Google’s data processing terms.
Where any other service provider processes personal data outside the EEA, we ensure that the transfer is covered by an adequacy decision or by the standard contractual clauses adopted by the European Commission. You can ask us for information about these safeguards, and for a copy of them, using the contact details in Section 1.
7. How long we keep your personal data
We keep personal data only for the periods set out in Section 3. After that, we delete or anonymise it, unless we need to keep it longer to comply with a legal obligation or to establish, exercise or defend legal claims.
8. Your rights
Subject to the conditions set out in the GDPR, you have the right to:
- access your personal data and receive a copy of it;
- have inaccurate or incomplete personal data corrected;
- have your personal data erased;
- restrict the processing of your personal data;
- receive the personal data you gave us, in a structured, commonly used and machine-readable format, and have it transmitted to another controller, where the processing is based on consent or on a contract and is carried out by automated means;
- object at any time to the use of your personal data for direct marketing, in which case we will stop;
- withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
You also have the right to lodge a complaint with a supervisory authority, as explained in Section 13.
9. How to exercise your rights
Contact us using the details in Section 1. Exercising your rights is free of charge. We will reply within one month of receiving your request. We may extend this by up to two further months where necessary, taking into account the complexity and number of requests, and will tell you if we do. If we have reasonable doubts about your identity, we may ask for information to confirm it.
10. Social media
The website links to our LinkedIn page. When you use LinkedIn, LinkedIn Ireland Unlimited Company processes your personal data under its own privacy policy. For the statistics that LinkedIn provides to us about visits to our page, we and LinkedIn are joint controllers, under the terms LinkedIn makes available for that purpose.
11. Security
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration and disclosure.
12. Children
The website is not directed at children, and we do not knowingly collect personal data from children.
13. Complaints
If you believe that our use of your personal data breaches data protection law, you can lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, www.cnpd.pt, or with the supervisory authority of the EU Member State of your habitual residence, your place of work or place of the alleged infringement.
We would appreciate the chance to deal with your concern first, so please feel free to contact us.
14. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. The date at the top shows when it was last changed. We will draw material changes to your attention on the website or, where appropriate, by email.