Privacy Policy.

Data Processing

Below we inform you about how we handle personal data when you use our website. We act in accordance with the General Data Protection Regulation ("GDPR") and applicable German data-protection law. You can retrieve this statement at any time on our website. Please note that the transmission of data over the internet (e.g. email) can have security gaps and cannot be completely protected against access by third parties. Any use of our contact details for unsolicited commercial promotion or advertising is prohibited unless we have given written approval or an ongoing business relationship exists.

1. Controller

LEA Ventures GmbH
An der RaumFabrik 10
76227 Karlsruhe
Germany
Email: info@leaventures.de‍

2. Data protection officer‍

We are advised on data protection matters by the specialists at Protektis GmbH (www.protektis.de), who act as our data protection officer. If you have questions about how we handle your personal data, or wish to report a data protection concern, please contact us at datenschutz@protektis.de.

3. Data collected when you visit the website, and hosting

When you visit our website, your browser automatically transmits certain information to the server hosting the site. This information is stored temporarily in a log file and deleted automatically after a defined period. The following data is collected:

• IP address of the requesting device
• Date and time of access
• Name and URL of the file accessed
• Referrer URL (the website from which you accessed our site)
• Browser type and version, operating system, and, where applicable, the name of your access provider

This data is processed to ensure a reliable connection, to enable convenient use of the website, to evaluate system security and stability, and for other administrative purposes. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in the purposes listed above). We do not use this data to draw conclusions about you as an individual.

Hosting. Our website is hosted by Webflow, Inc. (398 11th Street, 2nd Floor, San Francisco, CA 94103, USA). Webflow acts as our processor under a data processing agreement and processes the connection data described above on our behalf. Webflow's infrastructure (including AWS and Fastly) is located in the United States, so this data is transferred to and processed in the USA. Webflow provides Standard Contractual Clauses within its data processing agreement as the safeguard for this transfer and is certified under the EU–U.S. Data Privacy Framework. Server logs containing IP addresses are retained by Webflow for a limited period (up to approximately 30 days) for security and abuse-prevention purposes.

4. Dealflow / investments

You can send us information about investment opportunities by email. We process this data solely to assess the opportunity. It is stored in identifiable form, not anonymised, and only the staff responsible for evaluation have access to it.

To store and assess dealflow we rely on cloud-based file-storage and CRM/dealflow providers acting as our processors under data processing agreements. Some of these providers are located outside the EU/EEA, including in the USA. Where personal data is transferred outside the EU/EEA, we rely on appropriate safeguards, in particular the European Commission's Standard Contractual Clauses and, where applicable, the recipient's certification under the EU–US Data Privacy Framework.

Processing is based on Art. 6(1)(a) GDPR (your consent). You may withdraw your consent for future processing at any time by email or in writing. Note that we may be subject to statutory retention requirements, so some processing may continue after a transaction ends.

5. Applications

You can apply to join our team through our online application form or by email. Applications we receive by email are transferred into this system. Below we explain the scope, purpose and use of the personal data we collect during the application process. We process your data in accordance with applicable data protection law and all other statutory provisions, and treat it in strict confidence.

When you send us an application, we process the personal data associated with it (for example contact and communication data, your application documents and notes taken during interviews) to the extent necessary to decide whether to establish an employment or internship relationship with you. If you apply through our online form, this includes the information you enter there, such as your name, email address, the role you are applying for, your earliest start date, your CV and your answers to our questions, as well as any optional details you choose to provide.

The legal basis is § 26 BDSG (initiation of an employment relationship), Art. 6(1)(b) GDPR (steps prior to entering into a contract) and, where you have given consent, Art. 6(1)(a) GDPR. You may withdraw your consent at any time. Within our company, your personal data is shared only with the people involved in processing your application. If your application is successful, we store the data you submitted in our systems on the basis of § 26 BDSG and Art. 6(1)(b) GDPR for the purpose of carrying out the employment relationship.

Our online application form and the system in which we manage applications are provided by a cloud-based workspace provider located in the USA, acting as our processor under a data processing agreement. Applications we receive by email or post are transferred into this system. For transfers to the USA we rely on the European Commission’s Standard Contractual Clauses and, where applicable, the recipient’s certification under the EU–U.S. Data Privacy Framework.

If we cannot offer you a position, you decline an offer or you withdraw your application, we may retain the data you submitted for up to six months after the application process ends, on the basis of our legitimate interests (Art. 6(1)(f) GDPR). We then delete the data. This retention serves in particular as evidence in the event of a legal dispute. If it is apparent that the data will be needed beyond the six-month period, for example because of a threatened or pending legal dispute, we delete it only once the purpose of further retention no longer applies.

We may also retain your data for longer if you have consented to this (Art. 6(1)(a) GDPR) or if statutory retention obligations prevent deletion.

6. Social media and external links

We maintain a presence on LinkedIn to present our organisation and our work. The platform is operated by LinkedIn Ireland Unlimited Company (Wilton Place, Dublin 2, Ireland). When you visit our LinkedIn page or interact with us there, LinkedIn processes your personal data under its own privacy policy, over which we have no influence. You can view it at https://www.linkedin.com/legal/privacy-policy.

Our website links to LinkedIn, for example from our team profiles and the footer. These are plain links: no LinkedIn content is embedded in our pages, and no LinkedIn cookies or scripts are loaded unless you actively follow a link and leave our site. Once you do, LinkedIn's privacy policy applies. The same applies to other external links on our site, such as to portfolio companies; the privacy policy of the respective site then governs.

The legal basis for maintaining our LinkedIn presence and responding to enquiries made through it is Art. 6(1)(f) GDPR (our legitimate interest in presenting our organisation and communicating with interested parties).

Our website uses the jsDelivr content delivery network (provider: Volentio JSD Limited, Suite 2a1, Northside House, Mount Pleasant, Barnet, EN4 9EB, United Kingdom) to deliver certain static files. When these load, your IP address and technical connection data are transmitted to jsDelivr so the content can be delivered to your browser. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in the secure and efficient provision of our website).

Our careers page and application form are published on Notion, a service of Notion Labs, Inc. (USA), at leaventures.notion.site. When you follow a link there from our website, you leave leaventures.de. Notion processes your connection data, such as your IP address, to deliver these pages and may set cookies, under its own privacy policy: https://privacycenter.notion.so/policies. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in providing information about open positions and a simple way to apply). How we process the information you submit in an application is described in section 5.

7. Cookies

Our website does not set cookies. It is hosted on Webflow, which does not place cookies on sites published through its hosting, and we do not use analytics, advertising, or other tracking tools. Should we introduce cookies in future, we will update this policy and, where any non-essential cookies are involved, obtain your consent under §25(1) TDDDG before they are set.

8. Disclosure of data to third parties

Your data is not passed to third parties except as follows:

• Where you have expressly consented (Art. 6(1)(a) GDPR)
• Where disclosure is necessary to establish, exercise or defend legal claims (Art. 6(1)(f) GDPR) and there is no overriding interest of yours in non-disclosure
• Where there is a legal obligation to disclose (Art. 6(1)(c) GDPR)
• Where disclosure is required to perform a contractual relationship with you (Art. 6(1)(b) GDPR)

We also engage the processors and processor categories described above (hosting, and our file-storage and CRM/dealflow providers), who act only on our instructions under data processing agreements.

9. Your rights

You have the following rights regarding your personal data:

• Access (Art. 15 GDPR) — to obtain confirmation of whether we process your data and a copy of it
• Rectification (Art. 16 GDPR) — to have inaccurate data corrected
• Erasure (Art. 17 GDPR) — to have your data deleted, subject to legal retention obligations
• Restriction (Art. 18 GDPR) — to restrict processing in certain circumstances
• Data portability (Art. 20 GDPR) — to receive your data in a structured, machine-readable format
• Objection (Art. 21 GDPR) — to object to processing based on legitimate interest
• Withdrawal of consent (Art. 7(3) GDPR) — to withdraw any consent at any time, without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at info@leaventures.de.

10. Right to complain to a supervisory authority

You have the right to lodge a complaint with a data-protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your residence, place of work, or the place of the alleged infringement, if you consider that our processing of your personal data infringes the GDPR.