Legal

PRIVACY POLICY

This is CrowdedHero’s Privacy Policy (“Policy”) applicable to the Services, as defined below. This Policy forms an integral part of CrowdedHero’s Terms and Conditions. Processing of your personal data is subject to the EU General Data Protection Regulation (“GDPR”) and applicable national legal acts. This Policy explains how we will process your personal data, for which purposes, for how long and also informs you about your rights.

The Policy may be made available in several languages; all versions are legally binding, but in the event of inconsistency between the Latvian version and a translated version, the Latvian version prevails.

The version of this Policy is effective as of 1st of August, 2023.

1    DEFINITIONS

The following capitalized terms have the following meanings in this Policy

2    OUR CONTACT DETAILS

2.1 For any additional questions regarding on how we process your personal data, please contact our Customer Support Service. You can contact them via e-mail at: [email protected].

2.2 The Customer Support Service is available on the Business Days from Monday through Friday, 9:00 a.m. to 5:00 p.m. (EET) for any questions you may have. If you contact our Customer Support Service, please provide the following information including:

2.2.1 your identification number (if such has been given to you by us);

2.2.2 if you are a natural person – your name and last name;

2.2.3 if you are a legal entity – your company’s name, and your authorized representative’s name and last name;

2.2.4 your full telephone number, including country code;

2.2.5 a brief message describing your question.

3    PURPOSE OF THIS POLICY

3.1 This Policy applies when:

3.1.1 you have expressed the intention to use our Services as an Investor or a Project Owner or during the use of our Services in accordance with our Terms;

3.1.2 you represent a Client (for example, as an authorized representative of a Project Owner, an authorized representative of an Investor, etc.) or you have been indicated as the contact person for the Client (for example, in the complaints form as a legal representative of a Project Owner or Investor);

3.1.3 you have used our Services in the past and we are required to retain this information;

3.1.4 you contact us or submit to us a complaint in line with our Complaints Policy;

3.1.5 you visit our Website;

3.1.6 in any other way provide us with your personal data for any of the data processing purposes set in this Policy.

4    OUR ROLE

4.1 Generally, when you use our Services, access the Platform, the Website or contact us, we are the data controller.

4.2 In certain cases, for example, during the registration process on our Platform and when a Client opens a Payment Account with the payment institution Lemonway (registration number 500 486 915, registered address 8, rue du Sentier - 75002 Paris, France) (“Lemonway”), we act as a joint controller together with Lemonway. We cooperate with Lemonway to enable you to use payment services on our Platform about your use of our Services. More information about the joint controllership is available in Section ‘’Joint Controllership” of this Policy.

5    JOINT CONTROLLERSHIP

5.1 As payment processing on the Platform is carried out exclusively by Lemonway, to begin using the Services, our Clients are required to open a Payment Account with Lemonway pursuant to Lemonway’s terms made available on our Website. In essence, our joint controllership agreement states that:

5.1.1 we collect and jointly process your personal data for the following purposes:

-  the opening and management of your Payment Account and processing payments about the Services;

-  compliance with the legal requirements arising from requirements relating to the anti-money laundering and combating the financing of terrorism, for example, verify that our Clients are not sanctioned persons, do not cooperate with such persons or are part of an investigation of relevant authorities or considered as a politically exposed person, verify their source of income, etc. In essence, we collect Client personal data and share it with Lemonway, so that Lemonway is able to perform these checks in line with its internal due diligence procedure and open the Payment Account;

5.1.2 the requests to access personal data, exercise the right to data portability, limit or object to the processing of Client’s data about these activities will be answered by either us or Lemonway, whoever receives the request. For this purpose, Clients may contact the parties using the following e-mail addresses:

-  Lemonway – [email protected];

-  CrowdedHero – [email protected].

5.2 Please note that further information about how Lemonway processes your personal data is available in Lemonway’s terms made available to you on our Website and concluded by and between you and Lemonway during the registration process with us in compliance with the procedure established on the Platform.

6    PURPOSE OF PERSONAL DATA PROCESSING AND LEGAL BASIS

We can process your personal data for various purposes and based on different legal grounds. Please note that we may process certain types of personal data for several purposes at the same time. We may receive your data from both you and external sources, such as public and private registries and other third parties.

6.1   Registration of an Account on the Platform

6.1.1 When you register on the Platform for the use of our Services as a potential Investor or Project Owner, we collect data, which is required to create and open an Account on the Platform. For this purpose we will process your name, surname and e-mail address.

6.1.2 The legal basis for the processing of your data for this purpose is the performance of the Services or taking steps prior to entering into the Services in accordance with our Terms.

6.2     Registration of the Account through the Social Media channels

6.2.1       We offer you the possibility to register and log in to the Platform with your Facebook account, Google account or LinkedIn account. In this case, additional verification of your email on the Platform is not required. Rather, the user account of your social network (Google, Facebook or LinkedIn) is linked to the Account on the Platform so that you can register and log in with your social media user account to the Account on the Platform. The advantage for you is that you do not have to remember a separate password for your Account on the Platform.

6.2.2       The legal basis for transmission of your data - first name and surname as well as the e-mail address - is the performance of the Services or taking steps prior to entering the Services in accordance with our Terms. You provide us with all additional information voluntarily, the legal basis for the processing of your data for this purpose is your consent. The purpose of processing data is to make easier for you to use our registration function.

6.2.3       When registering with social login, through the link, we automatically receive the following information from Meta Platforms Ireland Limited, Google Ireland Limited or LinkedIn Ireland as a minimum:

·       First and last name

·       E-mail address.

6.2.4       For further information on the respective social media login, the transmitted data and the privacy settings of your social media account, please refer to the respective data protection notices and the terms of use of

·       Meta (https://www.facebook.com/legal/terms).

·       Google (https://policies.google.com/privacy?hl=en-US).

·       LinkedIn (https://www.linkedin.com/legal/privacy-policy).

6.2.5       You can prevent processing data of your social media account (Facebook, Google or LinkedIn) by using the regular registration process. Further settings may be possible within the profile settings of your social media (Facebook, Google or LinkedIn) account.

6.3   Compliance with a legal obligation and verifying your information

6.3.1 Once you have submitted your application to create and open an Account on the Platform regardless of the kind of registration and login, we will collect and process your personal data, which we require to identify you and perform our internal due diligence procedure in order to comply with applicable laws, including requirements relating to the anti-money laundering and combating the financing of terrorism.

6.3.2 If you are a natural person (individual), then for this purpose we will process:

-  your identification details (name, surname, date of birth, personal identity number or taxpayer number, nationality, passport details (its number, date of issue and expiry, issuing authority), and details of either ID card, residence permit or driving license (its number and expiry date);

-  contact details (e-mail address, residence address, phone number);

-  your financial data (bank account details, bank statements, tax residency, financial data, source of income, etc.);

-  other data, which may be required for this purpose in accordance with applicable laws and regulations, such as information on you as a politically exposed person and whether you are a citizen of the United States.

6.3.3 If you are an authorised representative of an Investor that is a legal person, then for this purpose we will process:

-  your identification details (name, surname, date of birth, personal identity number or taxpayer number, nationality, details of a passport or ID card (its number and date expiry));

-  contact details (e-mail address, residence address, phone number);

-  your position and a confirmation of the right of representation;

-  other data, which may be required for this purpose in accordance with applicable laws and regulations, such as information on you as a politically exposed person and whether you are a citizen of the United States;

6.3.4 If you are an ultimate beneficial owner of an Investor that is a legal person, then for this purpose we will process:

-  your identification details (name, surname, date of birth, personal identity number or taxpayer number, nationality, details of a passport or ID card (its number and date expiry));

-  contact details (e-mail address, residence address, phone number);

-  your financial data (source of wealth, etc.);

-  other data, which may be required for this purpose in accordance with applicable laws and regulations, such as information on you as a politically exposed person and whether you are a citizen of the United States.

6.3.5 The legal basis for processing your personal data for this purpose is the compliance with the applicable laws and regulations, which we are subject of and performance of the Services or taking steps prior to receiving the Services in accordance with our Terms.

6.4   Knowledge Test

6.4.1 To assess whether you have sufficient knowledge, skills and experience as required to use our Services and understand the risks involved in investing, you will be required to take the Knowledge Test and use the Simulation Tool on the Platform. For this purpose, we will process:

-  information about your experience, investment objectives, financial situation and basic understanding of risks involved in investing in general and in investing in the types of investments offered on our Platform;

-  information about your net worth and other information, to help you assess your ability to bear the possible loss.

6.4.2 The legal basis for processing your personal data for this purpose is the compliance with the applicable laws and regulations, which we are subject of and performance of the Services or taking steps prior to receiving the Services in accordance with our Terms.

6.4.3 If you are a Prospective non-sophisticated investor or Non-Sophisticated investor, we will only receive the results of your Simulation after you have submitted them to us. Prior to submitting the results, we will only receive information that you have used the Simulation, but the results will be visible to us only if you choose to submit them to us. If you indicate as affirmative check box  after the Simulation, it will be considered as your consent to provide us your result of the Simulation.

6.4.4 Based on the information you provide while taking the Knowledge Test and/or using the Simulation Tool, we will create your profile in a way that we make sure that we ascertain that you understand the level of risk associated with an investment in the Projects published on our Platform and offer the possibility to simulate your ability to bear the loss. More information on profiling and automated decision making is available in Section “Profiling and automated decision making” of this Policy.

6.5   Evaluating Project Owners

6.5.1 If you are an authorized representative of the Project Owner, we will collect and process your information to evaluate your Project, protect the interests of our Investors and publish information about the Project on our Platform. For this purpose, we will process:

-  your identification details (name, surname, date of birth, personal identity number or taxpayer number, nationality, details of a passport or ID card (its number and date expiry);

-  contact details (address, e-mail address, phone number);

-  your position and data on your criminal convictions;

-  other data, which may be required for this purpose in accordance with applicable laws and regulations.

6.5.2 The legal basis for processing your personal data for this purpose is the compliance with the applicable laws and regulations, which we are subject of and performance of the Services or taking steps prior to receiving the Services in accordance with our Terms.

6.6   Providing our Service

6.6.1 Once we have verified your information and performed our internal due diligence procedure, we will process your data to transfer the data to Lemonway necessary for opening a Payment Account for you with Lemonway and provide you our Services. For this purpose, we will process:

-  your identification and contact details (your name, surname, identification document details, e-mail address);

-  your financial data (bank account details, bank certificates);

-  other data, which may be required for this purpose.

6.6.2    In some case, for providing our Services your qualified electronic signature and a time stamp is required for the provision of our Service. We will process your data to transfer the data to Dokobit, UAB (registration number 301549834, registered address Paupio g. 50-136, Vilnius, Lithuania) (“Dokobit”), necessary for signing the Project Owner’s documents with the qualified electronic signature with a time stamp. We will process:

-    your identification and contact details (your name, surname, personal identification number, date of birth, address, identification document details, e-mail address, and phone number);

-    data about investments (share/stock number, share/stock price, bank account details);

-    other data, which may be required for this purpose in accordance with applicable laws and regulations.
For more information about Dokobit, see  Dokobit Privacy Policy (https://www.dokobit.com/compliance/privacy-policy).

6.6.3    In the scope of the Secondary Market, we will process your data to transfer to other Investors. We will process:

-    your contact details (e-mail address and if you submit it to us also telephone number).

6.6.4  The legal basis for the processing your data for this purpose is the performance of the Services or taking steps prior to receiving the Services in accordance with our Terms.

6.7   Payment processing on our Platform

6.7.1 To connect you to your Payments Account, process the payment transactions in relation to the Services, maintain any payment-related documentation, we will process your full name, personal identity number and your Payment Account details.

6.7.2 The legal basis for processing your data for this purpose is the compliance with the applicable laws and regulations, which we are subject of and performance of the Services or taking steps prior to receiving the Services in accordance with our Terms.

6.8   Marketing and promotional activities

6.8.1  If you have signed up to our newsletter or marketing information, we will process your e-mail address to send you our news and updates. The legal basis for processing your information for this purpose is your consent. Please note that you have the right to withdraw your consent at any time, by clicking on the unsubscribe link in each e-mail footer, on the Platform by logging in your Account, opening section ‘Account Settings’ and then checking the relevant check boxes in the section ‘Subscriptions’, as well as by contacting us using the e-mail address provided in this Policy.

6.9   Providing support and communication with you

6.9.1 To communicate with you, contact you, provide consultations and resolve any issues in relation to our Services and/or the use of the Platform, we will process:

-  your name, phone number and e-mail address;

-  information registered with your user profile, activities on our Platform and the data you provide to us during the communication.

6.9.2 The legal basis for the processing your data for this purpose is our legitimate interest to resolve any issues or misunderstandings, provide support and necessary information related to our Services and Platform.

6.10   Managing Investor and Project Owner cooperation

6.10.1 To facilitate the meeting of Investors and Project Owners and to provide any relevant documentation, confirmations, contracts or other legally or contractually required information, we will process:

-  your identification details (name, surname, date of birth, personal identity number, identification document details);

-  contact information (residence address, e-mail address);

-  other data, which may be relevant for this purpose and/or contained in the relevant documents.

6.10.2 The legal basis for the processing of your data for this purpose is the compliance with the applicable laws and regulations, which we are subject of and performance of the Services or taking steps prior to receiving the Services in accordance with our Terms.

6.11 Protecting our legal rights and interests

6.11.1 In certain cases, we may process your personal data to pursue and defend our legal interests, such as to prevent fraud or attempted fraud, recover funds, prove your consent, resolve any disputes and conflicts, and raise and maintain legal claims. For this purpose, we will process:

-  your identification details (name, surname, date of birth, personal identification number, identification document details);

-  contact information (residence address, e-mail address);

-  other data, which may be relevant for this purpose, for example, information on your activities on the Platform or use of our Services.

6.11.2 The legal basis for the processing of your data for this purpose is our legitimate interest to protect and defend our legal rights and interests.

6.12 Analysis and improvement of our Services

6.12.1  We may process your personal data to find out your opinion about our Services, as well as to analyse our Services and Platform, compile statistics and other analytical information for the purpose of assessing risks, improving the Services and avoiding deficiencies. For this purpose, we will process:

-  your identification details (name, surname, date of birth, personal identity number, identification document details);

-  contact information (residence address, e-mail address);

-  your use of our Services and Platform or content you have provided to us or posted on the Platform.

6.12.2  The legal basis for the processing your data for this purpose is our legitimate interest to analyse and improve our Services, study how Clients use our Services and develop and grow our business.

6.13 Ensuring IT and network security

6.13.1 To monitor the use of our Services, as well as the operation of our Platform and other information systems, including databases, websites and networks, we may process various technical data obtained from cookies, audit trails and other technical solutions. For this purpose, we will process

-  your IP address;

-  information on your device and browser which you use to access our website and Platform;

-  time zone and various metadata, such as information on access to and interaction with the Platform or website, and other information for this purpose.

6.13.2 The legal basis for the processing this information is our legitimate interests to ensure safety and security of our Services and the Platform and ensure our business continuity.

6.14 Cookies and web analytics

6.14.1 Our website uses cookies and similar technology such as web pixels. If you have provided your consent, in addition to the cookies, which ensure website functionality, we may collect analytical data. For further information, please see our Cookie Policy.

7    DATA RETENTION

7.1 We will process your personal data as long as:

7.1.1 one of the above-mentioned legal basis for data processing exists and there is a purpose for your personal data processing, for example, you are registered on our Platform and using the Services or your consent to certain data processing is valid;

7.1.2 we are required by the applicable law to retain your personal data;

7.1.3 there is a need to pursue our legitimate interests, for example, raise and maintain legal claims.

7.1.4 if the data processing is based on consent, you have the possibility to revoke your consent to the data processing.  A revocation takes effect from the time at which it is expressed. It has an effect for the future. You can revoke your consent at any time. This can be done by post, email or by any other means.

7.2 When these conditions end, we will delete or anonymize your personal data.

8    DATA SHARING

8.1 If reasonably required, we may share your personal data with our outsourced service providers, partners and professional advisers (collectively – “Partners”), for example, with Partners who provide KYC and AML assessment tools, IT and data hosting services, email and content delivery tools, accounting, legal, audit, web analytics and marketing services and other services that we may reasonably need to provide the Services and Platform.

8.2 In certain situations, we have a legal obligation to share your information with third parties to comply with legal requirements or requests, as well as to protect our, or a third party’s legal interests. We will also disclose your information to third parties to the extent allowed by applicable law and as set in our Terms, including:

8.2.1 to a prospective purchaser or purchaser that acquires all or substantially all of us or our business;

8.2.2 to a third party if we sell or buy any business or undergo a merger, in which case we may disclose your information to the prospective buyer of such business; and

8.2.3 to a third party if we partner with other companies or businesses, undergo a reorganization, bankruptcy, insolvency or liquidation, or otherwise undertake a business transaction or sell some or all our assets. In such transactions, your information may be among the transferred assets.

8.3 When we share your personal data with the Partners, we comply with the applicable data protection legal norms, specifically:

8.3.1 we transfer only the minimum amount of data necessary for a particular Partner;

8.3.2 we only cooperate with a Partner who can provide and ensure an adequate level of personal data protection;

8.3.3 If the Partner acts as our data processor, it may only process personal data in accordance with our instructions, on the basis of a written agreement, and may not use it for other purposes.

9    DATA TRANSFER OUTSIDE OF THE EU

9.1 If a Partner is located outside the EU / EEA, we will share your personal data in accordance with the requirements set in the GDPR and applicable personal data protection legal norms, including:

9.1.1 by entering into EU standard contractual clauses or by using other appropriate grounds for data transfer provided by applicable legal norms such as codes of conduct and certifications;

9.1.2 cooperating with a Partner located in a country, which offers an adequate level of data protection in accordance with the European Commission decision.

10 PROFILING AND AUTOMATED DECISION-MAKING

10.1 Profiling is the evaluation of natural persons (individuals) according to certain parameters, such as economic situation, preferences, knowledge level, experience, etc., to assign individuals to a pre-defined category based on this evaluation. Automated decision-making is the making of certain decisions by technical, automated means, using the information and data provided by the individual or the information obtained as a result of profiling.

10.2 We use profiling and automated decision-making during the assessment of your results of the Knowledge Test and Simulation Tool to ascertain that you understand the level of risk associated with an investment in the Projects published on our Platform and offer the possibility to simulate your ability to bear the loss. If the outcome of the assessment will indicate that certain investment opportunities are not suitable for you or may cause high risk to your financial situation, we will provide appropriate risk warnings. The Investor may choose to proceed with the investment, disregarding the said risk warnings.

10.3 We review and amend our decision-making algorithms and underlying logic to avoid any assessment-related mistakes or errors. If we have refused to provide you our Services, based on profiling or automated decision-making, you have the right to request that your application to create and open an Account on the Platform is reviewed manually. This right does not guarantee that the result of the assessment will be different.

10.4 Profiling and automated decision-making are:

10.4.1 based on our legal obligations relating to anti-money laundering and combating the financing of terrorism as well as requirements applicable to the crowdfunding service providers;

10.4.2 required for using our Services in accordance with our Terms.

11 YOUR RIGHTS

11.1 As a data subject you have the rights, which are provided by the GDPR and other legal acts and laws implementing or supplementing the GDPR. These rights provide that you can:

11.1.1 find out what information we process about you and ask for clarification on data processing;

11.1.2 correct false or inaccurate data;

11.1.3 withdraw your consent to the processing of data based on such consent. Please be aware that the withdrawal of the consent will not affect the lawfulness of processing based on consent before its withdrawal;

11.1.4 ask to delete your data. Please note that we will not be able to delete data that we are required to process and retain in accordance with applicable laws or that may be necessary to defend our rights or bring legal action if our rights have been infringed;

11.1.5 object to the processing of data, which is processed based on our legitimate interests. In the event of such an objection, we will no longer process your personal data, unless we will demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims;

11.1.6 request to receive your data to transfer it to another data controller, provided that this does not affect our legitimate interest in protecting our trade secrets or any other confidential information;

11.2 To exercise these rights, please contact us using the e-mail address indicated in this Policy. We will process this request within 30 (thirty) days and provide an answer. When we receive your request for the exercise of your data subject rights, we will verify your identity, evaluate the request and execute it in accordance with the applicable legal norms.

11.3 Additionally, you have the right to file a complaint to the supervisory authority (State Data Inspectorate) if you believe that we have violated your data subject's rights.

12 REVISION AND MONITORING OF THIS POLICY

12.1 We reserve the right, at our sole discretion, to modify, amend, supplement or replace this Policy at any time. We will review and revise this Policy when there are any material circumstances arisen that may affect our ability to apply this Policy pursuant to the provisions of statutory and law requirements. What constitutes a material change will be determined at our sole discretion.

12.2 We will inform our Clients on all material amendments to this Policy by publishing the updated version of this Policy on our Platform. We may also notify you of such amendments by e-mail.