Personal Data Protection
How we collect, use and protect the personal data of website visitors, waiting-list registrants, senders of contact forms and investors.
English translation for convenience. The legally binding version is the Czech text.
1. Data controller
The controller of personal data is Bricks Funding a.s., Company ID (IČO) 23960531, with its registered office at Komořanská 2428/17, Modřany, 143 00 Prague 4, registered in the Commercial Register maintained by the Municipal Court in Prague, file no. B 30105.
Contact for matters relating to personal data protection: gdpr@bricksfunding.cz.
2. What data we process
Waiting-list registrants: first and last name, e-mail address, telephone number (optional), country of residence, planned investment amount, time horizon and source of funds (optional).
Senders of the contact form: name, e-mail, subject and content of the message.
Investors (after identity verification in the investment platform): identification data from the identity document (name, date of birth, document number and type, citizenship), bank details, tax residence, and an overview of investments made. Where the investor is a legal entity, we process, to a comparable extent, the personal data of the natural persons who act on its behalf or are its beneficial owners (members of the statutory body, authorised representatives, contact persons).
Website visitors:
- security logs – IP address, time and basic technical data about the request; we process these without consent on the basis of our legitimate interest (website security and prevention of attacks and fraud);
- analytics data – information about the browser, device, referrer and visited pages; we process these only with consent given through the cookie bar (see the Cookies Policy).
3. Purposes, legal bases and retention periods
| Purpose of processing | Legal basis (Art. 6(1) GDPR) | Retention period |
|---|---|---|
| Joining the waiting list and notifying of investment openings | point (b) – measures taken prior to entering into a contract at the data subject's request | until unsubscribing from the waiting list, no longer than 24 months from the last contact |
| Responding to an enquiry from the contact form | point (f) – legitimate interest (communication with interested persons) | 12 months from the last reply |
| Conclusion and performance of the contract with the investor | point (b) – performance of a contract | for the duration of the contractual relationship |
| Identity verification and screening of investors, prevention of fraud and money laundering | point (b) – performance of a contract; point (c) – compliance with legal obligations | for the duration of the contractual relationship and 10 years after its termination |
| Bookkeeping and compliance with tax obligations | point (c) – legal obligation (Accounting Act, tax regulations) | accounting records 5 years, financial statements 10 years, tax documents as per tax regulations |
| Operational notifications relating to an investment or the waiting list | point (b) – performance of a contract, or point (f) – legitimate interest | for the duration of the relationship |
| Marketing communications | point (a) – consent | until consent is withdrawn |
| Measuring website usage and improving it | point (a) – consent (cookie bar) | as per the Cookies Policy |
| Website security, prevention of attacks and fraud | point (f) – legitimate interest | technical logs 6 months |
4. Legitimate interests and the right to object
You have the right to object at any time, on grounds relating to your particular situation, to processing based on legitimate interest, in accordance with Art. 21 GDPR. Send your objection to gdpr@bricksfunding.cz; we will cease the processing unless we demonstrate compelling legitimate grounds that override your interests.
If we were ever to process your data for direct-marketing purposes, you may object to such processing without any further reason. In that case we will always stop processing the data for those purposes.
5. Provision of data
Providing data for the waiting list and the contact form is entirely voluntary; without it, however, we cannot provide the relevant service (joining the waiting list, answering an enquiry).
For investors, providing identification data is a contractual requirement and a condition for concluding the contract; without identity verification we cannot conclude the contract or enable the investment.
6. Copies of identity documents
Where, as part of identity verification, we make a copy (photograph) of your identity card or travel document, we do so only with your explicit consent, which you give during verification in the investment platform, in accordance with Act No. 269/2021 Coll., on Identity Cards, and Act No. 329/1999 Coll., on Travel Documents. You may withdraw your consent at any time; however, without a copy of the document it may not be possible to complete identity verification and conclude the contract.
We retain copies of documents for the same period as the other data from the identity-verification process (see the table in Section 3).
7. With whom we share data
We share personal data with the following categories of recipients, and only to the extent necessary:
- processors that provide the operation of the service for us on the basis of a processing agreement under Art. 28 GDPR: providers of hosting and infrastructure, e-mail and CRM tools, the operator of the inGain SaaS platform (technical provision of investor identity verification and investment management) and the providers of analytics tools Google Ireland Ltd. and Microsoft Ireland Operations Ltd. (only with consent, see the Cookies Policy);
- our auditor and other professional advisers bound by a duty of confidentiality;
- public authorities, where required by law (e.g. the tax administrator).
We will provide a current list of the specific processors upon request sent to gdpr@bricksfunding.cz.
8. Transfers of data outside the EU/EEA
We process data primarily within the EU/EEA. With the analytics-tool providers, data may be transferred to the USA within the Google and Microsoft groups; both parent companies are certified under the EU-U.S. Data Privacy Framework, which, according to the European Commission's adequacy decision, ensures a comparable level of protection of personal data.
9. Automated decision-making
The processing of personal data does not involve decisions based solely on automated processing. The results of automated checks within identity verification are always assessed by a member of our staff.
10. Your rights
You have the right of access to your data, and the right to rectification, erasure, restriction of processing, portability and to object (see Section 4 above). You may withdraw your consent at any time with effect for the future; withdrawal does not affect the lawfulness of processing carried out before it.
Send requests to gdpr@bricksfunding.cz. We will handle them without undue delay, at the latest within one month; for complex or numerous requests we may extend the period by a further two months, of which we will inform you. Where we have reasonable doubts about the identity of the requester, we may ask for additional information to verify it before handling the request – this protects your data against misuse.
You also have the right to lodge a complaint with the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, https://www.uoou.gov.cz/.
11. Cookies
The website uses necessary cookies for basic functioning and, only with your consent, analytics cookies. You can find the full overview, legal bases and settings options in the Cookies Policy.
12. Security
We apply technical and organisational measures appropriate to the risk: encryption in transit (TLS), encryption of sensitive fields, access control, audit logs and regular reviews.
13. Changes to this policy
We may update this policy. We will notify waiting-list registrants and investors of material changes by e-mail and publish them on our website with a new effective date.