This policy covers the processing of personal data:
- when you visit our website and confirm the regulatory entry notice;
- when you communicate with us via the contact form, e-mail or telephone;
- when you subscribe to reports and informational communications;
- when we assess whether a person may be admitted as an investor;
- when we comply with AML, identification and international sanctions obligations;
- throughout the investment relationship and its settlement;
- when we keep accounts and comply with tax and other statutory duties;
- when we protect our rights and legitimate interests.
Data controller
The controller is Strategic Hedge Capital osoba rizikového kapitálu s. r. o., ID No. 233 29 611, registered office at Příčná 1892/4, Nové Město, 110 00 Prague 1, registered in the Commercial Register kept by the Municipal Court in Prague, Section C, Insert 425347 (the „Company“, the „Controller“ or „we“).
The Company manages assets in a manner comparable to management under Section 15 of the ZISIF and is entered in the list kept by the Czech National Bank.
We have not appointed a data protection officer because we are not required to do so by law. For all data protection matters contact us at info@wayupcapital.cz or at our registered office.
Whose data we process
We process personal data in particular of:
- website visitors who confirm the regulatory entry notice;
- prospective investors who contact us or request materials;
- subscribers to reports and informational communications;
- investors and persons acting for corporate investors;
- beneficial owners of investors and persons screened for AML purposes;
- business partners, advisers and their contact persons.
Purposes, legal bases and retention periods
For each purpose we state the data processed, the legal basis under Article 6 GDPR and how long we keep the data.
3.1Records of the regulatory entry notice confirmation
- Data: date and time of confirmation, IP address, language, page visited, device type and browser, random visitor identifier, version of the notice.
- Purpose: demonstrating that investment content was made available only to a person who declared to be a qualified investor within the meaning of Section 15(4)(b) of the ZISIF.
- Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR) and legitimate interest in demonstrability (Art. 6(1)(f) GDPR).
- Retention: 3 years from confirmation.
3.2Contact form, e-mail and telephone communication
- Data: name and surname, e-mail, phone (optional), message content, language, handling status and internal note.
- Purpose: handling your enquiry, sending requested materials and follow-up communication.
- Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR), alternatively legitimate interest.
- Retention: 1 year after the enquiry is handled. If an investment relationship follows, the communication becomes part of its documentation.
3.3Subscription to reports and informational communications
- Data: e-mail, name, language and a record of consent given and withdrawn.
- Purpose: regular delivery of reports and information about our activities.
- Legal basis: consent (Art. 6(1)(a) GDPR), which may be withdrawn at any time free of charge.
- Retention: for the duration of the consent, then 3 years of records of its granting and withdrawal to evidence lawfulness of processing.
3.4Single contact database
- Data: e-mail, name, phone (if provided), language, an “investor contact” flag (a submitted contact or investor form) and a “newsletter subscriber” flag (Insights subscription), date of first and last contact, number of messages, record of unsubscribing and an internal note.
- Purpose: keeping one clear contact record so that we do not send duplicate communications, can distinguish prospective investors from newsletter readers, and can evidence the origin and scope of every contact. One person may be recorded in both categories at the same time.
- Legal basis: pre-contractual steps and legitimate interest in proper records of business contacts (Art. 6(1)(b) and (f) GDPR) for investor contacts; consent (Art. 6(1)(a) GDPR) for the newsletter.
- Retention: for the newsletter, for the duration of the consent and then 3 years to evidence its granting and withdrawal; for investor contacts, 3 years from the last communication unless an investment relationship follows. A record can be erased at any time upon request.
- Access: only members of the Controller's team through a password-protected internal area; every access, change and export is written to an audit log. The database is not accessible from the public part of the website.
3.5Assessment of a prospective investor
- Data: identification and contact data, information on financial situation, experience and investment intention, documents evidencing qualified investor status.
- Purpose: verifying whether an investment may be accepted and meeting the conditions set out in the ZISIF.
- Legal basis: compliance with a legal obligation and pre-contractual steps.
- Retention: 10 years where part of AML documentation; otherwise 3 years from the assessment if no investment is made.
3.6Client identification and screening under the AML Act
- Data: identity document data, beneficial owner data, source of funds, politically exposed person status and sanctions screening results.
- Purpose: compliance with Act No. 253/2008 Coll., on selected measures against the legitimisation of proceeds of crime and financing of terrorism, and with sanctions legislation.
- Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR).
- Retention: 10 years from the transaction or from the end of the client relationship (Section 16 of the AML Act).
3.7Administration of the investment and performance of the contract
- Data: contractual documentation, bank details, data on contributions, withdrawals, returns and reporting.
- Purpose: performance of the contract with the investor and related communication.
- Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
- Retention: for the duration of the relationship and then 10 years after its end, with regard to limitation periods and archiving duties.
3.8Accounting, tax and archiving
- Data: billing and payment data, accounting documents.
- Purpose: bookkeeping and compliance with tax obligations.
- Legal basis: compliance with a legal obligation.
- Retention: accounting records 5 years, tax documents 10 years under the VAT Act.
3.9Protection of legal claims and security
- Data: communication records, operational and security logs of the website and internal records.
- Purpose: establishment, exercise or defence of legal claims and security of the website.
- Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
- Retention: operational logs 12 months, other data for the limitation period of the relevant claim.
The periods above are maximum periods. If the purpose ceases earlier, we erase or anonymise the data without undue delay.
Where we obtain personal data
We obtain data primarily directly from you. We may also obtain it from public registers (commercial register, beneficial owners register, insolvency register, sanctions lists) and from persons acting on your behalf.
Recipients of personal data
Only authorised members of our team have access to the data. We may also disclose data to the following categories of recipients, always only to the extent necessary:
- the provider of website hosting and database services (processor);
- the provider of e-mail and office services (processor);
- accounting and tax advisers, the auditor and the law firm;
- banks, the depositary, the administrator and other entities involved in settling the investment;
- public authorities, in particular the Czech National Bank, the Financial Analytical Office, the tax administrator, courts and law enforcement bodies, where required by law.
We do not sell personal data and do not pass it to third parties for their own marketing purposes.
Transfers outside the European Economic Area
We process data in the European Union. Should any technical provider process data outside the European Economic Area, this happens only on the basis of an adequacy decision of the European Commission or standard contractual clauses under Article 46 GDPR. We will provide a copy of the safeguards on request.
Security of personal data
Data is transmitted over an encrypted connection (HTTPS). Access to internal records is password protected and limited to authorised team members; access and changes are logged. We apply data minimisation and regularly delete data whose retention period has lapsed.
Automated decision-making and profiling
No automated decision-making or profiling takes place that would produce legal effects concerning you or similarly significantly affect you.
Is providing data mandatory?
Providing data in the contact form and for report subscription is voluntary; without it, however, we cannot contact you or send you the communications.
Providing data for identification and screening under the AML Act and for the assessment of qualified investor status is a statutory requirement. Without it we may not accept an investment.
Your rights
In connection with the processing of personal data you have the following rights:
- the right of access to your personal data and to a copy of the data processed (Art. 15 GDPR);
- the right to rectification of inaccurate and completion of incomplete data (Art. 16 GDPR);
- the right to erasure, unless another legal ground for further processing applies (Art. 17 GDPR);
- the right to restriction of processing (Art. 18 GDPR);
- the right to data portability for data processed on the basis of consent or a contract (Art. 20 GDPR);
- the right to object to processing based on legitimate interest (Art. 21 GDPR);
- the right to withdraw consent at any time, without affecting the lawfulness of prior processing.
Exercising your rights
You can exercise your rights by e-mail at info@wayupcapital.cz or in writing at our registered office. In order to handle the request we may ask you to verify your identity. We will respond without undue delay, at the latest within one month; in complex cases the period may be extended by a further two months, of which we will inform you.
Changes to this policy
We may update this policy, in particular if legislation or the manner of processing changes. The current wording is always available on this page together with its effective date.