Privacy Policy

1. Privacy at a Glance

General Information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data with which you can be personally identified. Detailed information on the subject of data protection can be found in our privacy policy below this text.

Data Collection on this Website

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. You can find their contact details in the section "Information on the Responsible Party" in this privacy policy.

How do we collect your data?

On the one hand, your data is collected by you providing it to us. This can be, for example, data that you enter in a contact form.

Other data is collected automatically or after your consent when you visit the website by our IT systems. This is mainly technical data (e.g. internet browser, operating system or time of page access). This data is collected automatically as soon as you enter this website.

What do we use your data for?

Some of the data is collected to ensure error-free provision of the website. Other data may be used to analyze your user behavior.

What rights do you have regarding your data?

You have the right to receive information free of charge at any time about the origin, recipient and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. If you have given your consent to data processing, you can revoke this consent at any time for the future. You also have the right to request the restriction of the processing of your personal data under certain circumstances. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.

2. Responsible Party

The responsible party for data processing on this website is:

Lightweb Media GmbH

An d. Flutrinne 12

01139 Dresden

Germany

Email: info@venture-diligence.com

The responsible party is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data (e.g. names, email addresses, etc.).

3. Data Collection on this Website

Contact and Demo Requests

If you contact us via contact form, email or demo request, we process your information including the contact details you provide to handle the request and follow-up questions. We do not pass on this data without your consent.

The processing of this data is based on Art. 6 para. 1 lit. b GDPR, if your request is related to the fulfillment of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of inquiries addressed to us (Art. 6 para. 1 lit. f GDPR) or on your consent (Art. 6 para. 1 lit. a GDPR), if this has been requested.

Server Log Files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

• Browser type and browser version
• Operating system used
• Referrer URL
• Hostname of the accessing computer
• Time of server request
• IP address

This data is not merged with other data sources. The collection of this data is based on Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimization of his website - for this purpose, the server log files must be collected.

4. Processing of Pitch Decks and Dealflow Data

Confidential Analysis Materials

VCs process highly confidential data in diligence workflows, including founder and team profiles, cap tables, customer lists, technical IP and investment memos. If you provide pitch decks, memos, company information or other dealflow data for analysis, we process this content solely to create and provide the commissioned investment memo.

User identity is separated from document content before analysis where possible. Processing is based on Art. 6 para. 1 lit. b GDPR where it is necessary to perform pre-contractual measures or a contract. Where special confidentiality requirements apply, we treat the provided materials confidentially within the agreed service.

Data Minimization and Public Research

Content is enriched only with publicly available sources, for example through targeted pull queries on known entities, commercial register information, press reports, markets or companies. Uploaded document content is not actively shared with third parties; confidential pitch deck content is not sent outward as unfiltered search input.

AI Processing

During the beta phase, Venture Diligence uses the OpenAI API for memo generation. This means content passes through OpenAI servers for this processing step. OpenAI contractually commits not to use API data to train its own models. This setup is temporary: after the beta phase and initial traction, the model is intended to be hosted locally on German infrastructure (Hetzner/IONOS). If required, the platform can also be integrated into your infrastructure, customized and hosted there; in this inhouse setup, data remains fully within your environment.

5. Hosting and Technical Safeguards

German Hosting

The Venture Diligence platform is operated on German servers at Hetzner. A data processing agreement (DPA) under Art. 28 GDPR is in place with Hetzner. The operator Lightweb Media GmbH, a subsidiary of DRIVE Ventures GmbH, is currently in the ISO 27001 certification process to formally establish and audit consistent standards for information security, access controls and data protection.

Data Isolation, Access and Deletion

Uploaded documents and analysis results run in an isolated Trusted Zone assigned exclusively to the respective customer. Lightweb Media GmbH employees have no insight into encrypted customer data. Data is not used for internal purposes or AI training. All data is automatically and irrevocably deleted when the account is closed; until then it remains accessible to the customer.

6. Analysis Tools and Advertising

Matomo

This website uses the open-source web analytics tool Matomo. Matomo uses technologies that enable cross-site recognition of the user to analyze user behavior (e.g. cookies or device fingerprinting). The information collected by Matomo about your use of this website is stored on our server. The IP address is anonymized before storage.

The use of this analysis tool is based on Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the anonymized analysis of user behavior in order to optimize both the website offering and advertising. If corresponding consent has been requested (e.g. consent to the storage of cookies), processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR; consent can be revoked at any time.

7. Your Rights

You have the following rights:

• Right to information according to Art. 15 GDPR
• Right to rectification according to Art. 16 GDPR
• Right to erasure according to Art. 17 GDPR
• Right to restriction of processing according to Art. 18 GDPR
• Right to data portability according to Art. 20 GDPR
• Right to object according to Art. 21 GDPR

If you have questions about data collection and processing, you can contact us at any time.

8. Storage Duration

Unless a more specific storage period has been specified within this privacy policy, your personal data will remain with us until the purpose for data processing no longer applies. Uploaded documents and analysis results remain accessible to the customer while the respective account exists and are automatically and irrevocably deleted when the account is closed, unless statutory retention obligations or legitimate evidence purposes prevent deletion. If you assert a legitimate request for deletion or revoke consent for data processing, your data will be deleted unless we have other legally permissible reasons for storage.