Privacy policy

01Controller

The controller responsible for data processing on this website is:

No data protection officer has been appointed, as the legal requirements for doing so are not met. For any questions about data protection, please contact us at the address above.

02Visiting the website and server log files

When you visit this website, our hosting provider automatically processes data transmitted by your browser: IP address, date and time of access, page requested, referrer URL, browser type and version, and operating system.

• Purpose: technical provision of the website, stability and security, in particular defending against attacks.
• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and error-free operation of the website.
• Retention: usually a few days, at most 30 days; the data is then deleted or anonymised.

This data is not combined with other data sources or analysed for advertising or profiling purposes.

03Hosting

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, and delivered via a global network of data centres; requests from Europe are usually served from European locations. A data processing agreement pursuant to Art. 28 GDPR is in place with Vercel.

Where personal data is transferred to the USA, the transfer is based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), under which Vercel is certified, and additionally on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

04Cookies and local storage

This website does not set any cookies and does not store any information on your device. Consent is therefore not required, and no cookie banner is shown.

05Contacting us

If you contact us by email or phone, we process the data you provide (such as your name, contact details, company and the content of your enquiry) in order to handle your request.

• Legal basis: Art. 6(1)(b) GDPR where your enquiry relates to entering into or performing a contract; otherwise Art. 6(1)(f) GDPR, based on our legitimate interest in responding to enquiries.
• Retention: until your enquiry has been fully dealt with; beyond that only where statutory retention obligations apply (for example up to seven years for business correspondence under Estonian accounting law) or where the data is needed to establish, exercise or defend legal claims.

If your enquiry concerns a portfolio company, we will only forward it to that company with your consent.

06Business partners

In the context of existing or prospective business relationships, we process contact and contract data of our business partners’ representatives for contract performance, invoicing and communication (Art. 6(1)(b), (c) and (f) GDPR). The data is deleted once it is no longer required for these purposes and no statutory retention obligations apply.

07Recipients

We only share personal data where this is necessary for the purposes stated: with our hosting provider and our email provider as processors, with tax advisers and auditors who are bound by professional secrecy, and with authorities where we are legally obliged to do so. Data is never shared for advertising purposes.

08Your rights

Under the GDPR you have the following rights:

• Access to the data stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): Where we process data on the basis of Art. 6(1)(f) GDPR, you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds.

To exercise your rights, an informal message to l_lehner_btc@icloud.com is sufficient.

09Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR). The authority responsible for us is:

In Austria, the competent authority is the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna (www.dsb.gv.at).

10Data security

This website is delivered exclusively via encrypted HTTPS (TLS). We take appropriate technical and organisational measures to protect your data against loss, manipulation and unauthorised access.

11Automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

12Changes

We will update this privacy policy whenever the website or the legal framework changes. The version published here applies.