Privacy Policy

2.2 Prospecting and Business Development

Where we approach potential business clients directly (for example via professional networks such as LinkedIn), we collect and process personal data of potential business contacts (“prospects”). This data is collected from publicly available sources, not directly from the data subject.

Existing business contacts: We keep contact details of persons with whom we are or were in business contact (for example, counterparts from earlier projects and negotiations, partners, and contacts in professional networks) for as long as the business contact continues. The 30-day period stated below applies to first approaches that receive no response.

Sources of data:

• •Company websites and impressum/legal notice pages
• •Public business directories
• •Professional networking platforms (e.g. LinkedIn)
• •Trade and commercial registers

Categories of data processed:

• •Name (first name, last name)
• •Business email address
• •Business phone number
• •Company name and legal form
• •Job title or role/function
• •Company website URL
• •Company address

Purpose: To contact potential business clients about our services (go-to-market and Closing-as-a-Service, consulting on market entry and regulatory orientation, software development, AI consulting, commercial due diligence, Regulatory Intelligence, and the DACH Market Entry Playbook); to manage our business development pipeline; and to maintain records of business communications.

Data source disclosure (Art. 14 GDPR): As required by Article 14(2)(f) GDPR, we inform each prospect in our first communication about the specific source from which their personal data was obtained (e.g. “your company website”, “your LinkedIn profile”).

Retention:

• •If a prospect does not respond to our outreach: data is deleted within 30 days after the last attempted communication (maximum 2 follow-ups).
• •If a prospect responds and declines / requests removal: data is deleted within 14 days of the request (except for the entry on the suppression list, see Right to Object).
• •If a prospect becomes a client: data is retained for the duration of the business relationship and thereafter in accordance with statutory retention obligations (see Section 2.3).

2.3 Client Data

When a business relationship is established, we process additional data as necessary for the performance of the contract, including:

• •Billing and invoicing information
• •Project-related data (briefings, content provided by the client, correspondence)
• •Communication history

2.4 Regulatory Intelligence Service and Customer Portal

Our Regulatory Intelligence service provides subscribers with editorially reviewed regulatory updates in our customer portal, the “Regulatory Intelligence Portal” by Aegiron Capital Group at portal.aegironcapitalgroup.com. For ordering, invoicing, and access, we process:

• •Name and email address of your contact person for the order, the order confirmation, sending the access code, and invoices
• •Company name, address, and VAT ID (businesses outside the EU: company registration or tax number) for invoicing; Section 2.7 applies accordingly to the VAT ID check
• •Subscription data (start, cancellation, end of access) and the details of your access code (customer label, issue, redemption deadline, and redemption); the portal stores the code itself only as a hash
• •Payment data for our monthly invoices (incoming bank transfers; where card payment has been agreed, Revolut handles the payment, Section 3; we do not store card data)

In the customer portal

When you register for and use the customer portal, it processes the following data. The portal does not ask for your name, your address, or payment data.

• •Account: your business email address as login name, the role, the interface language, light or dark reading mode, the status, the time and reason of a suspension, the end of your access (“access until”), timestamps (created, activated, last active), and the reference to the access code you redeemed
• •Login data: password and recovery codes only as a hash, the secret for two-factor authentication only in encrypted form
• •Company profile: activities, licences or status, countries, topics, and the language of the summaries. The portal uses them to select the matching updates. Read status and bookmarks are added to this. We do not analyse this information, and we cannot see it in the administration area
• •Sessions: to keep you signed in, the portal stores for each session a hash of the session token, timestamps, the device type (browser and operating system, e.g. “Firefox · Windows”), and your network. Network means: your IP address shortened to its first three blocks (IPv4) or its first 48 bits (IPv6); of this, the portal stores only a keyed hash, never the IP address itself
• •Login log: time and type of sign-ins and security-relevant events (e.g. successful or failed sign-in, wrong two-factor code, password changed, session ended by another sign-in, account locked), each with device type and network
• •Protection against password guessing: counters of failed attempts per network and per login name entered, both stored only as a hash, plus a counter per account under the internal account number for the lock after 20 failed attempts in 24 hours
• •Administration log: our administrative actions concerning your account and your access code (creating and revoking access codes, suspension with reason and lifting it, ending sessions, issuing a password reset code, resetting two-factor authentication, changing the end of access, deletion)

Access is intended for one person (see our Terms of Service). At most two sessions can be active at the same time; a further sign-in ends the oldest one. From sessions and the login log, the portal shows us indications of shared use, for example more than three different device types (browser and operating system) within seven days, sign-ins from more than two networks within 24 hours, or new sign-ins repeatedly ending running sessions. Such an indication does not lead to an automatic suspension: we review it and decide ourselves. After 20 failed attempts within 24 hours, the portal locks the account automatically for your protection; we lift the lock as soon as we have made sure that the request comes from you.

Public publications and AI service

For the updates, the portal retrieves public publications of authorities and official bodies of the EU, Germany, Austria, and Switzerland every day. We send the title, a text excerpt (at most 30,000 characters), the body, the address, and the date to Google (Gemini, Section 3) to have them classified and summarised. We do not send any data of the portal's users. Email addresses and phone numbers are removed from the texts beforehand. Publications that are directed against named persons or centre on them are excluded by fixed rules for each source that check the title, address, section, or short text; this covers, for example, warnings about unauthorised firms, measures against individuals, and sanctions lists, and for several sources also speeches, interviews, and personnel announcements. Of excluded publications, the portal stores only a hash of the address so that it does not retrieve them again. If no rule catches such a publication, it may go to the AI service; it does not appear in the portal, because we review every update before publication and do not release such updates. The remaining texts may contain names of officials, for example where a press release quotes the head of the authority. Our summaries do not name persons, and we review each one before publication. The legal basis for processing such names is Article 6(1)(f) GDPR: our legitimate interest in evaluating official publications for our subscribers. The names come from public communications of the authorities and concern the persons in their official capacity. Informing them individually would involve a disproportionate effort (Art. 14(5)(b) GDPR); we therefore provide this information here. Text excerpts are deleted 90 days after processing; the title and address of the original publication remain in the portal's archive for as long as we offer the service.

Retention:

• •Account, company profile, read status, and bookmarks: until 30 days after the end of your access; at your request we delete the account immediately. Afterwards only an entry without email address and without customer label remains (timestamps, language, and technical details such as the role and the reference to the access code), so that our administrative actions remain traceable
• •Label of an access code (customer or company): with the deletion of the account; for codes never redeemed or revoked, 12 months after the redemption deadline
• •Registrations in which two-factor authentication was not completed: 24 hours
• •Sessions: end after 12 hours without activity, at the latest after 14 days; login log: 90 days; counters against password guessing: about one day at most; password reset codes: 7 days after they expire
• •Administration log: 365 days
• •Backups of the portal: daily backups for 14 days, plus an encrypted monthly copy kept by us, of which we keep the last three at most. Deleted data may therefore remain in backups for up to about three months. Backups made by our hosting provider (Section 3) are deleted under its routines
• •Order and subscription data outside the portal: the duration of the subscription plus 12 months after it ends; invoicing records at least 6 years (Section 2.3)

In the portal you change your password, two-factor authentication, recovery codes, company profile, language, and reading mode yourself; there you also see your sessions and can end other sessions. You can obtain a copy of your data (Art. 15 and 20 GDPR) or the immediate deletion of your account on request at legal@aegironcapital.com.

2.5 DACH Expansion Network (Partner Referrals)

As part of our DACH Expansion Network, we facilitate introductions between our clients and suitable third-party service providers (including law firms, tax advisers, HR providers, and banks). For this purpose, we share client contact details with these partners.

Categories of data shared with partners:

• •Client name and company name
• •Business email address
• •Specific service requirements relevant to the referral

Important: Client data is shared with third-party partners only after the client has provided explicit consent for each individual referral. Clients may withdraw their consent at any time, after which no further data will be shared with that partner.

2.6 Engagements: Due Diligence, Closing, and Consulting

In the course of our engagements (commercial due diligence, go-to-market and Closing-as-a-Service, consulting, AI consulting, and software development), we process confidential business data. This may include personal data contained in corporate, sales, and compliance documents — including data of persons who are not themselves our contractual partners (e.g. employees or managers of a target company, or contacts at our clients’ target customers). In go-to-market and closing engagements we also research business contact details of contacts at target customers from the sources listed in Section 2.2, approach these persons on behalf of our client, and pass contact details and the status of the conversation on to the client. The right to object described in Section 2.2 applies here as well; we forward any objection to the client. Where a client is established outside the EEA, we transfer this data only on the basis of an adequacy decision of the European Commission (Art. 45 GDPR) or the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR); on request we will tell you the recipient and the safeguard.

• •Confidential business data as required by the engagement; in closing engagements also business contact details of contacts at target customers
• •Documents and data from an engagement are processed exclusively for that engagement; business contacts that arise in the course of it are continued as our own business contacts (Section 2.2), unless the engagement agreement provides otherwise
• •Strict confidentiality obligations apply to all personnel involved
• •Data is stored on encrypted, access-controlled systems

2.7 DACH Market Entry Playbook

When purchasing our DACH Market Entry Playbook (digital product), we process the following personal data:

• •Email address (from your order) for digital delivery of the product and of the updates included in the purchase price (24 months from the purchase date)
• •Company name, address, and VAT ID (businesses outside the EU: company registration or tax number) for invoicing and for licensing the product to your company; you give us these details with your order. We may check the validity of the VAT ID through the European Commission’s VAT Information Exchange System (VIES)
• •Payment data: the incoming payment for our invoice (account holder, amount, date, payment reference)

Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority. The competent authority for Aegiron Capital Group Ltd is:

You may also contact the supervisory authority at your place of residence, your place of work or the place of the alleged infringement, for example:

• •Germany: the data protection authority of the federal state (Land) in which you live or work
• •Austria: Datenschutzbehörde (Österreichische DSB)
• •Switzerland: Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (EDÖB)

For Residents of Switzerland

Where the Swiss Federal Act on Data Protection (FADP) applies to the processing of your data, the information in this Privacy Policy applies accordingly. The supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC), to whom you can report a concern. International data transfers involving Swiss data are safeguarded, where required, by Swiss-adapted Standard Contractual Clauses.