Privacy Policy

The controller within the meaning of the EU General Data Protection Regulation (GDPR) and other national data protection laws is:

SML Investment Management GmbH  |  Kurfürstendamm 214  |  10719 Berlin | Germany

Managing Director: Sebastian Mogos-Lindemann

Phone: +49 (0) 179 79 222 94

Email: sebastian@smlinvest.de

If you have any questions regarding this Privacy Policy or the processing of your personal data, you can contact us using the details above.

This Privacy Policy explains how we process personal data when you visit our website www.smlinvest.de (the “Website”), contact us, or otherwise interact with us as a business contact, client, investor or service provider.

It applies in particular to:

- visitors to our Website,

- existing and potential clients, investors and business partners,

- contact persons at our clients, investors, service providers and other counterparties.

When you access our Website, your browser automatically transmits certain data to our web server. This information is temporarily stored in log files. The following data may be collected:

- IP address of the requesting device

- date and time of access

- URL and file requested

- referrer URL (the previously visited page)

- browser type and version

- operating system and interface

- name of the access provider

We process this data to ensure the technical delivery of the Website, to maintain IT security and to analyse any malfunctions.

Legal basis: Article 6(1)(f) GDPR (legitimate interest). Our legitimate interest is to provide a secure and stable Website.

Log files are generally deleted after 30 days, unless a longer retention is necessary in individual cases (for example to clarify security incidents).

If you contact us by email, phone or mail, we process the personal data you provide, for example:

- name and contact details (email address, phone number, address)

- your role and organisation

- content of your enquiry and any related information

- date and time of the communication

We use this data to process your enquiry, respond to you and – where applicable – to enter into or perform a contract or mandate.

Legal bases:

- Article 6(1)(b) GDPR (performance of a contract or pre-contractual measures), where the communication relates to an existing or potential mandate or contract;

- Article 6(1)(f) GDPR (legitimate interest) in all other cases; our legitimate interest is to handle business enquiries and maintain business relationships.

We store this data as long as it is necessary for the communication and any contractual relationship, and in addition where required by statutory retention obligations (for example under commercial or tax law).

In the context of mandates, advisory projects, investment management or similar engagements, we may process personal data of clients, investors, transaction counterparties and their contact persons, such as:

- identification and contact information,

- professional details (role, organisation, responsibilities),

- mandate-related information and documentation,

- communication content and meeting notes.

We process this data to plan, structure and deliver our advisory services, manage our client relationships and comply with legal obligations (for example documentation and record-keeping duties).

Legal bases:

- Article 6(1)(b) GDPR (performance of a contract or pre-contractual measures),

- Article 6(1)(c) GDPR (compliance with legal obligations),

- Article 6(1)(f) GDPR (legitimate interests), such as the efficient management of mandates and risk management.

At present, our Website is operated without any tracking or marketing cookies. Only technically necessary processes are used to deliver the Website.

If, in future, we use cookies or similar technologies that are not strictly necessary, we will inform you separately and, where required, obtain your consent via a cookie banner or preference centre.

Our Website is hosted and technically provided using services of Google (Google Sites) and other IT service providers. These providers may process personal data (such as IP addresses and log file data) on our behalf as so-called “processors” within the meaning of Article 28 GDPR.

We select our service providers carefully and conclude contracts with them that meet the requirements of Article 28 GDPR.

Depending on the services used (for example certain hosting or collaboration tools), your personal data may be transferred to recipients in countries outside the European Union (EU) or the European Economic Area (EEA), in particular the United States.

In such cases, we ensure an adequate level of data protection, for example by:

- relying on adequacy decisions of the European Commission, and/or

- using standard contractual clauses (SCCs) approved by the European Commission, and taking additional security measures where appropriate.

You may request further information and copies of the relevant safeguards using the contact details above.

We only disclose your personal data to third parties where this is necessary and lawful, in particular to:

- IT and hosting service providers,

- professional advisers (for example lawyers, tax advisers, auditors),

- banks and payment service providers,

- public authorities and institutions, where legally required,

- other parties involved in a transaction or mandate (for example counterparties, investors, co-advisers), where necessary for the performance of our services.

In all such cases, we ensure that an appropriate legal basis and adequate safeguards are in place.

We process and store personal data only for as long as the processing purpose requires it or as long as we are subject to statutory retention obligations.

Criteria for determining the retention period include:

- the duration of our contractual or business relationship with you,

- statutory retention requirements (for example commercial and tax law),

- limitation periods for legal claims,

- the necessity to retain data for evidence purposes in case of disputes.

Once the data is no longer required and no legal retention obligations apply, it is deleted or anonymised.

As a data subject, you have the following rights with regard to your personal data:

- Right of access (Article 15 GDPR) – to obtain information about whether we process your personal data and, if so, which data.

- Right to rectification (Article 16 GDPR) – to correct inaccurate or incomplete personal data.

- Right to erasure (Article 17 GDPR) – to request deletion of your personal data, subject to legal retention obligations.

- Right to restriction of processing (Article 18 GDPR).

- Right to data portability (Article 20 GDPR) – to receive personal data you have provided to us in a structured, commonly used and machine-readable format, and to transmit it to another controller where technically feasible.

- Right to object (Article 21 GDPR) – to object at any time, on grounds relating to your particular situation, to processing based on Article 6(1)(e) or 6(1)(f) GDPR; we will then no longer process your data unless we demonstrate compelling legitimate grounds.

- Right to withdraw consent (Article 7(3) GDPR) – where processing is based on your consent, you may withdraw this consent at any time with effect for the future.

To exercise your rights, please contact us using the contact details set out in Section 1.

You also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The supervisory authority responsible for us is in particular:

Berliner Beauftragte für Datenschutz und Informationsfreiheit

(Berlin Commissioner for Data Protection and Freedom of Information)

You are not legally obliged to provide personal data when visiting our Website. However, the provision of certain data (such as IP address) is technically necessary to display the Website.

If you wish to enter into or perform a contract with us (for example a mandate or advisory engagement), we generally need sufficient personal data to prepare, perform and manage that contract. Without such data, we may not be able to enter into or fulfil the engagement.

We take appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures are continuously adapted to the current state of the art and the risk profile of the processing activities.

We may amend this Privacy Policy from time to time to reflect changes in our data processing or in the legal framework. The version published on this Website shall apply.