PRIVACY POLICY

This Privacy Policy describes how Ortvest ("Company", "we", "us") collects, uses, stores, and protects personal data of users ("you") who visit or interact with ortvest.com ("Website").

We process personal data in accordance with:

• Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR)
• Polish Act of 10 May 2018 on the Protection of Personal Data
• Polish Telecommunications Law

The controller of your personal data is:

Ortvest sp. z o.o.
ul. Szamarzewskiego 21/2, Poznań, Poland
NIP: 7812111756 | KRS: 0001244461
Website: ortvest.com
Contact email: contact@ortvest.com

For all matters related to personal data protection, you may contact us at the email address above.

When you submit a form on our Website, we collect the following data:

3.1 Contact form

Contact form:

• Name – your first and/or last name
• Email address – used to reply to your inquiry
• Project type (optional) – one or more of the following categories you select: P2P, Community & clubs, Logistics, Other
• Budget (optional) – selected budget range: €10–25k, €25–50k, €50–100k, €100k+, or Not sure yet
• Consultation type – type of session requested: Discovery Call (Free) or Cold Start Audit (€199)
• Message (optional) – a free-text description of your project and timeline

3.2 Review form

• Name – your first and/or last name
• Role – your job title or position
• Company – the name of your organisation
• Rating – a numeric or star rating of your experience
• Review text – a free-text description of your experience working with us

3.3 Partnership application form

• Name – your first and/or last name
• Email address – used to respond to your application
• Product description – a free-text description of what you are building, including the participants on each side of your platform
• Market access – a free-text description of which side of your platform you can currently reach and approximately how many participants
• Development stage – idea, prototype, live with users, or generating revenue
• Funding status – bootstrapped, pre-seed raised, seed raised, or Series A or beyond
• Preferred engagement model – embedded team, build plus equity, technical co-founder function, or not sure
• Previous attempts – a free-text description of what you have already tried and why it did not work

Free-text fields in this form may contain information about your business, your team, or third parties. Please do not include personal data of other individuals unless you have a lawful basis to share it with us, and do not include commercially sensitive information unless a non-disclosure agreement is in place (see our Terms of Use).

3.4 Data collected automatically

• IP address
• Browser type and version
• Pages visited and time of visit
• Referral source (how you found the Website)

This data is collected via analytics tools (e.g., Google Analytics) to improve Website performance and user experience.

We do NOT collect sensitive personal data (health, political views, religious beliefs, financial details, etc.).

We process your data for the following purposes:

4.1 Responding to inquiries (contact form)

Legal basis: Art. 6(1)(b) GDPR – processing is necessary for taking steps at the request of the data subject prior to entering into a contract.

4.2 Direct marketing of our services (B2B)

Legal basis: Art. 6(1)(f) GDPR – legitimate interest of the Company (marketing own services to business clients).

4.3 Analytics and Website improvement

Legal basis: Art. 6(1)(f) GDPR – legitimate interest in understanding how the Website is used and improving user experience.

4.4 Legal obligations

Legal basis: Art. 6(1)(c) GDPR – compliance with applicable legal obligations (e.g., accounting, tax records).

4.5 Publishing and displaying client reviews

We process review form data to publish client testimonials on our Website, subject to moderation.

Legal basis: Art. 6(1)(a) GDPR – consent. By submitting the review form, you voluntarily provide data intended for public display. You may withdraw consent at any time by contacting contact@ortvest.com, and we will remove your review.

4.6 Evaluating partnership applications

We process partnership application data to assess whether a proposed engagement is a suitable fit, to respond to your application, and to prepare for potential contractual negotiations.

Legal basis: Art. 6(1)(b) GDPR – processing is necessary for taking steps at your request prior to entering into a contract.

Partnership application data is reviewed internally and is not published, shared with other applicants, or used for any purpose other than evaluating and responding to your application.

Our Website uses cookies and similar technologies. Cookies are small text files stored on your device.

We use:

• Necessary cookies – required for the proper functioning of the Website
• Analytics cookies – e.g., Google Analytics (to analyse traffic and usage patterns)
• Marketing cookies – only if you have given explicit consent

You can manage cookie preferences through your browser settings or via our cookie consent banner. Refusing analytics or marketing cookies will not affect access to the Website.

We do not sell your personal data. We may share data with trusted third parties only to the extent necessary:

• IT service providers and hosting companies (data processors under GDPR)
• Email and CRM platforms (e.g., for managing inquiries)
• Analytics providers (e.g., Google Analytics)
• Legal, tax, or financial advisors, where required

All third-party processors are bound by data processing agreements in compliance with GDPR Art. 28.

Due to the international nature of our business, personal data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States and Ukraine. We ensure that all such transfers are carried out with appropriate safeguards as required by Chapter V of GDPR:

7.1 Transfers to the United States

Transfers to the US may occur via service providers (e.g., Google, cloud platforms). These transfers are carried out under Standard Contractual Clauses (SCCs) approved by the European Commission (Commission Decision 2021/914), and where applicable, supplementary technical and organisational measures to ensure an equivalent level of data protection.

7.2 Transfers to Ukraine

Ukraine is not listed among countries recognised by the European Commission as providing an adequate level of data protection. Where personal data is transferred to Ukraine (e.g., for development or operational purposes), we rely on Standard Contractual Clauses (Art. 46(2)(c) GDPR) and implement additional safeguards including data minimisation, encryption in transit and at rest, and access controls. Where required, we will seek your explicit consent for such transfers (Art. 49(1)(a) GDPR).

You may request a copy of the safeguards applied to international transfers by contacting us at contact@ortvest.com.

We retain your personal data for as long as necessary:

• Inquiry data: up to 3 years from the last contact, or until you request deletion
• Partnership application data: up to 12 months from submission where no engagement follows, or until you request deletion. Where an engagement begins, the data is retained under the client data period below.
• Client data (if a contract is concluded): 5 years from the end of the business relationship (tax and accounting requirements)
• Analytics data: as per the settings of the analytics provider (typically up to 26 months)
• Review data: retained for as long as the review is published on the Website, or until you request deletion by contacting contact@ortvest.com

Under GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR) – obtain a copy of your data
• Right to rectification (Art. 16 GDPR) – correct inaccurate data
• Right to erasure / "right to be forgotten" (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR) – including direct marketing
• Right to withdraw consent at any time (where processing is based on consent)

To exercise any of these rights, contact us at: contact@ortvest.com
We will respond within 30 days as required by GDPR Art. 12.

If you believe we are processing your data unlawfully, you have the right to lodge a complaint with the Polish supervisory authority:

Urząd Ochrony Danych Osobowych (UODO)
ul. Stawki 2, 00-193 Warsaw, Poland
Website: uodo.gov.pl
Phone: +48 22 531 03 00

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, disclosure, or destruction. These include:

• Encrypted data transmission (SSL/TLS)
• Access controls and authentication
• Regular security reviews

Our Website may contain links to external websites. We are not responsible for the privacy practices of third-party websites and encourage you to review their privacy policies separately.

We reserve the right to update this Privacy Policy at any time. The current version will always be available on this page with the "Last updated" date. Continued use of the Website after changes constitutes acceptance of the updated Policy.

For any questions about this Privacy Policy or personal data processing, please contact us:
Email: contact@ortvest.com
Website: ortvest.com