Privacy Policy

1. Data controller

Växthuset Invest is operated by Sapling Invest AB, which is the data controller for the processing of your personal data and determines the purposes and means of that processing.

Sapling Invest AB
Company reg. no. 559588-2316
Box 44026, 100 73 Stockholm, Sweden
Email: hej@vaxthusetinvest.se

The website and its technical infrastructure are provided by Applikatur AB, which processes personal data on our behalf as a data processor under a data processing agreement.

If you have questions about how we process your personal data, contact us at hej@vaxthusetinvest.se.

2. Personal data we process

When you complete the capital application or contact us, we process the data you provide. Depending on what you fill in, this may include:

• Contact and company details: company name, company registration number, contact person (name), phone number, email address, website and LinkedIn profile.
• Information about the business: business idea, the problem you solve, customers and target group, what makes you unique, sector, stage of development, how long the business has existed and number of employees.
• Financial information: last year's revenue, forecast revenue, amount of capital sought, how the capital will be used, the type of partnership you are looking for and what you offer in return.
• Information about the team and intellectual property: founders and key people, the team's experience, external advisors or board members, and patents, trademarks and other intellectual property rights.
• Attachments you upload, such as a pitch deck, business plan, budget, annual report or product images. These may contain additional personal data.

If your application or attachments include personal data about other people (for example co-founders, employees or advisors), we assume that you have informed them that the data is shared with us and processed in accordance with this policy. We process this data in our capacity as data controller, and the individuals concerned have the same rights under section 8 as you do, regardless of who provided the data to us.

When you visit the website, technical information such as your IP address may be processed by our hosting environment in order to deliver and protect the service. With your consent, we also collect website usage information, including pseudonymous cookie IDs, to produce aggregate visitor statistics. See section 7, Cookies and analytics.

3. Purposes and legal basis

We process your personal data for the following purposes:

• To receive, assess and respond to your capital application and to communicate with you during the process. Legal basis: steps taken at your request prior to entering into a possible agreement, and our legitimate interest in evaluating and following up investment opportunities.
• To respond to messages you send us. Legal basis: our legitimate interest in answering enquiries.
• To comply with legal obligations, such as accounting requirements. Legal basis: legal obligation.
• To understand how the website is used and improve it using aggregate visitor statistics. Legal basis: your consent, which you can withdraw through Cookie settings in the footer.

Providing the data is voluntary, but we need it to assess your application. Without it we cannot process your request.

We do not make decisions based solely on automated processing. Assessments are made by people, and where relevant by our investment committee, which consists of Växthuset Invest's founders and advisors.

4. Who has access to the data

Your data is handled by authorised people at Växthuset Invest. We use the following suppliers for the purposes described below:

• Applikatur AB, which provides and operates the website and the technical infrastructure, as a data processor.
• Amazon Web Services (AWS), as a sub-processor for operation, storage, email delivery and related cloud services.
• Google Ireland Limited (Ireland), which provides Google Analytics 4 (GA4) and processes information about pages visited, interactions, browsers, devices and approximate location (derived from the IP address), and pseudonymous cookie IDs on our behalf as a data processor when you consent to visitor statistics.

Google Ireland Limited engages Google LLC (USA) and other Google group companies as sub-processors, which means the analytics data may be processed outside the EEA, including in the United States. Transfers to the United States rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, under which Google LLC is certified (Article 45 GDPR). For transfers not covered by an applicable adequacy decision, Google applies the European Commission's standard contractual clauses (Article 46 GDPR), in accordance with Google's data protection terms. Read more about international transfers, data protection terms and sub-processors.

We never sell your personal data and do not share it for third-party marketing. Data may be disclosed where required by law, by a decision of an authority, or to establish, exercise or defend legal claims.

5. Where the data is processed

Växthuset Invest and Applikatur process your personal data within the EU/EEA, and the website is operated on AWS in the EU (Stockholm). Visitor statistics data is, however, transferred to Google LLC in the United States and may also be processed in other countries where Google's sub-processors operate. Transfers to the United States rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework; for other transfers the European Commission's standard contractual clauses (Article 46 GDPR) are used. The recipient and links to the terms are in section 4. Contact us if you would like a copy of the applicable safeguards.

6. How long we keep the data

We keep your data for as long as needed to assess your application and communicate with you, and thereafter for as long as required to meet legal obligations or to handle any legal claims. If a collaboration begins, we keep the data relevant to the collaboration (e.g. contact details, contract documents and financial follow-up) for the duration of that collaboration and thereafter for the period required by law, for example the seven-year requirement under the Swedish Bookkeeping Act. Attachments that are no longer relevant to the collaboration, e.g. early pitch materials, are deleted in accordance with the ordinary 90-day limit unless they are actively used in the ongoing collaboration.

Attachments you upload are automatically deleted from our storage after 90 days.

7. Cookies and analytics

When you save your cookie choice, the website uses one necessary cookie to remember it. It does not require consent. If you consent, we also use analytics cookies to collect information about how the website is used and produce aggregate visitor statistics. This information includes pseudonymous cookie IDs. We use no functional cookies and no marketing or advertising trackers. The analytics provider is described in section 4.

Cookie settings in the footer lists the website's cookies, including the necessary cookie, with their purposes and storage times. Analytics cookies are set only after you consent to Visitor statistics.

Data in Google Analytics is stored at Google for up to 2 months at event level and up to 14 months at user level; for user data the period is counted from your most recent visit. It is then deleted automatically. Aggregate statistics that cannot be linked to an individual visitor may be kept longer. The storage times in Cookie settings refer to cookies in your browser and are not the same as the storage times for the data at Google.

You can change or withdraw your consent at any time through Cookie settings in the footer. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.

8. Your rights

Under the GDPR you have the right to:

• request access to the personal data we process about you,
• request that inaccurate or incomplete data be corrected,
• request that your data be erased when it is no longer needed,
• request that processing be restricted,
• object to processing based on our legitimate interest,
• receive the data you have provided in a structured, commonly used and machine-readable format and have it transferred to another party (data portability),
• withdraw any consent you have given, without affecting the lawfulness of processing before the withdrawal.

To exercise your rights, contact us at hej@vaxthusetinvest.se. We will respond to your request without undue delay and within one month at the latest.

9. Complaints to the supervisory authority

If you believe we process your personal data in breach of the GDPR, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), the supervisory authority in Sweden. You can reach IMY at imy@imy.se and www.imy.se.

10. Changes to this policy

We may update this policy. The date of the latest update is stated in this document.

11. Contact

If you have questions about this policy or about how we process your personal data, please contact us at hej@vaxthusetinvest.se.