Privacy Policy

Information pursuant to Articles 13 and 14 GDPR.

This privacy policy sets out the processing of personal data by Black Manta Capital Partners S.à r.l. (hereinafter “the Controller”) in connection with the website blackmanta.capital, including its subpages, the forms provided thereon, the newsletter and the onboarding of investors, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”). Terms used herein shall have the meaning given to them in Article 4 GDPR.

Controller

Controller
Black Manta Capital Partners S.à r.l.
17, Boulevard Raiffeisen
L-2411 Luxembourg
Website
blackmanta.capital
Data protection contact
privacy@blackmanta.capital

Requests concerning the processing of personal data and the exercise of data subject rights shall be addressed to the Controller at the above address. Requests are answered without undue delay and in any event within one month of receipt (Art. 12(3) GDPR).

Personal data is processed on the basis of consent (Art. 6(1)(a) GDPR; for the storage of information in, or access to information stored in, the terminal equipment of the end user, in conjunction with Art. 4(3)(e) of the amended Luxembourg Law of 30 May 2005 on the protection of privacy in the electronic communications sector, “Law of 30 May 2005”), the performance of a contract or the taking of steps prior to entering into a contract (Art. 6(1)(b) GDPR), compliance with a legal obligation (Art. 6(1)(c) GDPR) or the legitimate interests of the Controller or a third party (Art. 6(1)(f) GDPR). The legitimate interest pursued is specified for each processing operation below.

Rights of the data subject

Subject to the statutory requirements, the data subject has the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR), and the right not to be subject to a decision based solely on automated processing, including profiling (Art. 22 GDPR). Consent given may be withdrawn at any time with effect for the future; the lawfulness of processing carried out on the basis of consent before its withdrawal remains unaffected (Art. 7(3) GDPR).

Without prejudice to any other administrative or judicial remedy, the data subject has the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The supervisory authority competent for the Controller is:

Authority
Commission nationale pour la protection des données (CNPD)
Address
15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg

Right to object (Art. 21 GDPR)

Where personal data is processed on the basis of Art. 6(1)(f) GDPR, the data subject has the right to object at any time, on grounds relating to his or her particular situation, to such processing. The Controller shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defence of legal claims (Art. 21(1) GDPR).

Where personal data is processed for direct marketing purposes, the data subject has the right to object at any time to such processing; the personal data shall then no longer be processed for such purposes (Art. 21(2) and (3) GDPR). The objection may be addressed informally to the Controller.

Provision of the website

Hosting and server log files

The website is hosted on the Webbase platform on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (“Hetzner”), in a data centre in Germany, acting as processor pursuant to Art. 28 GDPR.

Upon each access to the website, the following data is collected and stored in server log files: browser type and version, operating system, referrer URL, pages accessed, date and time of access, IP address, internet service provider of the accessing system and comparable data serving the defence against attacks on the Controller’s information technology systems. The processing serves the delivery of the website, the optimisation of its content, the permanent functionality and security of the information technology systems and, in the event of a cyber-attack, the provision of information required for criminal prosecution. Legal basis: Art. 6(1)(f) GDPR; the legitimate interest lies in the aforementioned purposes. No conclusions are drawn regarding the individual data subject. The log files are erased after seven years, unless further retention is required for evidentiary purposes.

In the course of hosting, the hosting provider may access personal data stored, including names, addresses, email addresses, IP addresses and telephone numbers. Further information: hetzner.com/legal/privacy-policy.

Fonts

The typeface used on the website (Roboto) is stored on the server of the website and delivered from there. No connection to servers of third parties, in particular Google, is established for this purpose, and no personal data is transmitted to third parties.

The storage of information in, or access to information stored in, the terminal equipment of the end user is effected only with consent (Art. 4(3)(e) Law of 30 May 2005), save where it is strictly necessary to provide a service explicitly requested by the user (exception in the same provision).

  • Strictly necessary: upon confirmation of the investor notice on the offering pages, the session cookie “bmcp_offer_terms” (value “1”) is set. It releases the offering pages for the rest of the browser session and prevents the notice from being displayed repeatedly. The cookie contains no personal data, is not used for any other purpose and is erased when the browser is closed. Legal basis: Art. 4(3)(e) Law of 30 May 2005 (strictly necessary); Art. 6(1)(f) GDPR (legitimate interest: display of the legally required notice once per session).
  • Subject to consent: Google Analytics, YouTube and the social media components set out below store or access information in the terminal equipment and are activated only upon consent given via the consent banner. Consent may be amended or withdrawn at any time via the cookie settings.

The data subject may prevent or delete the setting of cookies at any time by means of the browser settings; in this case, individual functions of the website may not be available.

Enquiries, applications and customer relationship management

Contact and enquiry forms, email

Where the data subject contacts the Controller by email, via the contact form or via the project enquiry form, the data provided is processed for the purpose of handling the request and any follow-up questions. This comprises, in the case of the contact form, name, email address, company and message and, in the case of the enquiry form, additionally the topic, industry, project details, address, regions, intended volume or listing details and website provided.

Legal basis: Art. 6(1)(b) GDPR, where the request relates to the performance of a contract or the taking of steps prior to entering into a contract; otherwise Art. 6(1)(f) GDPR (legitimate interest: processing of requests addressed to the Controller). The data is erased once the request has been conclusively dealt with, unless statutory retention obligations apply. Submissions are stored in the Controller’s own customer relationship management system (see below); the Controller’s staff responsible for the request are notified by email.

Applications

Personal data submitted in the context of an application (in particular curriculum vitae, certificates and contact details) is processed for the purpose of deciding on the establishment of an employment relationship. Legal basis: Art. 6(1)(b) GDPR. In the event of rejection, the application documents are erased six months after notification of the decision, unless the applicant has consented to a longer retention period for the purpose of future vacancies (Art. 6(1)(a) GDPR).

Customer relationship management and email delivery

Submissions of the contact, enquiry and newsletter forms, and contact data received from customers, prospective customers and interested parties (including business communication histories), are stored in the Controller’s own customer relationship management system and used for the purpose of answering requests and initiating and conducting business relationships. Processed data includes contact details, the content of the submission, consents given with their wording and time, newsletter status and the emails sent in connection with a request. Access is restricted to authorised staff of the Controller.

The system runs on a database operated by Webbase on servers of Hetzner Online GmbH in Germany.

Emails sent by the website (notifications to the Controller’s staff, confirmations to the sender, newsletter confirmation) are delivered through Resend (Plus Five Five, Inc., USA) as processor pursuant to Art. 28 GDPR; the emails are processed in the European Union (Ireland). Resend processes the recipient address, the content of the email and delivery data. Further information: resend.com/legal/privacy-policy.

Legal basis: Art. 6(1)(b) GDPR for the initiation and performance of contracts; otherwise Art. 6(1)(f) GDPR (legitimate interest: efficient handling of requests and management of business contacts) or, where obtained, consent pursuant to Art. 6(1)(a) GDPR. Data is erased in accordance with the storage periods below; the data subject may request erasure at any time.

Newsletter

Newsletters and other electronic communications containing promotional information (“newsletter”) are sent exclusively with the consent of the recipient (Art. 6(1)(a) GDPR). The email address is mandatory; first name, last name and country are collected for the purpose of personalisation.

Double opt-in and logging. Registration is effected by way of the double opt-in procedure. Registration and confirmation, including the time and IP address, are logged in order to evidence consent (Art. 6(1)(c) and (f) GDPR, Art. 7(1) GDPR).

Dispatch. The confirmation email of the double opt-in procedure is sent through Resend (see above); subscribers are stored in the Controller’s customer relationship management system.

Withdrawal. Consent may be withdrawn at any time by means of the link contained in each newsletter or by notification to the Controller. Following withdrawal, the email address may be retained in a blocklist and the consent log retained for as long as required to evidence the consent previously given.

Investor onboarding and identity verification

Registration, client classification, identity verification and investments take place on the investment platform of BMCP GmbH, Munich (invest.blackmanta.capital). BMCP GmbH is the controller for that processing; it is described in the privacy policy of the investment platform, which investors accept when they register.

Recipients and third-country transfers

Personal data is disclosed to third parties only where the data subject has consented (Art. 6(1)(a) GDPR), where disclosure is necessary for the performance of a contract (Art. 6(1)(b) GDPR), where the Controller is under a legal obligation to do so (Art. 6(1)(c) GDPR), in particular vis-à-vis supervisory and law enforcement authorities, or where the recipient acts as processor pursuant to Art. 28 GDPR and exclusively on the instructions of the Controller. Categories of recipients:

Hosting, customer database
Webbase, on servers of Hetzner Online GmbH, Germany
Email delivery
Plus Five Five, Inc. (Resend), USA; processing in Ireland
Analytics, video
Google Ireland Limited, Ireland
Social media
LinkedIn Ireland Unlimited Company; Meta Platforms Ireland Limited; Twitter International Unlimited Company

Where recipients or their group companies process personal data in third countries, in particular the United States and the United Kingdom, a transfer takes place only on the basis of an adequacy decision of the European Commission (Art. 45 GDPR; for the United States, the EU–US Data Privacy Framework in respect of certified recipients) or subject to appropriate safeguards, in particular standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR). A copy of the safeguards may be obtained from the Controller.

Storage period

Personal data is erased or its processing restricted as soon as the purpose of storage ceases to apply, consent is withdrawn or an objection is upheld, unless statutory retention obligations preclude erasure. In particular, the following periods apply:

  • commercial correspondence and accounting records: ten years (Art. 16 Luxembourg Commercial Code);
  • newsletter: until withdrawal of consent; evidence of consent for the duration of the limitation period of potential claims;
  • applications: six months following notification of the decision, unless consent to longer retention has been given;
  • enquiries not resulting in a business relationship: until conclusive handling, subject to statutory retention obligations.

Obligation to provide personal data; automated decision-making

The provision of personal data is in part required by law (e.g. tax and anti-money laundering regulations) or may result from contractual provisions (e.g. information on the contracting party). The conclusion of a contract may require the data subject to provide personal data which is subsequently processed by the Controller; investors are obliged to complete the identification procedure. Failure to provide such data precludes the conclusion of the contract. In all other respects, the provision of personal data via the website is voluntary; failure to provide it precludes the processing of the respective request or the dispatch of the newsletter. Prior to providing personal data, the data subject may contact the Controller in order to clarify whether the provision is required by law or contract and the possible consequences of failure to provide it.

Automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

Security of processing

The Controller implements appropriate technical and organisational measures pursuant to Art. 32 GDPR, including the transport encryption (TLS) of this website. Internet-based data transmission may be subject to security vulnerabilities; absolute protection cannot be guaranteed. The data subject is at liberty to transmit personal data to the Controller by alternative means, e.g. by post.

The website contains links to websites of third parties. The Controller is not responsible for the content or data protection practices of such websites; their respective terms of use and privacy policies apply. This privacy policy applies exclusively to personal data collected by the Controller. The Controller requests notification of any misuse or inappropriate content on linked websites in order to take action without undue delay.

Amendments

The Controller reserves the right to amend this privacy policy in order to reflect changes to the website, its services or the legal framework. The version published on this page applies.

Status: October 2026.