Date last revised: June 1, 2019

PLEASE READ THIS POLICY CAREFULLY BEFORE REGISTERING FOR AN ACCOUNT WITH US

Bourgeois Bohème Fintech UAB, trading as PrivateCrowd (we/us/our) are committed to protecting and respecting your personal data and your privacy. We recognise that your personal data is your property and that you have provided it to us for specific purposes.

Unless otherwise required by law, the Lithuanian Data Protection Authority and other applicable guidance or best practice, or in order to perform our contract with you, we will only process your personal data in the way we tell you or in the way you or applicable legislation requires us to, and we will give it back to you at any time (if possible).

1. THIS POLICY

1.1 This policy, together with the Rules of Use of the PrivateCrowd Crowdfunding Platform and other our contractual documents, explains how any personal data we collect from you, that you provide to us, or that we receive indirectly from third parties (e.g. persons that may represent you, registers, state authorities, etc.) will be processed by us or any processor on our behalf.

1.2 This policy applies to our Agreement of Use of the PrivateCrowd Crowdfunding Platfom with you and other contractual documents used by us. You are therefore advised to read it carefully. Terms used within it shall have the meaning(s) given in the Lithuanian Law on Data Protection (Law) and/or the General Data Protection Regulation (Regulation), as applicable.

1.3 By visiting our website located at https://privatecrowd.banquebobo.com (our Website), or by registering for user account with us, you accept the practices described in this policy.

1.4 Any changes we make to this policy will be posted on this page. You are advised to check back frequently as any changes will be binding on you when you continue to use the Website after the date of the relevant change.

1.5 For more information relating to your rights under this policy, please see section 10.

1.6 If you have any queries relating to this policy, please contact us at PrivateCrowd@BanqueBoBo.com.

2. WHO WE ARE

2.1 We are Bourgeois Bohème Fintech UAB, Mėsiniu g. 5, LT-01133 Vilnius, Lithuania. We operate the Website and we are the data controller for the purposes of the Regulation and the Law.

2.2 Your data will be processed on our behalf by subcontractors that we use for carrying out our activities and provision of services that you requested (for example, performance identity verification and KYC/AML compliance checks, payment services, hosting a website and an information technology system, partner credit institutions for protecting funds or carrying out payment operations, etc.) (Subcontractors). The subcontractors process your data only exclusively in the framework of the latter’s activities. The Subcontractors are not authorised to use your personal data for their own behalf. We contractually impose on Subcontractors to comply with the obligations of security and confidentiality, to implement appropriate technical and organisational measures so that data processing is carried out in a manner that complies with applicable regulations and guarantees the protection of your rights.

2.2.3 Other data controllers that may provide us services related to data processing from time to time. We will operate on the terms of a written agreement with these data controllers relating to your personal data.

2.3 Any payment transactions you make through our Website will be made through our approved third party payment gateway, encrypted through SSL technology. Any of your personal data they hold will be subject to their privacy policy and internal regulations.

3. YOUR MAIN PERSONAL DATA PROCESING CONDITIONS

3.1 By registering for Account and/or otherwise using the Website, you expressly consent to:

3.1.1 provide us and our Subcontractors with the personal data necessary to allow you to use the Website and make Investments through it;

3.1.2 confirm that are aware that the processing of your personal data may be performed by us and/or Subcontractors, and/or those specifically listed third parties, in accordance with this policy; and

3.1.3 confirm that are aware that your personal data may be transferred to those third parties listed in this policy, for the reasons specified.

3.2 You may object to your data processing under 3.1 at any time. However, where the objection prevents us or our Subcontractors from verifying your identity or otherwise monitoring who you are, you will be unable to use your Account and make Investments through our Website OR You may exercise your rights under 10.1 at any time, which includes your objection to our processing of your personal data. However, where this withdrawal prevents us from performing our contract with you, we may not be able to provide our goods and/or services to you.

4. WHAT WE COLLECT

4.1 We may collect all or some of the following categories of data from you:

  • Title;
  • Full name;
  • Date of Birth (or personal number);
  • Nationality;
  • Full address;
  • Email;
  • Phone number;
  • Bank account or card number;
  • Personal document number;
  • Personal document issue and expiration dates;
  • Copy (picture) of personal document;
  • Selfie (i.e. user‘s photo);
  • Data of legal entities (e.g. personal data of company’s representative);
  • Source of income;
  • Any additional personal data required for proving Source of Funds (e.g. job contract, certificate of inheritance, etc.);
  • Results from Politically Exposed Persons (PEP) Screening & Sanction screening;
  • Any additionally required Know Your Customer (KYC) data;
  • Any additional personal data required for assessment of the Projects (e.g. invested amounts, limits, guarantees, sureties etc.);
  • Information for our internet access logs, such as but not limited to internet protocol (IP) addresses, browser types, internet service providers (ISP), referring/exit pages, operating systems used, date/time stamps, and click stream data;
  • If you contact us, we may keep a record of that correspondence.
  • 4.2 In addition to the above, we will also provide you with your Account Details, which includes your username which is either created by, or assigned to, you. The Account Details should be remembered by you, but will be stored by us in case you forget them.

    4.3 Specific categories of processed personal data may also be in separate sections of this privacy policy.

    4.4 All categories of personal data which are collected by us are indicated in Procedure for performance and maintenance of records of data processing activities.

    5. HOW WE COLLECT YOUR DATA

    The data listed in section 4 is collected in the following ways:

    5.1 By you registering for an Account – this is any information you give to us that we request from you when signing-up for an Account to use our Website.

    5.2 Information collected – each time you visit our Website, whether through your home, work or a public network, your own computer or mobile device, Subcontractors will automatically collect:

    5.2.1 technical information – your IP address (used by your computer or device to connect to the internet), and any internet browser type and version details; and

    5.2.2 visit-specific information – your URLs, Projects and Properties you viewed or searched for, your clickstream through the Website.

    5.3 Received from third parties – we and our Subcontractors work closely on our authorised payment gateway, verification of your eligibility to make an Investment and any payment you wish to make. We will also perform searches in the global and local data bases when we are required to do this by law or for business purposes (e.g. PEP or Sanction list, credit ratings, etc.) and get personal data from the state authorities.

    5.4 Information provided by you directly – this is any information you provide to us related performance of our services and/or based to other purpose (e.g. provision of the queries, phone calls that may be recorded).

    6. Cookies

    6.1 Cookies are small data files that are placed on your computer, mobile, or handheld device (such as a smartphone) as you browse the website. They are used to "remember" when your computer or device accesses the website. Cookies are essential for the effective operation of the website and enable you to use its services. Our Website will use the cookies listed in section 6.2 (alpha-numeric text files placed on your computer) to:

    6.1.1 distinguish you from other users;

    6.1.2 optimise your browsing experience;

    6.1.3 make necessary improvements to our Website;

    6.1.4 recognise and count the number of visitors to our Website and see how they move around the Website during use;

    6.1.5 recognise you when you return to our Website; and

    6.1.6 record your visit to our website, including any links you may follow.

    6.2 The following cookies are set to our Website for the listed purposes:

    COOKIE

    PURPOSE

    Expiry date

    ASP.Net_SessionId

    Enhances user experience by remembering session history.

    12 months

    ASPXAUTH

    Records users authentication session

    12 months

    _culture

    Assists recognising user’s nationality and language preferences, login, token, username recognition and encoding.

    12 months

    RequestVerificationToken

    Part of a mechanism to protect against cross site scripting attacks

    12 months

    ARRAffinity

    Enhances user browsing experience – part of load balancing setup

    12 months

    cookie-policy

    Tracks presentation of the cookie information advice

    12 months

    6.3 Our Website additionally uses Google Analytics, a web analytics service provided by Google, LLC (Google). Google Analytics uses analytical, performance or targeting cookies to help analyse how you use the Website and compile reports on your activity for us.

    6.4 Any information generated by the cookie about your use of the Website (including your IP address) will be transmitted to, and stored by, Google on servers in the United States. Google will use this information for the purpose of evaluating your use of the Website, compiling reports on your activity for us and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf. Google will not associate your IP address with any other data held by Google.

    6.5 You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this your ability to use the Website may be restricted. By using the Website, you consent to the processing of data about you by Google in the manner and for the purposes set out above.

    6.6 You may refuse the use of cookies by selecting appropriate settings on your browser. However, if you do so, your ability to use the Website may be restricted.

    6.7 Except for essential cookies, all cookies will expire after your session.

    7. WHAT WE DO WITH YOUR DATA

    7.1 Your data is primarily necessary to verify who you are when accessing your Account and to ensure you meet our eligibility requirements in order to submit an Application and make an Investment.

    7.2 Additionally, we or ShareIn will use all of your data you provide us to notify you about:

    7.2.1 similar Projects or Properties listed on our Website that are similar to those you have already Invested in, or otherwise viewed or enquired about; or

    7.2.2 changes to our Website or our services.

    7.3 We or ShareIn use any data we collect about you (as a result of your visit to our Website) to:

    7.3.1 personalise and improve our services (including the Website and its security);

    7.3.2 deal with your inquiries and requests;

    7.3.3 administer and monitor traffic and behaviours on our Website for analysis, testing, research, statistical and survey purposes;

    7.3.4 ensure that any part of our Website (including any Content) is presented in the most effective manner for you and your computer or device, and to make improvements (where necessary); and

    7.3.5 keep our Website safe and secure.

    7.4 Where we change our services, or any applicable terms and conditions, we will contact you.

    7.5 Any data we obtain about you from third parties are used for the purposes of verifying your eligibility to submit an application and to make an investment through our Website, and are acquired only to the extent we are unable to do so as a result of the information you provide to us.

    7.6 Once collected, we and/or ShareIn may retain your data for up to six years following the date of your last Investment or the date you close your Account (whichever is the later). This is to enable us to refer back to any transactions or records you are involved in (should we be required to do so).

    8. HOW AND WHY WE DISCLOSE YOUR DATA

    8.1 Subject to the rest of part 8 of this policy, we or ShareIn will only disclose your personal data to the following third parties for the following purposes:

    8.1.1 the relevant Investee Company – in connection with your Investment, details of which will be stated on your Application;

    8.1.2 our approved payment gateway – in order for you to make the payment(s) required as part of your Investment;

    8.1.3 our approved transaction email provider, SendGrid, Inc - in order for us to be able to send emails to you (NB only your email address is passed to SendGrid).

    8.1.4 other our approved services providers – in order to ensure the proper functioning and provision of the services (e.g. IT services provider, auditor, accounting services provider, etc.).

    8.2 In addition to the transfers contemplated by part 8.1, we or ShareIn may transfer or disclose your personal data to:

    8.2.1 any prospective buyer of any part of the relevant business or assets in connection with the sale (in which case, any personal data held by us or ShareIn about you and our Account Holders will be one of the transferred assets);

    8.2.2 comply with any legal obligation (such as where stated at clause 6.5 of the Investor Terms and Conditions);

    8.2.3 enforce or apply any part of our Investor Terms and Conditions generally; or

    8.2.4 protect our rights or our property, or those of our other Account Holders.

    8.3 Any websites which are linked from the Website are outside of our control and not covered by this policy. If you access those websites using the links provided, the website operators may collect information from you which will be used by them in accordance with their own privacy policies (if any). These policies may differ from ours, and we cannot accept any responsibility or liability in respect of these.

    9. SECURITY

    9.1 We have put in place appropriate technical and organisational measures to help protect your personal information from unauthorised access, use, disclosure, alteration or destruction consistent with applicable Data Protection Laws.

    9.2 Each member of staff has unique log-in details and authentication software requires these to access the systems. Staff have access to personal data only for the purposes of performing their roles.

    9.3 We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

    10. YOUR RIGHTS

    10.1 In relation to all of your personal data, you have the following rights to ask us or us or ShareIn (in addition to any rights you may have under the Act or the Regulation):

    10.1.1 not to process your personal data for marketing purposes;

    10.1.2 to clarify what data we or ShareIn hold about you, how it was obtained, to whom it has been disclosed and for how long it will be stored;

    10.1.3 to amend any inaccurate data we or ShareIn hold about you;

    10.1.4 to delete any of your data (where you no longer think we or ShareIn need to hold it or you think we or ShareIn have obtained it or processed it without your consent at any time); and

    10.1.5 to only process your personal data in limited circumstances or for limited purposes.

    10.1.6 to forward the personal data you provided (in case it is on the basis of consent or contract, and if the are processed by automated means) to another data controller or transferred to you in a structured, commonly used and computer-readable format, if it is technically possible;

    10.1.7 to stop the processing of personal data, except if we process personal data due to the legitimate interest of the Company or other person to whom personal data are provided, and your interests are not more important;

    10.1.8 not to be the subject only to automated processing, including profiling;

    10.1.9 to submit an appeal on the actions or inactions of the Company, related to the implementation of the data subject's rights to the Lithuanian State Data Protection Inspectorate, (A. Juozapavičius str. 6, Vilnius, e-mail address ada@ada.lt, website www.ada.lt or to the competent court); and

    10.10 compensation, which you must apply for to the Lithuanian competent court, if you have suffered damage as a result of a violation of the data subject's rights, you are entitled to.

    10.2 If you wish to exercise any of your rights at any time, please contact us on the details contained at the beginning of this policy in the first instance. We will require you to verify your identity to us before we provide any personal data, and reserve the right to ask you to specify the types of personal data to which your request relates.

    10.3 Where you wish to exercise any of your rights, they may be subject to payment of a nominal administration fee (to cover our costs incurred in processing your request) and any clarification we may reasonably require in relation to your request. Such fees may be charged where we consider (acting reasonably) that your request is excessive, unfounded or repetitive.

    10.4 Any data provided to you in accordance with your rights will be in a structured and machine-readable form.

    11. YOUR RESPONSIBILITIES

    11.1. You confirm that you have provided correct data about yourself in every required form and that afterwards, when changing or adding any data at the Website, you will enter only correct data. We or our Subcontractors will not tolerate invalid, false or otherwise incorrect data and will pursue actions in accordance with its legal obligations. You shall bear any losses that occur with regard to the submission of invalid, false or otherwise incorrect data.

    11.2 We draw your attention to the fact that email address and any other contact information you have chosen to link to your Account are used for your identification and communication. You undertake responsibility to protect these instruments and logins to them. You are responsible for password disclosure and for all operations performed after you use the password for a relevant account. We recommend to memorize your passwords and not to write them down or enter anywhere where they may be seen by other persons.