Privacy Policy

Nextway Capital Management GmbH i.G., c/o Dr. Ruoff, Am Schwaigerfeld 2a, 83229 Aschau im Chiemgau, Germany, email: contact@nextway.capital. Nextway Capital is a company in formation; upon registration, the company will replace the individual named above as controller.

No data protection officer has been appointed; the requirements of sec. 38 (1) BDSG (at least 20 persons) are not met. Please direct any data protection matters to contact@nextway.capital.

The website is hosted by Vercel Inc. (USA) acting as our processor; the server location is Frankfurt am Main (EU). Each time the website is accessed, technical access data is recorded in log files: IP address, date and time, the resource requested, and browser and system information (user agent).

The legal basis is Art. 6(1)(f) GDPR (secure and stable provision of the website, error analysis, prevention of misuse). Log files are stored briefly and deleted within a few days; they are not analysed for analytics or marketing purposes. Where data is transferred to the USA, this is based on the EU Standard Contractual Clauses (Art. 46 GDPR) or the EU-US Data Privacy Framework (Art. 45 GDPR).

The internal area is in all cases available exclusively to logged-in team members. For this we use Supabase (database and authentication, Frankfurt/EU region, acting as processor). Login is by email address and password, or by a one-time code or sign-in link sent by email. Accounts are set up by invitation email, and a forgotten password can be reset via a link sent by email. We process the email address, the password (stored only as a hash), the login time and technical session data. After login, a strictly necessary session cookie is set.

This cookie does not require consent under sec. 25 (2) no. 2 TDDDG. The legal basis for the related processing is Art. 6(1)(f) GDPR (protection of unpublished content, access control) and, for team members, additionally Art. 6(1)(b) GDPR.

For sending emails – login codes to team members – we use Supabase as our processor. We process the recipient address, the content of the message and technical delivery information. The legal basis is Art. 6(1)(b) or (f) GDPR. We do not send newsletters or marketing emails.

Internal task reminders to team members are sent via the messaging service Telegram. The team also uses an internal Telegram bot through which business contact data and notes on business contacts and potential investments (see section 6) are transferred into the internal area. In this context Telegram processes the Telegram identifiers of team members, the content of messages and of transmitted documents, including third-party data contained in them, and technical transmission information. The legal basis is Art. 6(1)(b) or (f) GDPR.

The internal Telegram bot passes message content and uploaded documents to the Claude API provided by Anthropic (USA) in order to extract structured data from them. In this context the content of messages, uploaded documents including any third-party personal data contained in them, and technical metadata are processed. The legal basis is Art. 6(1)(f) GDPR. The transfer to the USA is based on the EU Standard Contractual Clauses (Art. 46 GDPR).

To detect technical errors we use Sentry as our processor. Only error reports and technical metadata are transmitted (error type, stack trace, application version, time of the error, browser and system information). Personal data is removed before transmission. Sentry processes this data in its EU region; there is no transfer to a third country. The legal basis is Art. 6(1)(f) GDPR (stability and security of our website).

If you contact us at contact@nextway.capital, we process your email address, your name and the content of your message in order to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR for contract-related enquiries and otherwise Art. 6(1)(f) GDPR. Providing this data is neither a statutory nor a contractual requirement; however, without it we cannot process your enquiry. Correspondence is deleted once it is no longer required and no statutory retention obligations apply.

We process business contact data of founders, investors, shareholders and business partners (name, role, company, business contact details, meeting notes) as well as publicly available register data (commercial register, shareholder lists) and information from company websites and professional networks.

The purposes are identifying and assessing potential investments, preparing transactions and approaching investors. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in deal sourcing and investor outreach); where a contractual relationship exists, Art. 6(1)(b) GDPR applies in addition.

Where data is not collected from you directly, we will inform you in accordance with Art. 14 GDPR within a reasonable period after obtaining the data, but at the latest within one month – or, if we contact you sooner, at the latest when we first contact you. You may object to the processing at any time under Art. 21 GDPR; in that case we retain only the information required to give effect to your objection. Contact data is deleted once it is no longer relevant for the purposes stated.

We do not use analytics or tracking services – in particular no Google Analytics – no marketing or advertising cookies, no social media plugins and no newsletter. There is no profiling and no automated decision-making within the meaning of Art. 22 GDPR. Only strictly necessary cookies are used, and no cookie banner is therefore required.

Recipients are exclusively the processors named above (Vercel, Supabase, Sentry), the messaging service Telegram, Anthropic (Claude API) and, where necessary, our advisers and public authorities on the basis of statutory obligations. Data is neither shared for advertising purposes nor sold. Transfers to third countries are based on an adequacy decision or the EU Standard Contractual Clauses; copies of the safeguards are available on request.

We store personal data only for as long as necessary for the respective purpose or as required by statutory retention periods. We apply appropriate technical and organisational measures pursuant to Art. 32 GDPR, and the website is delivered exclusively via encrypted connections (TLS).

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent (Art. 7(3)). Where processing is based on Art. 6(1)(f) GDPR, you have a right to object under Art. 21 GDPR. An email to contact@nextway.capital is sufficient.

You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular the authority of your place of residence or the authority responsible for our registered office. We will update this policy if our processing activities, the services we use or the legal framework change.