Privacy policy
Effective 8 August 2026 · Version 1.2
1. Who is responsible
The controller for the processing described here is:
Grownlearn 888 e.U.
Owner: Zorina Dimitrova
Firmenbuch: FN 636988 y, Landesgericht Korneuburg
UID: ATU81119601
Registered seat: Strasshof an der Nordbahn, Austria
Email: office@grownlearn.org
Postal address: see the Impressum
Email reaches us fastest and is the best way to exercise any of the rights in
section 7. A postal request is equally valid — the address is in the Impressum.
We have not appointed a Data Protection Officer, and are not required to.
2. What this policy covers
This policy covers this website and the mandate registration form on it. It does not cover the GrownLearn podcast, which is published through third-party platforms under their own policies — see section 8.
3. Visiting the website
We set no cookies and use no analytics. There is no tracking pixel, no advertising network, no social media widget and no consent banner, because there is nothing to consent to. Typefaces are served from our own server rather than a font provider, so visiting a page causes your browser to contact no third party at all. The one exception is a video you choose to play — see section 8.
Our hosting provider records standard server log data — IP address, date and time, the page requested, the referring page, browser and operating system. This is necessary to operate and secure the site, and is processed on the basis of our legitimate interest in a functioning, secure website (Art. 6(1)(f) GDPR). We do not combine it with any other data and do not use it to identify individuals. Logs are deleted on our provider’s ordinary schedule.
If you have an account on this site, WordPress sets a session cookie while you are logged in. This applies to site administrators only.
4. The mandate registration form
What we collect
Contact details — your name, business email address, organisation, role, and optionally telephone number, preferred contact channel, city, country, website and LinkedIn profile.
Mandate criteria — depending on whether you provide or are seeking capital: investment sectors, stages, transaction size range, geographies and instruments, and whether you can lead or co-invest; or your industry, stage, capital requirement, intended structure and, optionally, annual revenue. Plus anything you write in the free-text field.
Technical data — the date and time of submission, a one-way hashed form of your IP address, and your browser’s user-agent string, kept to detect and prevent automated abuse of the form. The IP address is not stored in readable form.
Why, and on what basis
| Purpose | Legal basis |
|---|---|
| Assessing whether we can be useful to you, and replying | Art. 6(1)(b) GDPR — steps taken at your request before entering a contract |
| Recording your criteria so future opportunities can be tested against them | Art. 6(1)(b), and our legitimate interest in operating an advisory practice, Art. 6(1)(f) |
| Preventing automated abuse of the form | Art. 6(1)(f) — legitimate interest in a functioning service |
| Future use in a capital matching platform | Art. 6(1)(a) — your separate, optional consent (section 5) |
Providing the required fields is necessary for us to respond. If you would rather not use the form, email us instead.
Where it goes
The form writes to this website’s database, hosted in the European Union by our hosting provider, who acts as our processor. Submissions are then transferred to our own infrastructure and deleted from this website, so the site holds recent submissions only rather than a permanent record.
We do not sell your data, and we do not share it with anyone as a mailing list. Where an introduction is the whole point — you have asked us to introduce you, or we have identified a possible fit — we will tell you who we propose to introduce you to, and why, before we do it. Introductions are made under confidentiality undertakings.
How long we keep it
We keep your mandate record for as long as it is plausibly useful — while you would still want to hear about a matching opportunity — and review it at least every three years. If you tell us the mandate has lapsed, or ask us to delete it, we do so promptly. Correspondence may be kept longer where Austrian commercial or tax law requires it.
5. Optional: the capital matching platform
We are developing a platform that would match capital to opportunities using the same criteria this form collects. It is not public.
If you tick the optional second box on the form, you agree that your details may also be used in that platform, whether operated by us or by an affiliated entity — and we will contact you before that happens. This is entirely optional; leaving it unticked changes nothing about how we handle your registration.
You can withdraw this consent at any time by emailing office@grownlearn.org. Withdrawal does not affect processing carried out before you withdrew.
6. Processors
- SuperHosting.BG (Sofia, Bulgaria — within the EU), which provides both our web hosting and our email. It therefore processes the website database, the server logs and our correspondence, in each case only to deliver the service, and under the data processing terms that form part of its general conditions.
That is the complete list. We use no separate mail service, no customer relationship platform hosted by anyone else, and no backup provider beyond our host.
We use no advertising or analytics services, and buy no data about you from anyone.
No decision about you is made by automatic means alone within the meaning of Art. 22 GDPR. Whether we can be useful to you, and who we might introduce you to, is a judgement made by a person who has read your registration.
The matching platform in section 5 does compare mandate criteria against opportunities automatically. That is why it sits behind a separate, optional consent rather than being covered by your registration: it produces suggestions for us to weigh, never an outcome you receive directly. It is not in use today.
7. Your rights
Under the GDPR you have the right to access your data, to rectification of anything inaccurate, to erasure, to restriction of processing, to data portability, and to object to processing based on legitimate interests. Where processing rests on consent, you may withdraw it at any time.
Write to office@grownlearn.org. We will respond within one month.
You may also complain to the Austrian supervisory authority:
Österreichische Datenschutzbehörde
Barichgasse 40–42, 1030 Vienna
dsb@dsb.gv.at · www.dsb.gv.at
8. External services
The GrownLearn podcast is published through third-party platforms. Links to it open on those platforms, under their own privacy policies. Following an external link means the destination receives your request; we have no control over that and no visibility of it.
Video on article pages. Some articles show an episode with a play button. Until you press it, the page has contacted YouTube in no way whatsoever: the preview image is stored on and served from our own server, and no YouTube script, frame or cookie is present. Pressing play loads the player from YouTube, at which point YouTube (Google Ireland Limited) receives your IP address and may set cookies or read storage on your device, under its own privacy policy. We use the youtube-nocookie.com variant, which withholds advertising cookies — it is not, despite the name, free of storage.
Because nothing loads until you act, this is not something we ask consent for in advance; pressing play is the consent, and the button says what it does. If you do not press it, no data reaches YouTube.
9. Changes
We will update this policy when what we do changes. The version and effective date are shown at the top. Where a change materially affects processing you have consented to, we will ask again rather than rely on the old consent.