Privacy Policy

01 Who is responsible for your data

The controller for the processing described in this policy, within the meaning of Article 4(7) of the General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”), is:

Entity

Defile B.V., trading as FluxNova Capital

Legal form

Besloten vennootschap met beperkte aansprakelijkheid (B.V.)

Postal address

Postbus 69003, 1060 CA Amsterdam, Netherlands

Trade register

Kamer van Koophandel (Dutch Chamber of Commerce), registration number 34297311

Email

xiumin@fluxnovacapital.com

Full company details are set out in the imprint.

Data protection officer

No data protection officer has been appointed, and none is required. Article 37(1) GDPR does not apply here: Defile B.V. is not a public authority, its core activities do not consist of regular and systematic monitoring of data subjects on a large scale, and it does not process special categories of data on a large scale. Data protection questions go to xiumin@fluxnovacapital.com.

02 What this policy covers

This policy describes the personal data we process when you visit this website or send us an enquiry through it. It does not cover:

• personal data processed in the course of an engagement or a transaction, which is governed by the agreement and the information we provide at that point;
• third-party websites we link to, each of which has its own policy and its own controller;
• correspondence you send us through channels other than this website, which is subject to the same principles but is not described here in detail.

This website is also published in Dutch, German, French, Spanish, Italian, Polish and Simplified Chinese, and this policy, which is in English, covers every language version of it.

Where this policy refers to “we”, “us” or “FluxNova Capital”, it refers to the controller identified in section 01.

03 What we collect

3.1 Enquiry forms

This site has two enquiry forms, one for site owners and developers and one for investors and lenders. Only your name and work email address are required; every other field is optional. The forms ask for:

• your name, your work email address and your company or firm;
• asset and project details, on the form for site owners: the asset location, the asset type, the development stage, the installed capacity and the grid connection capacity in MW, whether generation data is available, and your financing preference;
• details of your mandate, on the form for investors and lenders: the type of capital, an indicative ticket size, the geography you invest in and your stage preference;
• a free-text field, headed “Message” on the form for site owners and “Investment criteria” on the form for investors and lenders.

Each enquiry also records which of the two forms you used and, in a hidden field, which language version of the site you sent it from. When our server receives an enquiry, it adds the time of receipt and the IP address the enquiry was sent from, and both are stored with it.

Our own server sends your enquiry over an encrypted connection to our Google Workspace mailbox, where it is stored. No third-party form service handles it, and the web server keeps no copy. Section 07 describes Google’s role, and section 10 says how long we keep enquiries.

Anything you type into a free-text field is personal data if it identifies you or another individual, so please keep it to what is necessary for a first exchange. We do not ask for, and you should not provide, the categories of information listed in section 11.

3.2 Server access logs

Like almost every website, this site is served by infrastructure that records technical information about each request. Those records may include:

• the IP address of the requesting device or its network;
• the date and time of the request;
• the URL requested and the response status and size;
• the user agent string reported by your browser, which typically identifies the browser and operating system;
• the referring URL, where your browser sends one.

An IP address is personal data under the GDPR even where we cannot ourselves connect it to a name. We do not use these logs to build a profile of individual visitors, and we do not combine them with enquiry form data.

To limit abuse of the enquiry forms, our server also holds the IP address of each submission in memory, and uses that copy only to refuse repeated submissions from one address within ten minutes.

3.3 Correspondence

If you write to us, we process the content of your message and the contact details it carries, for as long as needed to deal with it and to keep a record of what was said.

04 Why we use it, and our legal basis

We process personal data only where one of the lawful bases in Article 6(1) GDPR applies.

Responding to enquiries

To read your enquiry, assess whether there is a plausible fit, and reply to you.

Article 6(1)(f) — our legitimate interest, and yours, in responding to a business approach that you initiated. Where your enquiry is a step towards a possible agreement with you personally, Article 6(1)(b) (steps taken at your request prior to entering a contract) may apply instead.

Assessing fit

To assess a site or project, and to match a project or a mandate against relevant counterparties, which is the service this firm provides.

Article 6(1)(f) — our legitimate interest in operating the business, balanced against your interests. Business contact data supplied voluntarily for exactly this purpose carries a low expectation of privacy intrusion; we do not enrich it from external sources.

Further contact

Where you ask to be kept in contact beyond the enquiry itself — for example, to be told about opportunities matching criteria you have given us.

Article 6(1)(a) — your consent. You may withdraw it at any time, and withdrawal does not affect the lawfulness of anything done before you withdrew it (Article 7(3) GDPR).

Operating and securing the site

To deliver pages, keep the site available, and detect and investigate abuse, attacks and faults.

Article 6(1)(f) — our legitimate interest in a functioning and secure website. Recital 49 GDPR expressly recognises network and information security as a legitimate interest.

Record-keeping

Where a record must be retained to satisfy a statutory obligation — for example administrative, accounting or tax records.

Article 6(1)(c) — compliance with a legal obligation to which we are subject. See section 10.

Legal claims

To establish, exercise or defend legal claims.

Article 6(1)(f) — our legitimate interest in being able to defend ourselves and to evidence what was agreed.

Handling an enquiry rests primarily on our legitimate interests under Article 6(1)(f), not on your consent. That is why the right to object under Article 21(1) applies to it, as set out in section 15.

05 No cookies, no analytics, no trackers

This website sets no cookies. It uses no analytics product, no tag manager, no advertising pixels and no third-party tracking of any kind. Nothing is written to your browser’s local or session storage. We do not fingerprint your device and we do not track you across sites.

Because nothing on this site requires consent to store or read information on your device, the site shows no cookie banner and runs no consent management platform. There is nothing here for you to consent to. If that ever changes, this policy will change first and the necessary consent mechanism will be in place before the change goes live.

06 Web fonts — no third-party request

The site’s two typefaces, Inter Tight and JetBrains Mono, are served from this domain, including the extra character sets that some of the site’s languages need. The font files sit alongside the pages and are requested from the same place the page came from, so displaying this site in its intended typefaces sends nothing to anyone but us.

Chinese characters are shown in fonts already installed on your device, and no font is downloaded for them.

If a third-party request is ever added to this site, this section will say which one and why, and this policy will change before the change goes live.

07 Hosting, DNS and other processors

We do not run our own servers. This site is delivered by third-party infrastructure providers, which process personal data on our behalf and on our instructions:

Hosting

Railway hosts the application that serves these pages. Request data, including the access log information described in section 3.2, is processed on its platform.

The site runs in Railway’s EU region, and Railway’s data processing terms apply as part of its terms of service.

DNS

Cloudflare provides DNS for this domain, which means it answers the lookups that tell a browser where to find this site. Requests for the pages themselves go to Railway and do not pass through Cloudflare’s network.

Cloudflare’s Data Processing Addendum applies as part of its terms.

Enquiry delivery

Google Workspace (Google Ireland Limited) — hosts the mailbox that receives and stores enquiries. Acting as a processor under Article 28 GDPR; the Workspace Data Processing Addendum applies. Data is stored in the region configured for the Workspace account: European Union.

Each of these providers acts as a processor within the meaning of Article 4(8) GDPR. In each case the processing agreement required by Article 28(3) is the provider’s own data processing addendum, incorporated into the terms under which the service is taken. All three are configured to the European Union.

08 Who else receives your data

We do not sell personal data, and we do not share it for anyone else’s marketing.

Beyond the infrastructure providers in section 07, personal data from an enquiry may be disclosed to:

• A counterparty, where you have asked us to make an introduction. This is the point of the service, but it is not automatic: we do not pass your identity or your details to a prospective counterparty without your agreement to that specific introduction. Until you agree, an approach is made on a no-names basis or not at all.
• Professional advisers — lawyers, accountants and similar — where their advice requires it, each of whom is bound by their own duties of confidentiality.
• Public authorities, where we are legally required to disclose.
• A purchaser or successor, if the business or the relevant part of it is transferred, subject to the same protections.

Anyone who receives personal data from us on our instructions is engaged under a written agreement that restricts what they may do with it.

09 Transfers outside the EEA

Some of the providers described above are, or may be, established outside the European Economic Area, or may process data on infrastructure located outside it. Because this site makes no other third-party request (sections 05 and 06), the infrastructure providers in section 07 are the only transfers to consider.

A transfer of personal data to a country outside the EEA is only lawful on one of the grounds in Chapter V of the GDPR (Articles 44 to 49): an adequacy decision under Article 45, appropriate safeguards under Article 46 — in practice, the European Commission’s Standard Contractual Clauses supplemented by a transfer impact assessment — or, exceptionally, a derogation under Article 49.

Hosting, DNS and the mailbox are all configured to the EU, so the ordinary processing of personal data for this site takes place inside the EEA and Article 45/46 transfer rules are not engaged for it. Where a provider’s support or engineering staff access data from outside the EEA, each provider’s Standard Contractual Clauses under Article 46(2)(c), incorporated into its data processing terms, are the mechanism relied on.

You may ask us for a copy of the safeguards relied on for any transfer, using the contact details in section 18.

10 How long we keep your data

We keep personal data only for as long as it is needed for the purpose it was collected for, or for as long as a statutory retention obligation requires, and then we delete it. Storage limitation is a requirement of Article 5(1)(e) GDPR, not a policy preference.

Enquiry data

Retained while the enquiry is live and for 24 months from the last contact about it, so that a later approach can be understood in context. An enquiry that leads nowhere is deleted at the end of that period.

Server access logs

Retained for 30 days for security and fault diagnosis, then deleted or aggregated beyond identification. This period is in part determined by our infrastructure providers’ own defaults.

Consent records

Where you have given consent, we keep the record of it for as long as we rely on it and afterwards for as long as we may need to evidence it under Article 7(1) GDPR.

Statutory records

Where a record forms part of our administration, Dutch law requires it to be kept for seven years (Article 52 of the Algemene wet inzake rijksbelastingen, and the corresponding obligation in Book 3 of the Burgerlijk Wetboek). A general business enquiry does not normally form part of that administration; where one does — because it belongs to an engagement that was actually entered into — the statutory period governs instead of the period given above.

Where data is retained only to satisfy a retention obligation, we restrict its processing to that purpose rather than continuing to use it.

11 What you must not send us

The enquiry forms on this site are for a first, high-level exchange. They are not a secure channel and they are not a data room.

If special category data or confidential material reaches us unsolicited, we will delete it without acting on it, save where we are required to retain it.

12 How we protect your data

We take the technical and organisational measures appropriate to the risk, as Article 32 GDPR requires. This site is served over an encrypted connection (HTTPS), access to enquiry data is limited to the people who need it, and the pages are static, with no database of visitor data behind them.

No transmission over the internet is completely secure. Email in particular is not a secure channel, which is one reason for the restriction in section 11.

Where a personal data breach occurs and it is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority in accordance with Article 33 GDPR, and you directly where Article 34 requires it.

13 Whether you have to give us your data

You are under no statutory or contractual obligation to provide any personal data through this website. Providing it is entirely voluntary.

The only consequence of not providing it is practical: without a name and a way to reply, we cannot respond to an enquiry, and without some sense of the site or the mandate, its location and its scale we cannot say whether there is a fit worth discussing.

14 No automated decision-making

We do not carry out automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22(1) GDPR. Enquiries are read and assessed by people.

15 Your rights

Subject to the conditions and exceptions in the GDPR, you have the following rights in relation to personal data we hold about you.

Access — Art. 15

To be told whether we process personal data about you and, if so, to receive a copy of it together with the information set out in Article 15(1).

Rectification — Art. 16

To have inaccurate personal data corrected and incomplete data completed.

Erasure — Art. 17

To have personal data deleted where one of the grounds in Article 17(1) applies — for example where it is no longer necessary for the purpose, or where you withdraw the consent it rested on.

Restriction — Art. 18

To have processing restricted while a dispute about accuracy or about our legitimate interests is resolved.

Portability — Art. 20

Where processing is based on consent or on a contract and is carried out by automated means, to receive the data you provided in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible.

Objection — Art. 21

To object at any time, on grounds relating to your particular situation, to processing based on Article 6(1)(f). We must then stop unless we demonstrate compelling legitimate grounds that override your interests, or the processing is for legal claims. Where personal data is processed for direct marketing, you may object at any time and we must stop, with no balancing exercise.

Withdraw consent — Art. 7(3)

Where processing rests on your consent, to withdraw it at any time, as easily as it was given. Withdrawal does not affect the lawfulness of processing carried out before it.

To exercise any of these rights, contact us using the details in section 18. We will respond without undue delay and in any event within one month of receipt, extendable by a further two months where the request is complex, in which case we will tell you within the first month. Exercising these rights is free of charge; we may charge a reasonable fee or refuse only where a request is manifestly unfounded or excessive, as Article 12(5) permits. We may ask for information reasonably needed to confirm your identity before we act.

16 Complaints to a supervisory authority

If you consider that our processing of your personal data infringes the GDPR, you have the right under Article 77 to lodge a complaint with a supervisory authority — in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement.

The supervisory authority competent for this controller is the Autoriteit Persoonsgegevens, the Dutch data protection authority: Postbus 93374, 2509 AJ Den Haag, Netherlands (autoriteitpersoonsgegevens.nl).

We would prefer to hear from you first, and will take any complaint seriously, but you are not required to come to us before going to the authority.

17 Changes to this policy

We will update this policy when what we do changes, for example when an analytics tool is adopted or when a processor is added or replaced.

The current version is always published at this address, and the date at the top of the page tells you when it was last changed. Where a change materially affects how we use personal data we already hold, we will take reasonable steps to bring it to the attention of the people affected rather than relying on the updated date alone. Where a change requires your consent, we will ask for it before the change takes effect.

18 How to contact us

For any question about this policy, or to exercise a right under section 15, write to xiumin@fluxnovacapital.com, or by post to Defile B.V., Postbus 69003, 1060 CA Amsterdam, Netherlands.

For data protection matters specifically: no data protection officer is appointed, so please use the same address.