Privacy Policy — GRID | startupgrid.ai

1. Controller

The controller within the meaning of the GDPR is:
NMA Venture Capital GmbH
Am Sandtorkai 27
20457 Hamburg, Germany
Email: [email protected]

2. Legal Basis for Processing

2.1 Scope of Processing

We process personal data of our users generally only to the extent necessary to provide a functional website and our SaaS platform.

2.2 Legal Bases

Art. 6(1)(a) GDPR — Consent (e.g. Google Analytics)
Art. 6(1)(b) GDPR — Contract performance (use of the SaaS software)
Art. 6(1)(f) GDPR — Legitimate interest (hosting, security)

3. Hosting & Log Files

3.1 Data Collected Automatically

IP address of the user
Date and time of access
Browser type and version
Operating system
Referrer URL

3.2 Hosting Providers

We have concluded a Data Processing Agreement (DPA) in accordance with Art. 28 GDPR with all service providers. Our infrastructure partners:

Hetzner Online GmbH (Server infrastructure, Germany)
Cloudflare Inc. (CDN, DDoS protection, DNS)
Google Cloud Platform (Infrastructure, Ireland/EU)

Insofar as data is transferred to providers in the USA, we rely on the EU-U.S. Data Privacy Framework adequacy decision or Standard Contractual Clauses (SCC).

3.3 Legal Basis

Art. 6(1)(f) GDPR — legitimate interest in technical security and stability.

4. Registration & Account Data

4.1 Data Collected

Email address
Password (encrypted/hashed — never stored in plaintext)
First and last name
Company name (optional)

4.2 Legal Basis

Art. 6(1)(b) GDPR — necessary for performance of the contract.

5. Payment Processing (Mollie)

We use the payment service provider Mollie B.V. (Netherlands) to process subscription payments. We do not store credit card or bank details ourselves — these are transmitted directly to Mollie. The legal basis is Art. 6(1)(b) GDPR.

6. Transactional Emails

For system-critical emails (registration confirmation, password reset, invoices), we transmit your email address to our email delivery provider. Legal basis: Art. 6(1)(b) GDPR.

7. Analytics (Google Analytics 4)

7.1 Scope

Where you have given consent via our cookie banner, we use Google Analytics 4 with IP anonymization enabled.

7.2 Legal Basis

Art. 6(1)(a) GDPR — consent. Revocable at any time via cookie settings.

7.3 Third Country Transfer

Google relies on the EU-U.S. Data Privacy Framework for transfers to the USA.

8. Your Rights (GDPR)

Right of access (Art. 15)
Right to rectification (Art. 16)
Right to erasure — "Right to be forgotten" (Art. 17)
Right to restriction of processing (Art. 18)
Right to data portability (Art. 20)
Right to object (Art. 21)

You also have the right to lodge a complaint with a supervisory authority. The competent authority for NMA Venture Capital GmbH is the Hamburg Commissioner for Data Protection.

To exercise your rights, contact: [email protected]