Privacy Policy — GRID

1. Controller

The controller responsible for processing your personal data within the meaning of the GDPR is:
NMA Venture Capital GmbH
Am Sandtorkai 27, 20457 Hamburg, Germany
Email: [email protected]

2. Legal Basis for Processing

2.1 Scope of Processing

We process personal data of our users generally only to the extent necessary to provide a functional website and our SaaS platform.

2.2 Legal Bases

Art. 6(1)(a) GDPR — Consent (e.g., cookie settings)
Art. 6(1)(b) GDPR — Performance of a contract (delivering the SaaS platform)
Art. 6(1)(f) GDPR — Legitimate interest (system security, logs)

3. Hosting & Log Files

3.1 Data Collected Automatically

IP address of the user
Date and time of access
Browser type and version
Operating system
Referrer URL

3.2 Infrastructure Providers

We host our services and process user data using secure infrastructure partners under standard Data Processing Agreements (Art. 28 GDPR):

Am Sandtorkai 27 Datacenter (UpCloud/Hetzner) (Server nodes)
Cloudflare Inc. (CDN, WAF, DNS, EU SCC basis)

4. Registration & Account Data

4.1 Data Collected

Email address
Encrypted credentials (stored as cryptographic hashes)
First and last name
Organization name (optional)

4.2 Legal Basis

Art. 6(1)(b) GDPR — necessary to establish and perform your user account contract.

5. AI Inference & Processing

AI-powered pitch scoring and debates run through secure API nodes, processing input data to output structural dimensions. LLM queries run via European cloud providers under strict processor terms.

6. Payment Processing (Mollie)

We use the payment service provider Mollie B.V. (Netherlands) to handle platform subscriptions and invoices. We do not store credit card numbers or banking passwords on our servers. Legal basis: Art. 6(1)(b) GDPR.

7. Transactional & Communication Emails

We route account validations, transaction receipts, and system alerts via our transactional email provider (Resend Inc.). Legal basis: Art. 6(1)(b) GDPR.

8. Your Rights (GDPR)

Right of access (Art. 15)
Right to rectification (Art. 16)
Right to erasure — "Right to be forgotten" (Art. 17)
Right to restriction of processing (Art. 18)
Right to data portability (Art. 20)
Right to object (Art. 21)

You have the right to lodge a complaint with a supervisory authority. The competent authority for NMA Venture Capital GmbH is the Hamburg Commissioner for Data Protection.

To exercise your rights, contact us at: [email protected]