Privacy Policy

Last updated: October 2026

This is a convenience translation. In case of any discrepancy, the German version shall prevail.

This privacy policy explains which personal data is processed when this website is visited or contact is made, for which purposes and on which legal basis, and which rights data subjects have.

Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

emdequity Management GmbH
Nymphenburger Straße 25 RG
80335 Munich
Germany

Phone: +49 (0) 89 6142 4104 0
Email: info@emdequity.de

No data protection officer has been appointed, as there is no legal obligation to do so. Questions regarding data protection may be directed to the contact details above.

Hosting and server log files

The website is operated and delivered via the platform Lovable (Lovable AB, Sweden). Delivery is provided through the global network of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA.

A transfer of data to third countries (e.g. the USA) cannot be ruled out in this context. It takes place on the basis of the EU-US Data Privacy Framework (Art. 45 GDPR), under which Cloudflare, Inc. is certified.

Each time the website is accessed, the following information transmitted by the browser is collected automatically (server log files):

• IP address of the requesting device
• date and time of access
• page or file accessed
• amount of data transferred and status code
• referrer URL (previously visited page)
• browser type and version
• operating system

Purpose: Delivering the website, ensuring stability and security, and detecting and preventing attacks.

Legal basis: Art. 6(1)(f) GDPR. The legitimate interest lies in the technically error-free and secure provision of the website.

Retention: Log files are deleted after 7 days. Data required to investigate a specific security incident is retained until the incident has been fully resolved.

Data processing: A data processing agreement pursuant to Art. 28 GDPR is in place with the hosting provider.

Cookies and storage on the device

This website does not use cookies and does not access information on the user's device unless this is strictly necessary to provide the website (Section 25(2) No. 2 TDDDG). No analytics, tracking or advertising services are used.

Fonts

The fonts used are stored locally on the website's server. No connection is made to servers of Google or any other third party.

SSL/TLS encryption

For security reasons, this website uses SSL/TLS encryption. An encrypted connection can be recognised by "https://" in the browser's address bar.

Contact by email or phone

When contact is made by email or phone, the data provided, such as name, email address, phone number, company and the content of the enquiry, is processed in order to handle the request.

Legal basis: Art. 6(1)(b) GDPR where the enquiry relates to a contract or pre-contractual measures (e.g. investment or financing enquiries). In all other cases Art. 6(1)(f) GDPR. The legitimate interest lies in the effective handling of enquiries.

Retention: The data is deleted once the enquiry has been fully handled, unless statutory retention obligations apply, e.g. for business correspondence under Section 257 HGB and Section 147 AO (up to six or ten years).

Recipients: Email communication is handled via Microsoft 365, provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, as a processor pursuant to Art. 28 GDPR. Transfers of data to the USA cannot be ruled out. They are based on the EU-US Data Privacy Framework (Art. 45 GDPR), under which Microsoft Corporation is certified, and additionally on EU Standard Contractual Clauses.

Job applications

In the course of an application (e.g. by email), application documents and contact details are processed in order to decide on the establishment of an employment relationship.

Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into an employment relationship). Special categories of personal data provided voluntarily (e.g. health data) are processed under Art. 9(2)(b) GDPR.

Recipients: Access to the documents is limited to the persons involved in the selection process.

Retention: If no employment relationship is established, the documents are deleted no later than six months after the application process ends. Retention until then serves to defend against potential claims under the German General Equal Treatment Act (AGG) (Art. 6(1)(f) GDPR). Inclusion in a talent pool only takes place with prior consent (Art. 6(1)(a) GDPR), which may be withdrawn at any time. In the event of employment, the data is transferred to the personnel file.

Company page on LinkedIn

emdequity Management GmbH maintains a company page on LinkedIn, a service provided by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland ("LinkedIn"). This website is not linked to the LinkedIn page; no data is transferred to LinkedIn when the website is visited.

When the LinkedIn company page is visited, LinkedIn processes personal data, among other things to create anonymised statistics ("Page Insights"). Joint controllership with LinkedIn exists for these statistics (Art. 26 GDPR). LinkedIn has contractually undertaken to assume primary responsibility for this processing and to handle data subject requests: https://legal.linkedin.com/pages-joint-controller-addendum

Legal basis: Art. 6(1)(f) GDPR. The legitimate interest lies in communicating with interested parties, founders, investors and applicants.

LinkedIn may transfer data to the USA. LinkedIn Corporation is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Further information is available in LinkedIn's privacy policy: https://www.linkedin.com/legal/privacy-policy

Links to external websites

This website contains links to websites of portfolio companies and other third parties. Visiting this website does not transfer any data to the linked providers. The external website is only accessed when a link is clicked. The respective provider is responsible for data processing on these websites, and its privacy policy applies.

Rights of data subjects

Under the GDPR, the following rights exist:

• Access to the personal data stored (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
• Objection to processing (Art. 21 GDPR, see below)

An informal message to info@emdequity.de is sufficient to exercise these rights.

Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): There is a right to lodge a complaint with a data protection supervisory authority. The competent authority is the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

Right to object under Art. 21 GDPR
Where personal data is processed on the basis of Art. 6(1)(f) GDPR (legitimate interests), there is a right to object to this processing at any time on grounds relating to the particular situation of the data subject. The data will then no longer be processed unless compelling legitimate grounds for the processing can be demonstrated that override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defence of legal claims. Objections should be sent to info@emdequity.de.

Obligation to provide data and automated decision-making

There is no obligation to provide personal data. However, the website cannot be delivered without the data in the server log files, and enquiries or applications cannot be processed without contact details. No automated decision-making, including profiling (Art. 22 GDPR), takes place.

Changes to this privacy policy

This privacy policy will be updated whenever the legal situation or the data processing changes. The version published on this page applies.