Privacy Policy

1. Controller

The controller for personal data processed via this website is Sternary.

Contact: hello@sternary.com
Privacy / data-protection requests: privacy@sternary.com
Legal notice: Impressum

Where a dedicated Data Protection Officer is appointed, contact details will be published here. Until then, use privacy@sternary.com.

2. What this policy covers

This policy describes how we process personal data when you visit https://sternary.com, use contact channels, or submit the investor-information form. It does not describe processing inside the Sternary application product for end-users/suppliers once that product is generally available — separate product privacy terms will apply.

3. Categories of data we process

• Server logs (technical): IP address, timestamp, requested URL, user agent, referrer — generated by our EU hosting stack for security and availability.
• Investor inquiry form: name, organisation, email, role, investment focus, optional check-size note, message, consent flag, coarse technical metadata (timestamp, IP, user agent).
• Email correspondence: content you send to our published email addresses.
• Cookie preference: your choice stored locally in your browser (see Cookie Notice).

We do not intentionally collect special-category data via this website. Please do not submit such data in free-text fields.

4. Purposes and legal bases (Art. 6 GDPR)

• Operating and securing the website (logs, abuse prevention) — Art. 6(1)(f) legitimate interests.
• Responding to investor / partner inquiries — Art. 6(1)(b) steps prior to a contract and/or Art. 6(1)(a) consent where you tick the consent box; Art. 6(1)(f) to manage professional inbound interest.
• Compliance with legal obligations (e.g. retention required by law) — Art. 6(1)(c).
• Remembering cookie preferences — Art. 6(1)(a) / (f) as described in the Cookie Notice.

5. Where data is hosted

Website hosting and form intake are designed to remain on infrastructure in the European Union (currently Hetzner Online GmbH, Germany). We do not sell personal data and do not use advertising trackers on this site by default.

If a transfer outside the EEA becomes necessary, we will apply an appropriate GDPR transfer mechanism (e.g. adequacy decision or Standard Contractual Clauses) and update this policy.

6. Recipients

• Hosting / infrastructure provider (Hetzner Online GmbH) as processor for hosting.
• Authorised Sternary personnel reviewing inbound inquiries.
• Professional advisers (legal, accounting) under confidentiality, where required for a specific matter.
• Authorities, where legally compelled.

7. Retention

• Server logs: typically up to 30–90 days, unless needed longer for security investigation.
• Investor inquiries: up to 24 months after last meaningful contact, or earlier if you request deletion and no overriding legal duty applies.
• Email: for as long as needed to handle the correspondence and related legitimate interests / legal holds.

8. Your rights

Subject to GDPR conditions, you may request: access, rectification, erasure, restriction, portability, and objection to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time without affecting prior lawful processing.

You may lodge a complaint with a supervisory authority in the EU/EEA, in particular in your habitual residence or our place of establishment.

Contact for rights requests: privacy@sternary.com.

9. No automated decision-making

We do not use personal data from this website for automated decision-making producing legal or similarly significant effects (Art. 22 GDPR).

10. Children

This website is directed at business and professional audiences. It is not intended for children under 16.

11. Changes

We may update this policy to reflect operational or legal changes. The “Last updated” date will change accordingly. Material changes affecting active inquiry relationships will be communicated where appropriate.