Privacy Policy

Privacy Policy

The protection of your personal data is a central concern for us. In this privacy policy, we inform you comprehensively about the nature, scope and purposes of the processing of personal data when visiting our website, as well as about the rights to which you are entitled. This is based on Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications-Digital-Services-Data Protection Act (TDDDG).

1. Controller and Data Protection Officer

1.1 Controller within the meaning of the GDPR

The controller responsible for the processing of personal data on this website is:

GREENPEAK Management GmbH
Theatinerstraße 14
80333 Munich, Germany
Phone: +49 (0)89 9430 1091
E-mail: info@greenpeak-partners.com
Managing Directors: Daniel Beringer, Philipp Meyer, Oliver Frank
Commercial register: Munich Local Court, HRB 255371
VAT ID: DE329796822

GREENPEAK Management GmbH is licensed and supervised as an alternative investment fund manager (AIFM) pursuant to Section 20 of the German Capital Investment Code (KAGB) by the Federal Financial Supervisory Authority (BaFin).

1.2 Data Protection Officer

You can reach our Data Protection Officer using the following contact details:

Mr. Fabian Fromm
Projekt 29 GmbH & Co. KG
Ostengasse 14, 93047 Regensburg
Phone: +49 (0)941 298 6930
E-mail: anfragen@projekt29.de

If you have any questions about the processing of your personal data or wish to exercise your rights as a data subject, you may contact our Data Protection Officer directly at any time.

2. General Information on Data Processing

2.1 Scope

This privacy policy applies to the processing of personal data in connection with visits to the website www.greenpeak-partners.com and all functions accessible through it (e.g. contact form, careers portal, investor/data room access, embedded third-party content). For external content and platforms to which we merely provide links (in particular LinkedIn and other social networks), the privacy notices of the respective provider apply; we have no influence over their content or practices.

2.2 Definitions

In this privacy policy we use the terms defined in the GDPR. An explanation, in particular of “personal data” (Art. 4 No. 1 GDPR), “processing” (Art. 4 No. 2 GDPR), “controller” (Art. 4 No. 7 GDPR) and “processor” (Art. 4 No. 8 GDPR), can be found directly in Art. 4 GDPR.

2.3 Legal Bases of Processing

Insofar as we process personal data, this is done exclusively on the basis of one of the following legal bases:

  • Art. 6(1)(a) GDPR: consent of the data subject;
  • Art. 6(1)(b) GDPR: performance of a contract or implementation of pre-contractual measures;
  • Art. 6(1)(c) GDPR: compliance with a legal obligation (e.g. retention and identification obligations under commercial, tax or anti-money-laundering law);
  • Art. 6(1)(f) GDPR: protection of legitimate interests, provided these are not overridden by the interests or fundamental rights and freedoms of the data subject;
  • Section 25(1) TDDDG: for the storage of information on the end user’s terminal equipment or access to information already stored there (in particular cookies and comparable technologies); Section 25(2) TDDDG for storage/access that is strictly necessary.

Insofar as special categories of personal data (Art. 9 GDPR) are processed, this is done only on the basis of explicit consent or another permissible legal basis under Art. 9(2) GDPR.

2.4 Data Erasure and Retention Period

We process and store your personal data only for as long as necessary to achieve the purpose of the processing or as required by the legal provisions applicable to us. Of particular relevance are the retention periods under commercial law (Section 257 HGB: generally 6, 8 or 10 years – in particular 8 years for accounting vouchers such as invoices), tax law (Section 147 AO: up to 10 years, 8 years for accounting vouchers) and anti-money-laundering law (Section 8 GwG: 5 years, longer in certain cases). Once the purpose no longer applies and the retention periods have expired, the data is routinely deleted or anonymized.

2.5 Recipients and Processing on Our Behalf

Your personal data is transferred to third parties only on the basis of one of the legal bases set out above. We engage carefully selected processors (Art. 28 GDPR), for example for hosting, IT maintenance, e-mail dispatch, web analytics and applicant management, and have entered into the agreements required under Art. 28 GDPR with them. Recipients may also include advisors (lawyers, tax advisors, auditors), banks, supervisory authorities and affiliated companies, provided a legal basis exists.

2.6 Transfers to Third Countries

Personal data is transferred to countries outside the European Economic Area (third countries) only where this is necessary for the performance of a contract, a legal obligation exists, you have given your consent, or a legitimate interest applies. Insofar as the European Commission has not issued an adequacy decision under Art. 45 GDPR, we rely on appropriate safeguards under Art. 46 GDPR, in particular the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914 of 4 June 2021), supplemented, where necessary, by additional measures within the meaning of the case law of the CJEU (judgment of 16 July 2020, C-311/18“Schrems II”). For transfers to the USA, we may rely on the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023), provided the respective recipient is certified under the DPF. You may request a copy of the safeguards used from the contact details given above.

3. Provision of the Website and Creation of Server Log Files

Each time our website is accessed, our system, or the system of our hosting provider, automatically collects data and information from the computer system of the accessing device. The following data is collected in this process:

  • IP address of the requesting device (initially collected in full, then shortened or anonymized; see retention period);
  • Date and time of access;
  • Name and URL of the file accessed, together with the amount of data transferred;
  • HTTP status code (e.g. successful retrieval);
  • Referrer URL (the page previously visited);
  • Browser used, operating system and language setting.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in ensuring the stable, secure operation of the website, defending against attacks and investigating any misuse.

Further details can be found in the privacy policy of Mittwald: https://www.mittwald.de/datenschutz.

4. Cookies, Consent Management and Comparable Technologies

4.1 General Information

We use cookies and comparable technologies (e.g. local storage) on our website only to a limited extent. Cookies are small text files that are stored on your device. On our website they serve exclusively technically necessary purposes (for example storing your acknowledgement of the cookie notice and ensuring security). We do not use cookies or comparable technologies that require consent, and we do not use them for advertising, cross-site tracking or personalization.

4.2 Cookie Notice

When you first visit our website, a cookie notice informs you about the technologies used. Because we use only technically necessary cookies and, for reach measurement, a cookieless web analytics tool that does not require consent (see Section 9), we do not obtain consent via a consent management tool and do not set any cookies or comparable technologies that would require your consent.

Any information stored for the operation of the website, for example to remember that you have acknowledged the cookie notice, or for security purposes, is strictly necessary.

The legal basis for such strictly necessary storage is Section 25(2) No. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR. As we do not use technologies requiring consent, no consent pursuant to Section 25(1) TDDDG is obtained.

4.3 Categories

We use the following categories of cookies/technologies:

  • Technically necessary: cookies required for the proper operation of the website (e.g. storing your consent choices, security cookies).
  • Web analytics (Rybbit): operated without cookies and without storing information on your device; used without your consent on the basis of Art. 6(1)(f) GDPR (see Section 9).

As we use only technically necessary cookies together with a cookieless web analytics tool, no cookie settings or consent management are required. Further details on the web analytics can be found in Section 9.

5. Contact Form and E-mail Contact

If you contact us via the contact form or by e-mail, we process the data you provide (in particular name, e-mail address, company, telephone number, subject and message content) as well as the metadata of the transmission for the purpose of processing your inquiry and for any follow-up communication.

Legal basis: Art. 6(1)(b) GDPR for pre-contractual or contractual inquiries; otherwise, Art. 6(1)(f) GDPR (efficient handling of inquiries). Where you have expressly given your consent, the legal basis is Art. 6(1)(a) GDPR.

Retention period: We store your inquiry until the matter has been conclusively dealt with and no statutory or legitimate interests preclude further retention. Business correspondence (inquiries with a potential contractual connection) is retained for up to 6, 8 or 10 years pursuant to Section 257 HGB / Section 147 AO (in particular 8 years for accounting vouchers such as invoices).

6. Applications and Careers

If you apply to us, whether on your own initiative or for an advertised position, via our website, by e-mail or via an integrated applicant management system, we process the data you transmit to us (in particular master data, contact details, CV, references, cover letter, a photo if applicable, and other data voluntarily provided during the application process) exclusively for the purpose of conducting the application process.

Legal bases: Art. 6(1)(b) GDPR (decision on the establishment of an employment relationship and implementation of pre-contractual measures), supplemented by Section 26(1) BDSG in conjunction with Art. 88 GDPR as a national specification, as well as Art. 6(1)(f) GDPR (efficient applicant selection). Where you expressly consent to us retaining your documents beyond the specific process for future positions, Art. 6(1)(a) GDPR applies in addition. Insofar as we use an applicant management system, this is done on the basis of a data processing agreement pursuant to Art. 28 GDPR; selection criteria include in particular a server location within the EU/EEA or certification under the EU-U.S. Data Privacy Framework. We will inform you of the specific provider and its location upon request using the contact details given above.

CJEU Case Law on Employee Data Protection

In light of the decision of the Court of Justice of the European Union of 30 March 2023 (C-34/21) and the ongoing discussion in case law and legal literature regarding the scope of Section 26 BDSG, we additionally base the processing of employee data, where necessary, directly on Art. 6 GDPR.

Note on special categories of personal data: Please do not provide us with any special categories of data within the meaning of Art. 9 GDPR as part of your application, such as information on religion, trade union membership, ethnic origin or health, unless this is expressly required for the application process (e.g. severe disability within the meaning of Section 164 SGB IX). Should you nevertheless voluntarily provide us with such data, we process it on the basis of your explicit consent pursuant to Art. 9(2)(a) GDPR. For information on severe disability status, we additionally base the processing on Section 26(3) BDSG in conjunction with Section 164 SGB IX.

Retention period: If an application is unsuccessful, application documents are deleted no later than 6 months after conclusion of the application process; longer retention takes place only where necessary to defend against legal claims (in particular under the German General Act on Equal Treatment (AGG)) or where expressly requested by you. If an application is successful, the data is transferred to the personnel file.

7. Investor Portal and Virtual Data Room

Through our website, we provide authorized persons with access to a protected investor portal (accessible at https://icx.efrontcloud.com/@3230/greenpeakpartners/login.aspx) and, where applicable, to virtual data rooms in which we make information, reports and contractual documents available to investors, limited partners (LPs), business partners, targets and their advisors.

The provider and processor operating the investor portal on our behalf is Apex Fund Services (Germany) GmbH (formerly Mola-administration GmbH), Gertrudenstraße 9, 20095 Hamburg. The portal is provided via the eFront platform. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider. Insofar as personal data is processed on servers in a third country (in particular the USA), the safeguards described in Section 2.6 apply in addition, namely the Standard Contractual Clauses under Implementing Decision (EU) 2021/914, supplemented by the EU-U.S. Data Privacy Framework where the recipient is certified.

In connection with the use of the investor portal and the data rooms, we process in particular the following data: master and contact data, login data, role/function, permissions, access and activity logs (time of access, documents accessed, IP address) as well as any documents uploaded to the portal.

Purposes: providing the portal, authentication and ensuring authorized access, traceability of access (audit trail), fulfilment of statutory and contractual obligations towards investors (in particular under KAGB, AIFMD, GwG), and protection of the confidentiality of the information provided.

Legal bases: Art. 6(1)(b) GDPR (performance of contracts with investors and their authorized representatives), Art. 6(1)(c) GDPR (in particular Section 8 GwG, KAGB, FATCA/CRS), and Art. 6(1)(f) GDPR (security, audit trail, protection of trade secrets).

Recipients include in particular our portal/data room provider (processor), our management company (AIFM), depositary, administrator, auditors, legal and tax advisors, and, to the extent legally required, competent authorities (BaFin, tax authorities, FIU).

Retention period: Activity and access logs are retained for up to 12 months and then deleted, provided no retention obligations or indications requiring investigation of security incidents preclude this. Contract and investor data is retained in accordance with the retention periods under anti-money-laundering and tax law (generally 5 or 10 years).

8. Processing in Connection with Business Development: Deal Sourcing and Portfolio Management

As an investment company, we maintain business contacts with (prospective) investors, business partners, intermediaries, advisors, managing directors and shareholders of potential target companies, as well as with officers and key personnel of our portfolio companies. In this context, we process personal data, including data that we do not collect directly from the data subject but obtain from publicly available sources (e.g. company websites, commercial registers, business databases, LinkedIn, press releases) or from third parties (e.g. M&A advisors, data providers).

Categories of data: professional contact details (name, position, company, address, business e-mail/phone), professional background, role in transactions/portfolio companies, correspondence history, shareholding and remuneration information (where relevant), KYC/AML data.

Purposes: initiation, execution and maintenance of business relationships, deal sourcing, due diligence, investment administration and monitoring, compliance with statutory obligations (in particular GwG, tax and regulatory law), investor reporting, compliance.

Legal bases: Art. 6(1)(b) GDPR (initiation/performance of contracts), Art. 6(1)(c) GDPR (statutory obligations), and Art. 6(1)(f) GDPR (legitimate interest in efficient business development and execution, as well as in protecting our investments). Legitimate interests include in particular identifying suitable investment and business opportunities, actively managing our portfolio companies, and protecting against reputational and compliance risks.

9. Web Analytics and Reach Measurement

To statistically analyse and improve the use of our website, we use the open-source web analytics tool Rybbit. Rybbit is self-hosted on a server operated on our behalf; the analytics endpoint is reachable at insights.oeoe.de. The service is administered for us by oevermann & oevermann GmbH, Alte Bergstrasse 394, 86899 Landsberg am Lech, Germany, as our processor within the meaning of Art. 28 GDPR. The server is operated at IONOS with a location in Germany/the EU; IONOS acts as a further (sub-)processor. A data processing agreement pursuant to Art. 28 GDPR has been concluded with oevermann & oevermann GmbH.

In this context we process in particular the device and browser data transmitted with your request (e.g. browser type, operating system, language, screen size), the pages accessed, the time spent, and the referrer URL. IP addresses are not stored: the “collect IP address” option is deactivated and the IP address is truncated/discarded immediately. Rybbit is operated without cookies and without storing or reading information on your device. Visitors are distinguished by means of a pseudonymous identifier derived using a key that rotates daily (“user-ID salting”), so that no permanent, cross-day recognition of individuals takes place. This data is not combined with other data sources. Session recording (session replay) and user identification (identify/setTraits) are not used.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the needs-based statistical evaluation and improvement of our website. As no information is stored on or read from your terminal equipment, consent pursuant to Section 25(1) TDDDG is not required. You may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR); please use the contact details in Section 1.

On the analytics server, raw IP addresses may be stored temporarily in server log files and are deleted after one month at the latest. The analytics data itself is processed on servers located within Germany/the EU/EEA.

10. Integrated Third-Party Services

10.1 LinkedIn / Social Media Buttons

We provide links to our LinkedIn company page and, where applicable, to other social network profiles. We use exclusively simple, privacy-friendly links or a so-called “Shariff” solution; data is transmitted directly to the respective providers only once you actively click on the relevant icon. The provider of the LinkedIn platform is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.

Joint Controllership (Page Insights)

Insofar as we use insights/analytics functions for our company page, we process the personal data of visitors to our LinkedIn page jointly with LinkedIn Ireland Unlimited Company as “joint controllers” within the meaning of Art. 26 GDPR.

You can view the essential content of the joint controller agreement entered into for this purpose (Page Insights Joint Controller Addendum) at any time at https://legal.linkedin.com/pages-joint-controller-addendum. Under this agreement, LinkedIn Ireland assumes primary responsibility for fulfilling the obligations under the GDPR towards data subjects, including the handling of rights to access, rectification, erasure and objection in relation to Page Insights. You may therefore exercise your rights directly against LinkedIn Ireland; any requests we receive in this context will be forwarded to LinkedIn.

Further information on processing by LinkedIn can be found at https://www.linkedin.com/legal/privacy-policy.

10.2 Web Fonts and Content Delivery Networks

We use web fonts to display fonts and content. Insofar as we deliver fonts locally from our own servers, no personal data is transmitted to third parties in this process. Where external CDN services are used, the provider processes at least the IP address of your device. The legal basis, insofar as consent is required, is Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG; otherwise Art. 6(1)(f) GDPR.

11. Hosting of the Website

Our website is hosted by Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4-6, 32339 Espelkamp, Germany (hereinafter “Mittwald”). In connection with hosting, we process in particular IP addresses, access logs, contact inquiries, and meta and communication data. A data processing agreement pursuant to Art. 28 GDPR is in place with Mittwald. Further information can be found in Mittwald’s privacy policy at https://www.mittwald.de/datenschutz.

12. Data Security

We take appropriate technical and organizational measures (Art. 32 GDPR) to protect your personal data against unauthorized access, loss, alteration or disclosure. These include, in particular, comprehensive TLS encryption of the website, access controls, authorization and role concepts, regular security updates, logging of security-relevant events, backups, data protection and security training, and confidentiality obligations for our employees and service providers.

13. Use of Artificial Intelligence in Our Business Processes

We use artificial intelligence (AI) systems in selected internal work processes to support the creation, analysis and structuring of content, to increase the efficiency of our work organization, and to ensure the quality of documents and analyses. Personal data may also be processed in this context. We apply the principle of data minimization and enter only the information necessary for the respective purpose.

For these purposes, we use the following services as processors within the meaning of Art. 28 GDPR, each via enterprise accounts based on our contractual agreements with the providers, which include the respective data processing agreements:

  • “Claude”, provided by Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland (privacy@anthropic.com; DPO: dpo@anthropic.com)
  • Microsoft 365 Copilot, provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland
  • “Jamie”, provided by wespond UG (haftungsbeschränkt), Alte Kölner Straße 25a, 51503 Rösrath, Germany (privacy@meetjamie.ai), for the AI-supported transcription and summarization of meetings

Data entered is not used to train the AI models and is processed exclusively for the provision of the respective service. The use of AI does not change the legal basis of the underlying processing; the relevant legal bases are in particular Art. 6(1)(b) GDPR (performance of a contract), Art. 6(1)(c) GDPR (compliance with legal obligations, in particular under GwG, KAGB and tax law provisions), and Art. 6(1)(f) GDPR (legitimate interest in the efficient organization of our business processes). The interests and fundamental rights of data subjects are safeguarded through data minimization, contractual protective measures vis-à-vis the providers, and human validation of all results; automated decision-making within the meaning of Art. 22 GDPR does not take place.

Personal data may be transferred to the providers’ servers in third countries, in particular the USA. Transfers to Microsoft are based on the EU-U.S. Data Privacy Framework; transfers to Anthropic are based on the European Commission’s Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR (Module 2), supplemented by appropriate technical and organizational protective measures. Further information on data protection at the providers: anthropic.com/legal/privacy | privacy.microsoft.com

14. Automated Decision-Making and Profiling

Automated decision-making within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you does not take place on our website. Insofar as we carry out analyses of usage behavior, market data or investment opportunities, these do not serve to make individual decisions about data subjects.

15. Your Rights as a Data Subject

Subject to the statutory requirements in each case, you have the following rights vis-à-vis us:

  • Right of access (Art. 15 GDPR);
  • Right to rectification of inaccurate data or completion of incomplete data (Art. 16 GDPR);
  • Right to erasure (Art. 17 GDPR);
  • Right to restriction of processing (Art. 18 GDPR);
  • Right to data portability (Art. 20 GDPR);
  • Right to withdraw consent given, with effect for the future (Art. 7(3) GDPR);
  • Right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement.

15.1 Right to Object (Art. 21 GDPR): Important Notice

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR. We will then no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which overrides your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims. Where data is processed for direct marketing purposes, you have an unconditional right to object at any time.

15.2 Competent Supervisory Authority

The competent authority for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach (P.O. Box 1349, 91504 Ansbach), Phone: +49 (0)981 180093-0, E-mail: poststelle@lda.bayern.de, https://www.lda.bayern.de. An overview of all German supervisory authorities can be found at https://www.bfdi.bund.de/.

16. Obligation to Provide Personal Data

Unless expressly stated otherwise in the specific data collection situation, you are under no statutory or contractual obligation to provide us with your personal data. However, without this data we may be unable to fully process certain inquiries or contractual relationships. In establishing business relationships with (prospective) investors, statutory identification and cooperation obligations also apply (in particular under Sections 10 et seq. GwG and under tax law/FATCA/CRS).

17. Validity and Amendment of this Privacy Policy

This privacy policy is currently valid and dated August 2026. Due to the ongoing development of our website and offerings, or due to changes in legal or regulatory requirements, it may become necessary to amend this privacy policy. The current version of this privacy policy can be accessed at any time on our website at www.greenpeak-partners.com/privacy-policy.