Privacy Policy

This policy explains how Crowdbase Ltd uses personal data when you visit crowdbase.eu, register on the Crowdbase Platform, invest or raise funds through it, or are connected to someone who does.

Who we are

Crowdbase Ltd, company number HE 414264, of 6 Tefkrou, 4th Floor, 1066 Nicosia, Cyprus, is the controller of your personal data, which means it is responsible for it. You can contact us at [email protected].

What we use, why, and on what legal basis

Your account and our services. We use your name, contact details, date of birth, address, account details, orders, investments, payments and bank account details to open and run your account and provide our services, including your orders, investments and payments, any perks you ask for, and the records of them. We need this to perform our agreement with you.

Identity checks and anti-money laundering. We use your identity document, a photo or video of your face compared with it, your nationality, tax residence, occupation, the source of your funds and wealth, screening results, and device and IP information to verify your identity and prevent money laundering and terrorist financing. This covers identity checks, screening against sanctions, politically exposed persons and adverse media lists, a risk rating, checks on the source of your funds and wealth, ongoing monitoring, and reports to the authorities. The law requires it.

Our duties as a crowdfunding service provider. We use your test answers and results, the simulation result, categorisation information, complaints and correspondence for the entry knowledge test, the loss simulation, your categorisation as an investor, complaints, records, and reports to the Cyprus Securities and Exchange Commission (CySEC). The law requires it.

Checks on Project Owners. We use the name, role, ownership, identity and screening results of the directors, shareholders and beneficial owners of Project Owners, the companies that raise funds on the Platform, to carry out due diligence on them. The law requires it.

Publishing offers. A campaign page shows the name, role, photo and biography of the Project Owner's team members and, where a Crowdbase shareholder, manager or employee invests, their name, role and amount. The law requires the second, and for the first we rely on our legitimate interest in presenting offers fully.

Messages about your account. We use your contact details and account and investment information to tell you about your account, your investments and changes to offers. We need this to perform our agreement with you, and the law requires some of these messages.

Email news. We use your name, email address, your list choices and whether you open our emails to send you news on the lists you choose, such as campaign launches, investor updates and campaign updates. We do this only with your consent.

Website measurement and advertising. We use cookie and device information and, for logged-in users, the account details sent with usage events to measure visits to our website and advertise, as set out in our Cookie Policy. We do this only with your consent.

Security, improvement and legal claims. We use account, usage, device and error information to keep the Platform secure, prevent fraud, improve our services, and establish or defend legal claims. We rely on our legitimate interests in doing these things.

If Crowdbase can no longer operate. We use your account and investment information, and your name and email address, to continue or transfer our services under our Business Continuity Plan, and to let the Project Owners you invested in keep you informed. The law requires the first, and for the second we rely on the legitimate interest of investors in being kept informed.

Comparing your face with your identity document uses biometric data, and screening may show information about criminal offences. Our identity verification provider carries out these checks for us as part of what anti-money laundering law requires, and that law is what allows us to use this data.

Where the law or our agreement with you requires information from you, such as for identity verification, we cannot open or keep your account without it.

Automated decisions

Some approvals are automatic. When you open an account, the Platform checks your proof of address and whether your answers to the economic profile questionnaire make sense. Where these checks are clear, it may approve them without a person reviewing them. When you ask to be treated as a sophisticated investor, the Platform checks your answers against the criteria of the crowdfunding regulation and may approve your request in the same way. If any check is not clear, a member of our team reviews it. We never refuse, close or restrict an account by automated means alone. You can ask for a person to review any automated decision, give your view and contest it, by emailing [email protected].

Who we share it with

We share personal data only as far as each purpose needs, with:

• service providers who act on our instructions, for identity verification, payments, banking, hosting and storage, email and customer relationship management, error monitoring, document generation, internal alerts and AI tools;
• with your consent, analytics and advertising providers, as set out in our Cookie Policy;
• the Project Owner you invest in, and the nominee company where one holds the instruments for you, so that your instruments can be issued and recorded, distributions can be paid to you and they can meet their own legal obligations;
• the Project Owner offering a perk you ask for, which receives only what it needs to provide it, such as your name and email address;
• our auditors and professional advisers;
• CySEC, the Unit for Combating Money Laundering (MOKAS), tax authorities, courts and the police, where the law requires; and
• if Crowdbase can no longer operate, whoever continues our services, and the Project Owners you invested in.

We use AI tools from service providers to help us review documents you send us, such as a proof of address, and to translate messages. These providers act only on our instructions and do not use your data to train their models.

Transfers outside the European Union

Most of your personal data is stored in the European Union. Some of our service providers, including the AI tools, our document generation provider and some analytics and advertising providers, are based in the United States or process data there. We use them only where the provider is certified under the EU-US Data Privacy Framework or has agreed to the European Commission's standard contractual clauses. You can ask us for a copy of these safeguards. Our identity verification provider is based in the United Kingdom, and some of its sub-processors process data there or in Canada. The European Commission has decided that both countries protect personal data adequately.

How long we keep it

We keep your personal data for 5 years after our relationship with you ends or, if you never became a client, after your last contact with us. We keep it longer only where a law or a legal dispute requires it. We keep your email list choices until you change them, and cookies last as set out in our Cookie Policy.

People we do not deal with directly

If you are a director, shareholder, beneficial owner or representative of a Project Owner or of a company that invests through Crowdbase, or a team member shown on a campaign page, we receive your personal data from that company. For our checks, we also receive results from public registers and screening databases. The data is of the kinds described above, and we use and keep it as this policy describes.

Your rights

You have the right to:

• access your personal data;
• have it corrected;
• have it erased;
• restrict how we use it;
• receive it in a portable form; and
• withdraw your consent at any time, through the unsubscribe link in any of our emails or through "Cookie settings" at the bottom of every page. Withdrawing does not affect our use of your data before then.

You can also object at any time to our use of your personal data based on legitimate interests. We will then stop, unless we have compelling grounds or need it for legal claims.

Some rights are limited where the law requires us to keep data, for example under anti-money laundering law.

To use any of these rights, email [email protected]. You can also complain to the Commissioner for Personal Data Protection in Cyprus (www.dataprotection.gov.cy) or to the data protection authority where you live or work.