Privacy Policy

1.1. This Policy applies to personal data collected through the Website and through correspondence that a Visitor initiates using the contact details published on the Website.

1.2. This Policy does not apply to third-party websites linked from the Website, whose own privacy statements should be consulted, nor to personal data processed in the course of the Company's business relationships (including with investors, portfolio companies, service providers and other counterparties), which is governed by separate notices or agreements.

2.1. The Visitor is not required to provide any personal data in order to browse the Website. The Company does not operate user accounts, subscriptions or payment functionality on the Website and does not collect account, billing or payment card data.

2.2. The Company may collect and process only the following limited categories of personal data: (a) Technical data — IP address, browser type and version, device and operating system details, referring page, pages viewed, and the date and time of access, which are recorded automatically by the Website's hosting infrastructure in server logs; and (b) Correspondence data — where the Visitor contacts the Company, the Visitor's name, email address, organisation and position (if provided), the content of the message and any attachments, and the Company's related correspondence.

2.3. The Visitor is requested not to send the Company any special categories of personal data (such as data concerning health, religious or political beliefs, or criminal records) or any confidential information of third parties.

2.4. The Website is not directed at persons under 18 years of age, and the Company does not knowingly collect their personal data. Should the Company become aware that such data has been received, it shall be deleted; notice may be given to info@bifrostia.com.

3.1. The Website uses only strictly necessary cookies and similar technologies required for the Website to be displayed correctly, to function securely and to balance server load. Such technologies do not require the Visitor's consent. The Website does not use advertising, profiling or cross-site tracking cookies.

3.2. Cookies may be managed or deleted through the Visitor's browser settings, although disabling strictly necessary cookies may impair the functioning of the Website. Should the Company introduce analytics or other non-essential cookies, this Policy shall be updated accordingly and the Visitor's consent shall be obtained where required by applicable law.

4.1. Personal data is processed solely in order to: (a) operate, maintain and secure the Website, and to detect and prevent misuse, attacks and other security incidents; (b) receive, review and respond to enquiries and correspondence sent by the Visitor; and (c) comply with legal and regulatory obligations and establish, exercise or defend legal claims.

4.2. Depending on the applicable law, such processing relies on: the Visitor's consent, which is given by voluntarily contacting the Company and providing the relevant data; the taking of steps at the Visitor's request; compliance with the Company's legal obligations; and, where recognised by applicable law (including the EU and UK General Data Protection Regulation), the Company's legitimate interests in operating and securing the Website and in handling correspondence.

4.3. The Company does not use personal data collected through the Website for direct marketing, does not engage in profiling, and does not employ automated decision-making producing legal or similarly significant effects.

5.1. Personal data may be disclosed, to the extent necessary for the purposes set out in Article 4, to: (a) service providers supporting the Website and the Company's communications (such as hosting, IT and email providers), bound by obligations of confidentiality and data protection; (b) the Company's professional advisers, including lawyers, auditors and corporate service providers; (c) entities affiliated with the Company, where necessary to handle the Visitor's enquiry; (d) courts, regulators and other public authorities, where required by law or in connection with the prevention or investigation of fraud or security incidents; and (e) a successor entity in the event of a reorganisation, merger or transfer of the Company's business.

5.2. The Company does not sell personal data and does not share it for advertising purposes.

6.1. The Company is established in the British Virgin Islands, and its service providers may be located in other countries. Where personal data is transferred outside the Visitor's country of residence, the Company shall ensure that such transfer is permitted under applicable law and, where required, is subject to appropriate safeguards, such as adequacy decisions or Standard Contractual Clauses.

7.1. Personal data is retained no longer than necessary for the purposes for which it was collected. Technical data in server logs is retained for a limited period consistent with ordinary security practice. Correspondence data is retained for as long as necessary to deal with the enquiry and any resulting relationship, and thereafter for such period as may be required by law or for the establishment, exercise or defence of legal claims, after which it is deleted or anonymised.

8.1. The Company applies appropriate organisational and technical safeguards to protect personal data against loss, misuse and unauthorised access, disclosure or alteration, including encrypted (HTTPS) connections to the Website, secure hosting environments and access restricted to authorised persons. No method of transmission over the internet is entirely secure, and the Company cannot guarantee absolute security.

9.1. Subject to applicable law, including the British Virgin Islands Data Protection Act, 2021 and, where applicable, the EU or UK General Data Protection Regulation, the Visitor may: (a) request access to and a copy of their personal data; (b) request correction of inaccurate or incomplete data; (c) request erasure of data, subject to the Company's legal obligations; (d) restrict or object to processing, including processing likely to cause damage or distress; (e) request data portability; and (f) withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

9.2. Requests may be addressed to info@bifrostia.com. The Company may request information necessary to verify the Visitor's identity and shall respond within the time limits prescribed by applicable law.

9.3. The Visitor may also lodge a complaint with the competent supervisory authority, including the Information Commissioner of the British Virgin Islands or, for residents of the EEA, the United Kingdom or Switzerland, the data protection authority of their country of residence.

10.1. The Company may amend this Policy to reflect legal, operational or technological developments. The current version, together with its "Last updated" date, shall remain available on the Website.

11.1. Enquiries concerning this Policy or the processing of personal data may be addressed to the Company at info@bifrostia.com, or by post to Bifrostia Holdings Ltd, Commerce House, Wickhams Cay 1, P.O. Box 2283, Road Town, Tortola, VG1110, British Virgin Islands.