Privacy Policy

Introduction

As used in this Privacy Notice, “Virida Capital Management” refers to Virida Capital Management B.V.. When used in this Privacy Notice, “Virida Capital Management”, “we”, “us” and “our” refer to Virida Capital Management as a group. Virida Capital Management B.V. is a private company with limited liability (besloten vennootschap met beperkte aansprakelijkheid) organised and existing under the laws of the Netherlands and registered with the trade register of the chamber of commerce in the Netherlands under number 94299900. Its registered office and principal place of business is at Plompetorengracht 19, 3512 CB Utrecht, the Netherlands. Virida Capital Management B.V. is the fund manager of Virida Capital I Coöperatief U.A.

Any reference to “you” in this Privacy Notice refers to you as business partner, supplier or investor in one of the funds management by Virida Capital Management.

Some definitions

Data Controller: an entity that determines the purposes, conditions, and means of processing personal data. Virida Capital Managementis regarded as the Data Controller for as business Partner, clients and suppliers.

GDPR team: the responsible team within Virida Capital Management for the personal data protection policies and procedures and making sure that Virida Capital Management is acting in accordance with all personal data protection regulations. If you have any questions or concerns relating to your personal data, please contact the GDPR team via the contact details stated in the section “Contact” below.

Updates to this Privacy Notice

We may unilaterally change or update this Privacy Notice by amending this page, so make sure you check this page from time to time. If there are substantive adjustments made to this Privacy Notice, a clear notification will be made available on our website.

Contents of this Privacy Notice

In this Privacy Notice we explain:

• what personal data we collect;
• for what purposes and on what grounds we process your personal data;
• how long we retain your personal data;
• who we share your personal data with;
• how your personal data is protected;
• the rights you have as data subject;
• how you can contact us.

Personal data we collect

Personal data is any information relating to an identified or identifiable natural person. Personal data that we process may include:

• Basic information such as your first and last name, prefix, title;
• Contact details such as your e-mail address, postal address and phone number;
• Personal data you provide us for the purpose of attending events or meetings;
• Any other personal data relating to you which you may provide us or that we may obtain in relation to the purposes and based on grounds set out below.

Purposes and legal basis for the processing of personal data

We collect this personal data because you provided this data to us. For example, you may provide personal data when entering into a contract or agreement with us, by entering your data on our website or by giving us your business card. We may also collect your personal data from other sources, such as counterparties we do business with, the Trade Register or by using publicly available sources. In some cases, you will have previously provided your personal data to Virida Capital Management.

Virida Capital Management may process your personal data where we need it for a specific purpose. We set out in the table below the ways in which we plan to use your personal information. We are only able to use your personal information if we have a proper legal reason or basis for doing so. This is called a legal basis and the regulations require that we have a legal basis so that your privacy is protected.

Most commonly we will use your information in the following ways:

• We have a contract directly with you. For example, Virida Capital Management B.V. manages Virida Capital I Coöperatief U.A. (Virida I Fund) in which you are an investor in accordance with the constitutional documents of Virida I Fund or you have concluded a limited partnership agreement with us and/or Virida I Fund.
• We have a contract with the company you represent and have a legitimate interest to process your information. For example, we manage a fund for which you act as a representative and need to process your personal data to conclude and execute the agreement and manage the investments on behalf of the company
• We have a legal obligation. We need to use your personal information to comply with laws that assist in the prevention of financial crime and to comply with regulatory obligations. For example this might include confirming your identity and source of wealth, as well as ensuring we provide you with necessary information so you understand the risk of the financial services we can provide.
• We receive your consent: for example in the case you agree to receive newsletters from us.
• We, or a third party, have a legitimate interest in processing the information and your interests and fundamental right do not override those interests. For example, processing your information to source deals.

We set out in the table below all the ways we plan to use your personal information and the legal bases we rely on to do so. We also explain what our legitimate interests are where appropriate:

Purpose	Lawful basis for processing (including our legitimate interests)
To facilitate investment into our funds and co-investment opportunities and comply with our obligations as manager as set out in the constitutional documents of the funds	To fulfil our contact with investors (legitimate interest)
To facilitate investment into portfolio companies and provide advice and assistance to help our portfolio companies grow	To fulfil our investment agreements with management companies (contractual obligations)
To acquire and exit investments	To fulfil the purchase or sale agreement (contractual obligations)
To purchase services from our suppliers	To fulfil our contracts with suppliers (contractual obligations)
To comply with our KYC and customer due diligence obligations	To fulfil our regulatory obligations (legal obligation)
We process the personal data of a wide variety of business contacts for the purposes of conducting key parts of venture capital business, such as fundraising, generating deal flow, and recruiting management teams	Necessary for our legitimate interests – to conduct the business of a venture capital fund manager (legitimate interest)

Retention period

As a fund manager Virida Capital Management will typically have a contract with you and will need to keep your personal information (updated to ensure accuracy) to fulfil our contract. We also need to comply with EU and Dutch law, which often requires us to keep certain records – which will include certain personal information – for several years.

In general, we shall keep personal data related to any contracts with you or the company you represent and investments during the lifecycle of the contract or Investment and for 7 years after termination thereof.

Our policy is to keep records on prospective investors, management teams and other business contacts for a period of 5 years after our last contact or sooner if you inform us that we may no longer store your personal data for these purposes.

We may wish to contact long standing contacts about a particularly relevant opportunity in the future, and in the context of venture capital and private equity business there is no way to predict when such an opportunity might arise.

We will ensure all records are safely destroyed if we no longer need to retain them. We review our retention periods for personal information on a regular basis. We will tell you if we change the retention period.

The aforementioned retention periods may be extended in the event that this is necessary in order to safeguard our legal position or to defend our rights, e.g. in the event of a legal dispute or where necessary to determine, defend or exercise our legal rights and position.

Sharing with others

Virida Capital Management may share your personal data with any company belonging to the Virida Capital Management group for the purposes described in this Privacy Notice.

In some cases we may also share your personal data with third parties. For example, we may need to provide information to assist in the detection or prevention of crime or for the purpose of safeguarding national security. Please refer to the table in the section ‘How we will use your personal  information’ which explains how we use your data. The third parties we may share your personal data with are as follows:

• The funds you are invested in;
• Our service providers such as accountants, fund administrators, compliance consultants, professional advisers and lawyers;
• The investment opportunities to which Virida Capital Management (envisages to), on behalf of the Virida I Fund makes any capital commitment;
• Regulatory authorities (such as tax authorities, financial intelligence units and supervisory authorities), competent courts, governmental bodies.

We will only transfer your personal data to the above mentioned third parties for the purposes and on the legal grounds stated in this Privacy Notice.

To the extent that a third party processes your personal data as a data processor of Virida Capital Management, Virida Capital Management will conclude a processor agreement with such party that meets the requirements set out in the EU GDPR.

If you wish to receive a list of third parties with whom we share your personal data with, please contact forgetme@virida-capital.com.

Security & automated decision making

Virida Capital Management has taken technical and organisational measures to ensure an appropriate level of security to protect your personal data from unauthorised or unlawful processing and from loss, destruction, damage, alteration or disclosure. Examples of such measures include:

• Physical security of access to our offices and floors
• Your data is stored on servers in controlled, secure environments
• A range of data flow detection and prevention methods
• Restrictions on connecting non-approved devices to the Virida Capital Management network
• Regular training of our employees on data protection and privacy matters

In addition, we limit access to our personal data to those employees, contractors and other third parties who have a need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.

We have procedures to deal with any suspected data security breaches and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

We do not use any automated processes to make decisions about you without human intervention.

If you have any questions regarding the security of you personal data, or if there are indications of misuse, please contact forgetme@virida-capital.com.

Your rights

You, as a data subject, have a number of legal rights:

• The right of access, this means you can make a request to obtain access to the personal data concerning you;
• The right to rectification or correction of your personal data if it is inaccurate or incomplete;
• The right to erasure of the personal data that relates to you. Please note that there may be circumstances in which we are required to retain your data in order to meet our legal and regulatory obligations;
• The right to object to or to request restriction of the processing;
• The right to data portability. This means that you have the right to receive your personal data in a structured, commonly used and machine-readable format, and that you have the right to transmit that data to another controller;
• The right to object to profiling and automated decision making without human intervention;
• The right to lodge a complaint with a supervisory authority;
• The right to withdraw your consent.

If you wish to exercise one or more of the abovementioned rights, kindly send an email to forgetme@virida-capital.com.

For certain personal information requests, we must first verify your identity before processing your request. To do so, we may ask you to provide us with your full name, contact information, and relationship to us. Depending on your request, we may ask you to provide additional information. Once we receive this information, we will then review it and determine whether we are able to match it to the information we maintain about you to verify your identity. In order for us to efficiently handle your request we kindly ask you to provide as much detail about the nature of your request and where relevant, to what processing activities the request sees. We aim to get back to your request within 30 days upon receipt of the request.

Contact

If you have any questions, comments or complaints in relation to this Privacy Notice or the processing of your personal data by Virida Capital Management, please feel free to contact your regular contact within our firm or our GDPR team via forgetme@virida-capital.com.

You also have the right to lodge a complaint with the supervisory data protection authority in your country of residence, place of work or in the country where an alleged breach of data protection law has occurred. The data protection authority in the Netherlands is Autoriteit Persoonsgegevens and can be contacted through the following website: https://autoriteitpersoonsgegevens.nl/.