Effective: 1 January 2026 · Last updated: 1 August 2026
1. Data controller
Capital Investing Ventures a.s., Company ID (IČO): 099 85 824, VAT ID: CZ09985824 (VAT payer), with registered office at Václav Havel Airport, Aviatická 1092/8, 161 00 Prague 6, Czech Republic, registered with the Municipal Court in Prague, Section B, Insert 26143 (the "Controller"). Contact: office@civ-capital.com.
2. Scope of data processed
- identification and contact details (name, surname, e-mail, phone, address)
- asset data (e.g. bond ISIN, land parcel numbers, company registration numbers)
- data disclosed during communication and in documents provided
- technical data when visiting the website (IP address, browser type — see Cookies)
3. Purposes and legal bases
- assessment and completion of asset acquisition (Article 6(1)(b) GDPR — performance of a contract)
- communication with the client and advisory services (legitimate interest)
- compliance with legal obligations (accounting, AML, tax)
- sending commercial communications to our own customers (legitimate interest, may be opted out of)
4. Retention period
We retain data for the duration of the contractual relationship and thereafter for the period required by law (generally 10 years for accounting records, 5 years for AML records).
5. Recipients of data and third-country transfers
Human access to personal data in our CRM and internal systems is limited to the Controller's EU-based staff and contractors. No personnel outside the EU have human access to personal data.
To operate the website, the application and certain features (e.g. automated classification of enquiries in the CRM, bond scoring, support for drafting legal documents, and diamond portfolio suggestions), we use technical processors and sub-processors, some of which process data outside the European Economic Area. We therefore cannot state that data never leaves the EU — for the technical sub-processors listed below, data is transferred to a third country to the extent necessary for the relevant feature, always on the basis of an appropriate transfer mechanism.
| Recipient | Country | Role | Data categories | Purpose | Transfer mechanism | DPA status | Retention |
|---|---|---|---|---|---|---|---|
| Lovable (application platform / hosting) | EU | processor | all data processed by the application (hosting/runtime) | operation of the web application and its infrastructure | intra-EU data processing agreement | in place | for the duration of the contractual relationship with the Controller |
| Supabase Inc. | United States (provider's registered seat); processing infrastructure | processor | database, authentication, stored files | storage and management of CRM data, client accounts and documents | Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914 and supplementary safeguards | in place | for the duration of the contractual relationship with the Controller |
| OpenAI (via the Lovable AI Gateway) | United States | sub-processor | text of enquiries and documents submitted for automated processing (CRM classification, scoring, legal drafting support) | AI classification in the CRM, bond scoring, support for drafting legal documents | Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914 and supplementary safeguards (we could not verify an EU-US DPF certification for this specific sub-processor, so none is claimed) | in place at the Lovable AI Gateway level | only for the time necessary to process the request; no persistent storage at the model provider |
| Google (Gemini, via the Lovable AI Gateway) | United States | sub-processor | text of enquiries and documents submitted for automated processing (CRM classification, legal document cross-check, diamond portfolio suggestions) | AI classification in the CRM, legal document cross-check, diamond portfolio suggestions | Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914 and supplementary safeguards (we could not verify an EU-US DPF certification for this specific sub-processor, so none is claimed) | in place at the Lovable AI Gateway level | only for the time necessary to process the request; no persistent storage at the model provider |
You may request a copy of the safeguards applied to any third-country transfer of your personal data (in particular the applicable Standard Contractual Clauses) by e-mail at office@civ-capital.com.
Aside from the technical processors above, we disclose data only to vetted EU-based processors (legal counsel, tax advisors, auditors) under a data processing agreement.
5.1 Referral to the authorised financing provider
If you submit an enquiry relating to property-secured financing, the recipient of your data may be Bona Fit, a.s., company ID 03305163, a non-bank consumer credit provider authorised by the Czech National Bank.
Purpose of the transfer: contacting the enquirer, the provider's own independent assessment of the enquiry and the possible preparation of a financing offer. Categories of data transferred: identification and contact details (name, e-mail, phone, and where applicable company name and company ID), the indicative amount and purpose, basic situational information about the property (type, location, indicative value, encumbrances, enforcement) and the description you provide.
Data is transferred solely on the basis of your prior explicit consent given in the form; each transfer is separately approved by an authorised person of Capital Investing Ventures a.s. and recorded in an audit trail. Without consent no transfer takes place. You may withdraw your consent at any time with future effect at office@civ-capital.com.
After the transfer, the provider processes your data as an independent controller under its own privacy policy: provider's personal data processing information.
6. Your rights
You have the right to access, rectify, erase, restrict processing, port your data and object to processing. Send your request to the e-mail address above. You also have the right to lodge a complaint with the Office for Personal Data Protection (uoou.cz).
7. Security
We apply reasonable technical and organisational measures (encrypted transmission, controlled access, backups). All communication takes place over TLS.