How we handle your data.
Venture Vault Capital AB is the data controller for the information you share with us. Here we explain what we collect, why, and the rights you have under GDPR.
Last updated: 11 June 2026 · Effective from: 16 June 2026
Venture Vault Capital AB
Registration number: 556597-2824
Stortorget 13 B, 211 22 Malmö, Sverige
Email: info@vvcapital.se
Phone: 040-13 10 50
Venture Vault Capital AB is not a financial institution and is not subject to the Swedish Financial Supervisory Authority. We invest our own capital and are owned by Venture Vault Holding AB.
We process personal data for the following purposes:
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Managing investor relationships and agreements | Performance of contract (6.1 b) |
| Sending investor portal login links | Performance of contract (6.1 b) |
| Digital document signing via Scrive | Performance of contract (6.1 b) |
| Calls and follow-up with investors | Legitimate interests (6.1 f) |
| Handling enquiries from prospective investors | Legitimate interests (6.1 f) |
| Accounting and tax obligations (7 years) | Legal obligation (6.1 c) |
| Security, access logging and fraud prevention | Legitimate interests (6.1 f) |
Depending on your relationship with us, we may process the following categories:
- Identity data: first and last name, Swedish national identity number (personnummer)
- Contact data: email address, phone number, postal address
- Financial data: bank account number, custody account, invested amount, share holdings
- Communications: email correspondence synced via Gmail, call recordings and transcripts
- Signatures: digitally signed agreements via Scrive
- Technical data: IP address, browser type, login timestamps
- Activity log: document views and profile updates in the investor portal
The Swedish national identity number (personnummer) is processed under Chapter 3, Section 10 of the Swedish Data Protection Act (2018:218) and only to the extent required by contract or legal obligation.
We engage the following data processors. All processors are bound by written data processing agreements (DPAs) and may only process data according to our instructions.
- Service
- Email synchronisation
- Data
- Email addresses, email content, attachments
- Location
- USA
- Basis
- EU Standard Contractual Clauses (SCC)
- Service
- Digital document signing
- Data
- Name, email address, national ID, signed agreements
- Location
- Sweden / EU
- Basis
- Data Processing Agreement, GDPR-compliant
- Service
- Telephony and call recording
- Data
- Phone numbers, call recordings, call metadata
- Location
- Sweden / EU
- Basis
- Data Processing Agreement, GDPR-compliant
- Service
- Transactional email (login links, notifications)
- Data
- Email address, send timestamp
- Location
- USA
- Basis
- EU Standard Contractual Clauses (SCC)
- Service
- Web hosting and infrastructure
- Data
- IP address, HTTP requests, cookies
- Location
- USA / EU (region choice)
- Basis
- EU Standard Contractual Clauses (SCC)
| Data type | Retention period |
|---|---|
| Investor agreements and financial documents | 7 years (Swedish Bookkeeping Act) |
| Investor profile and contact details | Contract period + 2 years |
| Email correspondence | 2 years from last activity |
| Call recordings and transcripts | 12 months |
| Login logs and access logs | 12 months |
| Enquiries (non-investors) | 12 months |
| Inactive accounts (soft-deleted) | Permanently deleted after 2 years |
The Swedish Bookkeeping Act (SFS 1999:1078) requires accounting records to be kept for 7 years. This legal obligation overrides the right to erasure for that category of data.
Under GDPR you have the following rights. Submit your request to info@vvcapital.se with the subject line "Data Rights". We will respond within 30 days.
- Right of access (art. 15) — You can request a copy of all data we hold about you, compiled as a PDF document.
- Right to rectification (art. 16) — You can ask us to correct inaccurate data.
- Right to erasure (art. 17) — You can request deletion of your data. Note that we may need to retain certain records under the Bookkeeping Act (7 years).
- Right to data portability (art. 20) — You can request your data in a machine-readable format (JSON/CSV in a zip file).
- Right to object (art. 21) — You can object to processing based on legitimate interests.
- Right to restriction (art. 18) — You can request that we restrict processing while a matter is under review.
If you believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY):
Integritetsskyddsmyndigheten (IMY)Box 8114, SE-104 20 Stockholm, Sweden
www.imy.se/en · imy@imy.se
For questions about this policy or how we process your data:
Investors with an active portal session can request data export and deletion directly via the investor portal.