Privacy Policy

This policy explains what personal data we process when you visit this website or contact us, why we process it, on what legal basis, and what rights you have. Personal data means any information relating to an identified or identifiable natural person within the meaning of Art. 4 (1) GDPR.

Controller

The controller responsible for the processing described here is:

Represented by Christopher Weiland. For any question about this policy, and to exercise any of the rights described below, write to privacy@paua.capital.

We have not appointed a data protection officer, as we are not required to do so under Art. 37 GDPR or § 38 BDSG.

Personal Data We Collect

We collect personal data in two situations: when you visit this website, and when you contact us.

When you visit this website: The site is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, United States, acting as our processor under Art. 28 GDPR. Each time a page is requested, our host automatically records:

• your IP address
• the date and time of the request
• the page or file requested
• the HTTP status code and the volume of data transferred
• the page you came from
• your browser type and version, and your operating system

This data is technically necessary to deliver the page to you, and we process it on the basis of Art. 6 (1) (f) GDPR. Our legitimate interest lies in operating the site reliably and securely, and in detecting and defending against attacks and misuse. We do not combine it with other sources and do not use it to identify individual visitors.

When you contact us: You can reach us through the contact form on this website or by writing to us directly by email. The form asks for:

• Required: your name and email address, a subject and a message.
• Optional: your company name, company website, and any attachments you choose to add.

We process what you send us to read and answer your inquiry and to handle any follow-up correspondence. Where your inquiry concerns an existing or prospective business relationship, the legal basis is Art. 6 (1) (b) GDPR, as the processing serves to take steps at your request prior to entering into a contract. In all other cases we rely on Art. 6 (1) (f) GDPR, our legitimate interest in responding to inquiries addressed to us.

Providing this data is required neither by statute nor by contract, and you are under no obligation to provide it; without the required fields, however, we cannot receive or answer your inquiry. Please do not send us special categories of personal data within the meaning of Art. 9 GDPR, or personal data concerning other people, unless it is genuinely necessary for your inquiry.

A message submitted through the form passes through three providers before it reaches us, each acting on our behalf and on our instructions as a processor under a data processing agreement in accordance with Art. 28 GDPR:

• Vercel Inc. receives the submission, as the host of this website.
• Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, forwards it as email through Amazon Simple Email Service (SES).
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, provides the Google Workspace mailbox in which we receive and keep the message, and may in turn engage Google LLC in the United States and other companies in the Google group as sub-processors.

An email you write to us directly reaches the same mailbox without passing through Vercel or Amazon SES.

To protect the form against automated submissions, it carries a field that is hidden from you and records how long the page had been open when you submitted it. A submission that fills the hidden field, or that arrives implausibly quickly, is discarded. The legal basis is Art. 6 (1) (f) GDPR, our legitimate interest in keeping the form free of spam and abuse. Nothing is stored on your device for this purpose.

Email sent over the internet without additional encryption cannot be fully protected against being read by third parties. For confidential matters, please write to us by post or ask us to agree an encrypted channel with you.

Cookies and Tracking

This website sets no cookies and stores no information on your device beyond what your browser caches automatically in order to display the pages. No consent under § 25 TDDDG is therefore required, and there is nothing for you to accept or decline. Our Cookie Policy explains this in more detail.

Website analytics: To understand how this website is used, we use Vercel Web Analytics, a service of Vercel Inc., the host named above and our processor under Art. 28 GDPR. It records one entry for each page view, comprising:

• the date and time of the request
• the page requested, including any query string, and the page you came from
• an approximate location derived from your IP address, no more precise than country, region and city
• your device type, operating system and browser, each with its version

No cookie is set for this purpose and nothing is stored on your device. Your IP address itself is not stored: it is used to derive the approximate location and, together with your browser’s request headers, to compute a hash that lets the service count repeat page views as one visit. That hash is discarded after 24 hours and cannot be traced back to you. We see the results only in aggregate, and neither we nor the service can use them to identify you, to recognize you on a later visit, or to follow you to other websites.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in understanding which of our pages are read and how visitors reach them, so that we can maintain and improve the site. You may object to this processing at any time under Right to Object below.

Beyond this, this website uses none of the following:

• tracking pixels or session recording
• advertising, retargeting or affiliate networks
• social media plug-ins or share buttons
• embedded third-party content such as maps, videos or chat widgets
• externally hosted fonts: our typefaces are served from our own servers, so displaying a page establishes no connection to a font provider

We do not profile you, and no automated decision-making within the meaning of Art. 22 GDPR takes place.

Recipients and Transfers

Apart from the processors named above, we do not disclose your personal data to third parties, unless we are legally required to do so, or disclosure is necessary to establish, exercise or defend legal claims.

Vercel Inc. and Google LLC are established in the United States, and Amazon Web Services may transfer data to its parent company there. Vercel, Amazon Web Services and Google are each certified under the EU–U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023, so transfers to them take place on the basis of Art. 45 GDPR. Where a transfer is not covered by that decision, it takes place on the basis of the European Commission’s Standard Contractual Clauses under Art. 46 (2) (c) GDPR. You may request a copy of the safeguards in place from privacy@paua.capital.

Retention

We retain personal data for as long as is necessary for the purposes set out in this policy, for as long as we may need it to establish, exercise or defend legal claims (Art. 6 (1) (f) GDPR), and for as long as statutory retention obligations require. In more detail:

• Server logs: our host retains the request data described above for 24 hours, after which it is deleted automatically.
• Analytics: the hash described above is discarded after 24 hours. What remains of the analytics data from then on is aggregate statistics that relate to no identifiable person, and we keep it for a reporting window of 12 months.
• Correspondence: we keep your inquiry, any attachments and the correspondence that follows from it for as long as is necessary to deal with it, and thereafter for as long as statutory retention obligations require.

Where commercial or tax law requires us to retain correspondence and business records, in particular under § 257 HGB and § 147 AO, we keep the data for the period prescribed and restrict our processing of it to complying with that obligation, without otherwise using it; the legal basis is Art. 6 (1) (c) GDPR. For commercial and business letters that period is six years, counted from the end of the calendar year in which the letter was received or sent. Once the purpose no longer applies and no retention obligation remains, we erase the data.

Your Rights

You have the following rights regarding the personal data we hold about you:

• Access (Art. 15 GDPR): to obtain confirmation of whether we process data concerning you and, if so, a copy of that data together with the accompanying information.
• Rectification (Art. 16 GDPR): to have inaccurate data corrected and incomplete data completed.
• Erasure (Art. 17 GDPR): to have your data deleted where one of the grounds set out in that article applies.
• Restriction (Art. 18 GDPR): to have our processing limited in the cases listed there.
• Portability (Art. 20 GDPR): where processing rests on your consent or on a contract and is carried out by automated means, to receive the data you provided in a structured, commonly used and machine-readable format, and to have it transmitted to another controller.
• Withdrawal of consent (Art. 7 (3) GDPR): where processing rests on your consent, to withdraw it at any time with effect for the future, without affecting the lawfulness of the processing carried out beforehand.

To exercise any of these rights, write to privacy@paua.capital. Exercising them costs you nothing.

Right to Object

Where we process personal data concerning you on the basis of Art. 6 (1) (f) GDPR, you have the right under Art. 21 (1) GDPR to object to that processing at any time on grounds relating to your particular situation. If you object, we will stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. We do not process personal data for direct marketing purposes. An objection needs no particular form; write to privacy@paua.capital.

Right to Lodge a Complaint

Without prejudice to any other remedy, you have the right under Art. 77 GDPR to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

Data Security

We maintain technical and organizational measures appropriate to the risk, as required by Art. 32 GDPR, to protect personal data against accidental or unlawful destruction, loss, alteration, and unauthorized disclosure or access. This site is served exclusively over an encrypted TLS connection.

Changes to This Policy

We may amend this policy to reflect changes to this website or to the legal requirements that apply to it. The version published here is the one that applies to your visit.