1. Controller

1.1.The controller of personal data (in the terms of the Ukrainian Law, the “owner of personal data”) is the Operator: Charity Organization “Charity Fund Come Back to Us”, identification code (EDRPOU) 45019404, Ukraine, registered address: 17 Kovpaka St, Kyiv 03150, Ukraine.

1.2.Contact for personal data matters: compliance [at] eurobridge [dot] online. Data protection officer / person responsible for personal data protection: to be appointed.

1.3.When an Investor and an Initiator exchange personal data through the Platform (for example contact details after the NDA or documents in a Deal Room), each of them acts as an independent controller of the data it receives. A Partner Bank that provides Escrow processes data as an independent controller under its own privacy notice.

2. Information We Collect

We may collect and process the following categories of personal and business information:

2.1.We do not intend to process special categories of personal data (art. 7 of the Ukrainian Law, GDPR art. 9) or data on criminal convictions. Please do not upload such data to Listings or Deal Rooms unless strictly necessary and lawful; sanctions screening results may incidentally contain such information about matched persons.

2.2.Documents you upload to the Platform (for example to a Listing or a Deal Room) are used only for the purpose for which they were provided (moderation, checks, assessment under the methodology, exchange with the counterparty in a Deal) and are not disclosed to outside parties except where necessary to provide the requested service, to comply with the law or with your consent.

2.3.Where we obtain data not from you (for example lead data or data of beneficial owners declared by an Organisation), we inform the persons concerned in accordance with art. 12 of the Ukrainian Law and GDPR art. 14, at the latest at the first contact; every invitation contains a link to opt out of further invitations.

3. Purposes of Processing

We use personal data and confidential information for the following purposes:

• to create, manage and maintain your Account and your Organisation’s profile;
• to verify identity, authority, Investor status (including the corporate domain), Project status or business credentials — within moderation and Verification Levels;
• to connect Investors, Initiators, Public Partners, strategic partners, institutions, advisers, donors and other participants through the Platform;
• to provide contact details to counterparties only where necessary for the Deal workflow (in particular after the NDA is concluded) or with your consent;
• to moderate Projects, investment opportunities, partnership proposals and related materials, and to calculate the EUROBRIDGE Score;
• to carry out compliance checks: sanctions and PEP screening, registry checks, cooperation with the Partner Bank’s KYC procedures, fraud prevention and risk management;
• to send service communications about your Account, Projects, Inquiries and Deals, moderation, changes to the legal documents, legal notices and technical support;
• to send reminders, saved-search alerts and watchlist digests — with one-click unsubscribe;
• to send newsletters, Platform announcements and event invitations — only with your consent; to invite businesses and participants in PPP opportunities found in public sources to join the Platform — with the option to opt out;
• to invoice Subscriptions and the Platform Fee, and for accounting and tax purposes;
• to keep the Legal Event Log, the Deal Room access log and watermarks as evidence and to protect confidentiality;
• to improve the functionality, usability, security and quality of the Platform, including through analytics (only with consent);
• to enforce the Terms of Use, agreements and Platform rules; to resolve disputes, respond to lawful requests, protect rights, prevent prohibited or unlawful activity and ensure the security of the Platform and its Users;
• to produce aggregated, anonymised data (including statistics by sector and region, market trends and the recovery dashboard) that do not identify anyone.

4. Legal Bases for Processing

Depending on the purpose, we process personal data on one or more of the following legal bases (art. 11 of the Ukrainian Law, GDPR art. 6):

• your consent;
• the conclusion and performance of a contract (the Terms of Use) or steps taken at your request before entering into it;
• compliance with a legal obligation;
• legitimate interests of the Operator or third parties, provided they are not overridden by your rights and freedoms — in particular protection against fraud, abuse, security threats and unlawful conduct.

Purposes, data and legal bases:

4.1.Where processing is based on legitimate interests, you may object to it (section “Your Rights”). Where it is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

4.2.Providing data marked as required in the forms is necessary to conclude and perform the contract (the Terms of Use); without them we cannot create an Account or process a Listing or Deal.

5. Automated Decision-Making

5.1.We do not take decisions that produce legal effects concerning you, or similarly significantly affect you, based solely on automated processing. The EUROBRIDGE Score is set by a moderator; sanctions-screening matches are decision support and are always reviewed by Staff before any action.

6. Sharing of Information, Recipients and Processors

6.1.We do not sell your personal data and do not use it for third-party advertising.

We share personal data only as necessary for the purposes above, in the following cases:

• Other Users and counterparties — the public part of a Listing is visible to everyone; an Investor’s Organisation and contact details are disclosed to the Initiator, and the Initiator’s contacts to the Investor, according to the Deal workflow (in particular after the NDA), where necessary to provide the requested service, assess an opportunity or proceed with a transaction or partnership. An Investor’s profile is never public.
• Staff, authorised employees and affiliates of the Operator bound by confidentiality, on a need-to-know basis.
• Processors — contractors and service providers acting on our instructions under data processing agreements (GDPR art. 28) and confidentiality obligations: hosting and database, object storage, e-mail delivery, analytics and the other providers listed below.
• Partner Bank — where the parties choose Escrow, as an independent controller.
• Paid Services Provider (Sole proprietor (FOP) Oleksandr Kiian, tax number (RNOKPP) 3083518472, 17 Kovpaka St, Kyiv 03150, Ukraine) — the Organisation and contact-person data needed for invoices, contracts and the paid services (plans, Add-ons, Project Preparation and Support), as an independent controller of that data.
• Professional advisers — legal, financial, tax, compliance, audit and technical consultants bound by confidentiality.
• Public authorities, regulators, courts and law enforcement — where required by law, a court order or another lawful request.
• In connection with fraud prevention, compliance reviews, dispute resolution or the protection of the rights, property and safety of the Operator, Users or third parties.
• A successor — in connection with a reorganisation, merger, acquisition or transfer of the Platform, a part of it or the Operator’s assets; in that case we will communicate the change of terms through the Platform or by e-mail where required by law, subject to this Policy.

Providers that may be used (an integration is active only when the Operator has configured it):

6.2.The role of individual providers and the data processing agreements with them are settled before they are connected.

7. Public Data, Testimonials and Use of Names

7.1.The public part of a Listing (title, sector, location, indicators, Score, Badges, the Initiator’s name and images) is available to all visitors of the Platform after moderation, to present Projects to Investors, partners and donors. An Investor’s profile and its participation in a Deal are not public.

7.2.We may publish testimonials, case studies, project success stories and mentions of institutions and partners. The name, title, photo or quote of a natural person is published in such materials only with that person’s consent; the name, city and logo of an Organisation — unless otherwise agreed in writing.

7.3.If you represent an Organisation, institution or Project listed on the Platform, the Operator may use its name, trade name, Project name and logo on the website, in Platform materials, reports, presentations, marketing materials and strategic communications, provided that no confidential Deal details are disclosed, until you request in writing that such use be discontinued. Names and logos of Investors are used only with their separate consent.

8. Cookies and Analytics

8.1.Without your consent the Platform uses only strictly necessary cookies: to sign in and keep the session, to remember the language and to record your consent choice. They are needed to authenticate Users, for security and to prevent fraud.

8.2.Analytics (Google Analytics 4 and Microsoft Clarity through Google Tag Manager, or cookieless analytics — Plausible or Umami — if the Operator has enabled it) helps us understand how the Platform is used and improve it. Analytics cookies are set only after your consent; analytics is not used for advertising or profiling. Current status: Google Analytics 4 and Microsoft Clarity are enabled through Google Tag Manager in Google Consent Mode (v2); analytics cookies are set only after your consent.

8.3.We do not use advertising cookies: permissions for advertising storage and ad personalisation are always denied. If this changes, we will first update the Cookie Policy and ask for your consent.

8.4.You may restrict or disable cookies in your browser settings; however, without the strictly necessary cookies, signing in to an Account and certain functions of the Platform will not work. You can withdraw your analytics consent at any time through “Cookie settings” in the site footer. Names, purposes and periods of the cookies and the providers are listed in the Cookie Policy.

9. Data Retention

9.1.We retain personal data and confidential information only for as long as necessary for the purposes of this Policy, including to provide services and maintain your Account; to comply with legal, tax, accounting, regulatory or reporting obligations; and to keep records related to disputes, enforcement of agreements, compliance and fraud prevention.

9.2.The periods stated are maximum periods unless the law requires longer retention.

9.3.If you close your Account, request deletion or stop using the Platform, certain data may still be retained where necessary for legal compliance, legitimate interests, dispute resolution, fee collection, fraud prevention or enforcement of agreements.

9.4.When a retention period ends, data are deleted or irreversibly anonymised. Anonymised or aggregated data that do not identify you may be kept without time limit for analytical and statistical purposes.

10. Data Security

We apply reasonable technical, administrative, organisational and contractual measures appropriate to the risk to protect information against unauthorised access, misuse, loss, destruction, disclosure or alteration, including:

• encryption in transit (HTTPS) and a strict Content Security Policy;
• passwords stored only as bcrypt hashes; sessions stored server-side with an httpOnly cookie; protection against brute-force attempts;
• role-based access and checks of rights on every server action;
• private file storage, with files delivered only after an access check; watermarking of confidential PDFs and an access log of the Deal Room;
• the Legal Event Log, monitoring and incident response procedures; secrets kept outside the code and never sent to the browser;
• limited Staff access on a need-to-know basis, confidentiality obligations, and data processing agreements with providers.

10.1.No website, platform, storage system or transmission method is completely secure. Although we strive to protect your information, the Platform Administration cannot guarantee absolute security and, to the extent permitted by law, is not liable for losses resulting from unforeseen cyberattacks, technical failures, service interruptions or security breaches beyond its reasonable control.

10.2.In the event of a personal data breach we notify the competent supervisory authority within 72 hours where required (GDPR art. 33) and inform affected persons without undue delay where the breach is likely to result in a high risk (GDPR art. 34).

11. International Data Transfers

11.1.As the Platform operates internationally and engages with investors, institutions, advisers and service providers in several jurisdictions, your data may be processed or accessed outside your country of residence, including in Ukraine and in countries where our providers are located.

11.2.Transfers from the European Economic Area to countries without an adequacy decision of the European Commission (Ukraine currently has none) are made on the basis of the Standard Contractual Clauses (Decision 2021/914) with supplementary measures where needed, or under another safeguard of GDPR Chapter V. Transfers to the USA to the analytics providers (Google LLC, Microsoft Corporation) rely on the European Commission adequacy decision for the EU-US Data Privacy Framework (Decision 2023/1795), under which these companies are certified, and on the Standard Contractual Clauses. Transfers from Ukraine are made to states that ensure adequate protection of personal data or on another basis under art. 29 of the Ukrainian Law.

11.3.You may request information about the safeguards applied by writing to compliance [at] eurobridge [dot] online.

12. Your Rights

Under art. 8 of the Ukrainian Law and GDPR arts. 15–22 (to the extent they apply to you) you have the right to:

• access the personal data we process about you;
• have inaccurate or incomplete data rectified or updated;
• have your personal data erased;
• restrict processing;
• object to certain processing, in particular processing based on legitimate interests (including profiling);
• withdraw consent where processing is based on consent;
• data portability where applicable;
• lodge a complaint with a competent supervisory authority (section “Supervisory Authority”);
• opt out of direct marketing at any time.

Most rights can be exercised directly on the Platform:

12.1.Where your contact details or Project data have been shared with counterparties through the Platform, such counterparties must respect the applicable privacy restrictions and, upon a legitimate request, delete your data or stop any unauthorised retention.

12.2.We answer requests within 30 calendar days of receipt; where the law allows the period to be extended for a complex request, we will inform you. We may ask you to confirm your identity. Requests are free of charge unless manifestly unfounded or excessive.

13. Account Closure and Deletion Requests

13.1.You can delete your Account in the account settings → “Delete my account” (password confirmation). The request is reviewed by an administrator; you can withdraw it while it is pending and you are informed of the decision by e-mail.

13.2.On approval the Account is anonymised: name, e-mail, phone and position are removed; sessions, tokens, saved searches and Projects, preferences and the newsletter subscription are deleted; if no other active User remains in the Organisation, its unpublished Projects are archived. Deal records, Deal Room questions and answers, the Legal Event Log and the request itself are kept, because they belong to the Deal and the counterparty and the Operator have a legitimate interest in the record (GDPR art. 17(3)(b), (e)); your authorship is shown as “Deleted user”.

13.3.To close your Account, request deletion of your personal data or ask how your information is used, you may also write to compliance [at] eurobridge [dot] online or use the contact form. We handle the request in accordance with applicable law within the period stated in section “Your Rights”. Certain data may be retained where required for legal, compliance, contractual or accounting purposes, fraud prevention or dispute resolution.

14. Children

14.1.The Platform is not intended for children: it may be used by persons aged 18 or over. We do not knowingly collect personal data of persons below the age permitted by applicable law without proper legal authorisation; if we learn that such data have been submitted inappropriately, we will take reasonable steps to delete them.

15. Changes to this Policy

15.1.The Operator may amend, update or revise this Policy at any time, in particular when the Platform, our providers or the law change. The updated edition is published on the Platform with a version number and date.

15.2.Registered Users are notified of material changes by e-mail and on the Platform at least 14 days before they take effect, unless an earlier change is required by law. Continued use of the Platform after the updated Policy takes effect means that you have read it; where a new purpose of processing requires consent, we will ask for it separately.

16. Contact Information

For questions about this Policy, the processing of personal data or your rights, please contact:

• Controller: Charity Organization “Charity Fund Come Back to Us”, identification code (EDRPOU) 45019404
• Address: 17 Kovpaka St, Kyiv 03150, Ukraine
• Website: https://eurobridge.online
• Personal data requests: compliance [at] eurobridge [dot] online
• Data protection officer / responsible person: to be appointed
• General questions: info [at] eurobridge [dot] online

17. Supervisory Authority

17.1.In Ukraine, supervision of personal data protection is carried out by the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua).

17.2.If you are in the European Economic Area, you may lodge a complaint with the data protection authority of the EU/EEA member state of your habitual residence, place of work or place of the alleged infringement; the list of authorities is published by the European Data Protection Board (edpb.europa.eu).

17.3.We would appreciate the chance to address your concern first: please write to compliance [at] eurobridge [dot] online.