CAPITAL FLOWS / PRIVACY
Privacy notice
Draft dated 22 October 2026. This notice describes the website, external newsletter signup and the separate Tally deal-submission form.
Publication review outstanding. Umami's actual account configuration, retention, processing terms, transfer safeguards and applicable legal basis must be confirmed before this draft is approved for publication. Deal submissions use a separate Tally form and private response inbox, not the public Deal Log.
Controller
Leon Tomski
Wilmsstraße 21 a
10961 Berlin
Germany
Email: leon.tomski@proton.me
Hosting and protection of the website
Cloudflare provides the website and its data interface. Delivering and protecting the service involves technical connection data such as IP address, time, requested URL, browser information and transferred data. The purpose is reliable delivery, troubleshooting and prevention of misuse. For these purposes, the stated basis is legitimate interests under Article 6(1)(f) GDPR.
The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Processing outside the European Economic Area is possible. Cloudflare's processing terms provide for EU standard contractual clauses where applicable. See Cloudflare privacy information and its data processing terms.
The public data API uses IP-based request limiting for abuse prevention. No single fixed retention period is asserted for all Cloudflare operational and security records; necessity for operation, security and legal obligations determines retention.
Map libraries and geographic data
Your browser requests D3, TopoJSON and country boundaries from the public jsDelivr CDN. The infrastructure receives your IP address and technical request information. This supports the map, on the stated basis of legitimate interests under Article 6(1)(f) GDPR. jsDelivr uses several infrastructure partners and processing outside the EEA is possible. See jsDelivr privacy information.
Theme preference
When you explicitly choose light or dark mode, your browser stores that preference locally until you change it or clear website data. This preference is not sent to Capital Flows. It supports the display setting you requested.
Umami Cloud usage analytics
The production website currently includes Umami Cloud. The browser loads a script from cloud.umami.is and can send usage information such as page URLs, referrer, browser, device and language details to that service. The purpose is to understand website usage and acquisition. No advertising-network pixels are integrated. The provider describes its standard analytics as cookie-free; this is not a blanket promise of anonymity or an independent determination that consent is unnecessary.
The integration excludes local and hosted previews, automated browser checks and the Submit a deal page. No external analytics tracker is loaded and no navigation events are recorded on the submission page. You can exclude a browser on capital-flows.eu by setting localStorage.setItem('umami.disabled', '1') in its console. This applies to that origin and browser profile only and is lost when website data is cleared. Exclusion does not delete historical events. Do not include personal or confidential information in URLs or analytics properties.
On the production site, selected navigation actions may be counted: opening the newsletter signup, a topic, a deal or the submission page, and requesting a map export. These action properties include only the page path, not search text, email addresses, form contents or full destination URLs. Opening signup is not treated as a confirmed subscription.
Provider processing terms, hosting region, subprocessors, transfers, retention and the legal basis for the actual configuration remain to be verified for this draft. No specific retention period or complete anonymisation claim is invented here. See Umami privacy information.
External newsletter signup through Tally
Subscribe buttons are ordinary external links, not embedded forms. Tally opens only when you choose the link. No newsletter address is entered on the map website. The signup URL contains no Instagram or Facebook tracking parameters.
Tally BV, Sint-Pietersnieuwstraat 11, 9000 Ghent, Belgium, provides the form. Submitting it sends your email address, express newsletter consent and technical submission information to Tally for signup processing. The stated basis is consent under Article 6(1)(a) GDPR. Signup is optional and not required to use the map. See Tally privacy information and its data processing terms.
The planned English email briefing is fortnightly, on Tuesdays. The form collects a signup request; it does not itself activate automated newsletter delivery or prove email ownership. A delivery provider, double opt-in and confirmation records must be configured and tested before activation. This notice must be updated before an additional delivery service is used.
Deal submissions, tips and corrections through Tally
The Submit a deal page embeds a separate form from Tally BV, Sint-Pietersnieuwstraat 11, 9000 Ghent, Belgium. Loading it connects your browser to Tally and its infrastructure, which receive technical connection information. Pressing Submit sends the startup name, website and primary source URL to Tally so we can review the submission privately. No personal contact field, newsletter consent or account is required. Share public business information only, not confidential or sensitive data.
The purpose is receiving and checking voluntary business announcements and corrections; the stated basis for necessary technical processing and editorial review is legitimate interests under Article 6(1)(f) GDPR. Responses are held in the existing Tally account, with self-notifications enabled to its registered account email. No automatic Notion import, publication or newsletter enrolment takes place. Tally states that response data is stored in Europe and encrypted in transit and at rest; see its data-protection information and processing terms. This is not a claim that the entire website has completed a legal review.
Partial submissions are not collected and Save answers for later is disabled. Duplicate primary-source URLs are rejected. Completed responses remain until manually deleted from Tally; notification copies follow mailbox retention. Review and remove submissions no longer needed for handling, allowing for legal obligations. No automatic retention/deletion timer is enabled. Request access or deletion at leon.tomski@proton.me, identifying the company and source URL. Only verified public facts may be manually added to the existing Deal Log.
Retention, withdrawal and deletion
Existing newsletter requests are kept for the requested purpose while consent and that purpose continue. You can withdraw consent or request deletion at leon.tomski@proton.me. Data no longer needed for the purpose should be deleted; records needed to meet legal obligations or establish or defend claims may remain restricted. Withdrawal does not affect the lawfulness of earlier processing. No automatic deletion or confirmation-email system is claimed.
Email contact
If you email us, we process your sender address, message and supplied information to answer your request. The stated basis is Article 6(1)(b) GDPR for pre-contractual or contractual requests, otherwise Article 6(1)(f) GDPR for responding to correspondence. Messages should be deleted after handling unless further work or retention obligations require them.
The contact mailbox uses Proton Mail, Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland. Switzerland benefits from an EU adequacy decision. See Proton privacy information. Proton Mail is a contact channel here, not an activated newsletter-delivery service.
External links
Notion, source, LinkedIn and Instagram links open external services; they are not embedded social plugins. Their privacy notices also apply when you open them. The published Deal Log interface does not send visitor signup details to Notion.
Your rights
Subject to the GDPR, you may request access, rectification, erasure, restriction, portability and withdrawal of consent. You may object to legitimate-interest processing on grounds relating to your particular situation under Article 21 GDPR, and to direct marketing at any time. Contact leon.tomski@proton.me.
Complaints
You may complain to a data protection authority, particularly in your habitual residence, workplace or location of the alleged infringement. For the stated Berlin address, see the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany.