This Privacy Policy explains how Subirachs Ventures collects, uses, shares and protects personal data when you visit this website, subscribe to a newsletter, submit an enquiry, or use one of our private client or admin areas. Where the General Data Protection Regulation (EU) 2016/679 ("GDPR") applies to your personal data — for example because you are located in the European Economic Area — we process that data in accordance with the GDPR's principles and grant you the rights described in Section 8 below, regardless of where our infrastructure is located.
1. Data Controller
This website is operated by BMBWeb3 Global FZCO, registered at IFZA Business Park, Building A1, Dubai Silicon Oasis, P.O. Box 342001, Dubai, United Arab Emirates ("Subirachs Ventures", "we", "us"). We act as the data controller for the personal data described in this policy. For any privacy-related enquiries, to exercise a data protection right, or to reach our data protection contact point, email us at hello@bmbweb3.com.
2. Data We Collect
We collect only the personal data required to operate this website, run our portfolio ventures' client and admin tools, and respond to your enquiries:
- Contact and enquiry data: name, email address, company, message content and any other information you choose to include when you fill in a contact, partnership or deck-request form.
- Newsletter data: email address, first name (optional), consent status and timestamp, and which of our group brands you subscribed to.
- Client and admin access data: if you are issued a private login link (client workspace or admin backoffice), we process your email address, login timestamps, session tokens (stored as one-way hashes, never in plain text) and, for client data rooms, document-viewing activity such as pages viewed and time spent.
- Technical data: IP address, browser type, device, approximate location, language and referring URL, collected automatically when you access the site.
- Usage / analytics data: pages visited, time on site, and interaction events, collected only after you consent to analytics cookies (see Section 5 and our Cookies Policy).
3. Purpose & Legal Basis
We process personal data for the following purposes, each on a specific legal basis:
- Responding to enquiries and business communications — legitimate interest in operating our business and, where an enquiry precedes a contract, taking pre-contractual steps at your request.
- Sending newsletters — your consent, given when you subscribe. You can withdraw it at any time (Section 8).
- Providing private client workspaces and the admin backoffice — performance of a contract or legitimate interest in providing the requested service securely, and legal obligation where we must keep records of access for security purposes.
- Site analytics and performance measurement — your consent, collected through the cookie banner before any analytics cookie is set (Section 5).
- Security, fraud and abuse prevention — legitimate interest in keeping our systems and accounts secure (e.g. rate-limiting login attempts, detecting suspicious activity).
- Legal compliance — where processing is necessary to comply with an applicable legal obligation.
4. Data Processors & Recipients
We do not sell personal data. We share personal data only with service providers who process it on our behalf, under contract and only for the purposes described above:
- Supabase — database hosting for contact, newsletter, and client/admin access records.
- Resend — transactional email delivery (newsletter welcome emails, login links, enquiry notifications).
- Vercel — website hosting, serverless functions, and Vercel Analytics, which runs only after you accept analytics in the cookie banner.
- Google Analytics (GA4) — with your consent only, via Google's Consent Mode, to measure site traffic and usage.
We may also disclose personal data where required by law, to protect our rights, or in connection with a corporate transaction (e.g. a merger or restructuring), subject to confidentiality safeguards.
5. Cookies & Consent
We only set analytics cookies, and only send Vercel Analytics page views, after you actively accept analytics through the cookie banner shown on your first visit; strictly necessary cookies are exempt from consent under the ePrivacy Directive and GDPR. See our Cookies Policy for the full list of cookies, their purpose, and how to change your choice at any time.
6. International Transfers
We operate from the United Arab Emirates and use service providers located in the European Union, United Kingdom and United States. Where personal data of individuals in the EEA or UK is transferred outside those regions, we rely on appropriate safeguards recognised under GDPR, such as the European Commission's Standard Contractual Clauses or a provider's own compliance with an adequate data-protection framework. You can request further information about these safeguards by contacting us (Section 1).
7. Data Retention
- Enquiry / contact form data: up to 24 months after your last contact with us, unless a longer period is required to pursue or defend a legal claim.
- Newsletter data: for as long as your subscription is active, and removed within 30 days of unsubscribing.
- Client workspace and admin access records: for the duration of the engagement plus up to 12 months, for security and audit purposes.
- Analytics data: retained in aggregated or pseudonymised form; raw event data is retained for no longer than the retention window set by the analytics provider (typically 14 months for Google Analytics).
We may retain data for longer where required to comply with a legal, accounting, or reporting obligation.
8. Your Rights Under GDPR
If GDPR applies to your personal data, you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate or incomplete data.
- Erase your data ("right to be forgotten"), subject to legal exceptions.
- Restrict processing in certain circumstances.
- Port your data to another provider in a structured, machine-readable format.
- Object to processing based on legitimate interest, including direct marketing.
- Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
- Lodge a complaint with the data protection supervisory authority in your EU/EEA country of residence, place of work, or the place of the alleged infringement.
To exercise any of these rights, contact hello@bmbweb3.com. We respond to verified requests within one month, as required by GDPR Article 12.
9. Automated Decision-Making
We do not carry out any processing based solely on automated decision-making, including profiling, that produces legal or similarly significant effects on you.
10. Data Security
We apply technical and organisational measures appropriate to the risk, including encryption in transit, hashed access tokens, row-level access controls on our databases, and rate-limiting on authentication endpoints. No method of transmission or storage is completely secure; we cannot guarantee absolute security but continuously work to protect personal data against unauthorised access, loss, or misuse.
11. Children's Privacy
This website is directed at businesses and professionals. We do not knowingly collect personal data from individuals under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
12. Updates
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The latest version will always be available on this page with an updated revision date. Material changes will be highlighted where appropriate.