Privacy policy

Data controller

Henrik Hallenborg, operating under the name Hallenborg CTA, is the data controller for the processing of personal data described in this policy.

What data is processed?

When you contact Hallenborg CTA or use a form, your name, email address, telephone number, the content of your message and information about the page from which the enquiry was sent may be processed.

The website’s technical providers may also process limited technical data, such as IP address, browser type, time and security logs, when required to operate and protect the website.

Why is the data processed?

Personal data is used to answer questions, provide requested information about Hallenborg CTA and the Arkad CTA programme, administer meeting requests and follow up an enquiry.

If you register for investor letters, your name and email address are used to send the letters and information you requested. The processing is based on your consent. You may withdraw your consent and stop the mailings at any time by contacting Hallenborg CTA.

Data may also be processed when necessary to comply with a legal obligation or to establish, exercise or defend legal claims.

Legal basis

Processing is normally based on your consent when you select the consent box in a form, or on steps taken at your request before a possible agreement is entered into. Some processing may be based on legitimate interests, for example to answer a message, maintain security or document relevant communications.

You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing that has already taken place.

How long is the data retained?

Personal data is retained only for as long as needed for the purpose for which it was collected. An unanswered or concluded enquiry is normally deleted or anonymised when no longer needed, unless the data must be retained longer because of law, contract or a legal claim.

Data used for investor letters is retained until consent is withdrawn or the mailings otherwise end. Communications and documents subject to accounting, contractual or regulatory record-keeping requirements may need to be retained for the period required by applicable rules, even after a deletion request.

Providers and recipients

Personal data may be processed by providers assisting with web hosting, technical security, form handling and email. Website forms use Cloudflare Turnstile for security and are forwarded through Cloudflare and Google for email delivery. Information is used to respond to enquiries, arrange meetings and handle investor-letter requests. Investor-letter registrations are processed manually after receiving the email. Providers may process the data only for agreed purposes and in accordance with applicable data-protection rules.

Data is not disclosed to other recipients unless required by law, necessary to handle your enquiry or expressly approved by you.

Transfers outside the EU/EEA

Some technical providers may process information outside the EU/EEA. Such transfers must have a valid legal basis and appropriate safeguards, such as an adequacy decision or the European Commission’s standard contractual clauses.

Your rights

Where the conditions of data-protection law are met, you have the right to request access to your personal data and its correction or deletion. You may also request restriction of processing, object to certain processing and, in some cases, receive the data in a structured, machine-readable format.

Contact Hallenborg CTA at henrik@hallenborgcta.com if you wish to exercise any of your rights. Your identity may need to be verified before the request is handled.

You also have the right to lodge a complaint with a competent data-protection authority. As Hallenborg CTA is established in Spain, you may contact the Agencia Española de Protección de Datos (AEPD). You may also contact the data-protection authority in the EU/EEA country where you live or work.

Cookies and website analytics

The website uses Google Analytics to produce statistics on matters such as pages visited, traffic sources, device type and downloads. The analytics tool is activated only if you choose to accept analytics cookies. If you reject them, Google Analytics is not loaded.

Your choice is stored locally in the browser and can be withdrawn by deleting the website’s stored data and making a new choice on your next visit. Data processed through Google Analytics may include technical browser and device information, approximate geographic information, visit data and interactions with the website. Google processes data under its own terms and data-protection rules.

Technically necessary storage may also be used by the website infrastructure for functionality, security and protection against misuse.

Security

Reasonable technical and organisational measures are used to protect personal data against unauthorised access, alteration, loss and unlawful processing. Access is limited to those who need the data for their duties.

Changes to this policy

The policy may be updated when the website’s functions, providers or legal requirements change. The latest version is always published on this page.