Privacy Policy

Prometheus Capital ("Prometheus Capital," "we," "us," or "our") is a student investment association based at the University of Amsterdam. This Privacy Policy explains what personal data we collect through prometheuscapital.nl (the "Site"), why we collect it, how we use and protect it, and what rights you have under the EU General Data Protection Regulation (GDPR) and applicable Dutch law.

This Policy applies to visitors to the Site, prospective and current members, and anyone who submits a report, application, or enquiry to us. It does not cover the practices of third-party platforms we link to (e.g. Instagram, LinkedIn, Linktree), which have their own privacy policies.

The data controller responsible for your personal data is Prometheus Capital, a Dutch association (vereniging) registered with the Dutch Chamber of Commerce (KvK) under number 42022865, with its registered address at Hartenstraat 15-3, 1016BZ, Amsterdam. For any privacy-related question or request, contact us at info@prometheuscapital.nl.

We have not appointed a Data Protection Officer, as our processing activities do not meet the GDPR's thresholds for mandatory appointment. Privacy enquiries can still be directed to the contact above.

We collect different personal data depending on how you interact with us:

• ↘Contact form: submitting the form on our Contact page opens your own email client addressed to info@prometheuscapital.nl. We do not receive or store anything through the website itself, only whatever you choose to send. We process it (your name, email address, and message) to respond to your enquiry, on the basis of our legitimate interest in responding to enquiries you initiate.
• ↘Partnerships form: submitting the form on our Partnerships page works the same way — it opens your own email client addressed to partnerships@prometheuscapital.nl. We do not receive or store anything through the website itself. We process what you send (company name, your name, email address, and message) to respond to your enquiry, on the basis of our legitimate interest in responding to partnership enquiries you initiate.
• ↘Membership & desk applications: if you apply via Linktree or by emailing us, we collect what you provide (e.g. name, email, CV, motivation). We process this to assess your application, on the basis of taking steps prior to entering into a membership arrangement with you. Linktree processes your data under its own privacy policy before it reaches us.
• ↘Report publishing: our published reports and articles are prepared and submitted internally by our desks and reviewed by the board — there is no public report-submission form on the Site. Author name and affiliation are published alongside a report on the basis of the consent given by the author as part of that internal process.
• ↘Member & team records: for active and alumni members, we hold name, role/desk, class year, LinkedIn profile URL, a headshot photo, and, where applicable, placement/employment outcomes. Active-member profiles are published on the public Site; we process this on the basis of the consent members give when joining, to showcase the association and support recruiting and credibility. Any future alumni directory will be visible only to logged-in members, not the public, processed on the basis of our legitimate interest in maintaining an alumni network, subject to an opt-out for alumni who don't want to be listed.
• ↘Analytics: we use Plausible Analytics, a cookieless, privacy-first analytics tool. It records aggregated page-view statistics (page, referrer, country-level location, device type) without cookies, persistent identifiers, or cross-site tracking, and cannot identify you individually. We rely on our legitimate interest in understanding site usage.
• ↘Local storage (theme preference): your light/dark theme choice is stored in your browser's local storage, not a cookie, and is never transmitted to us. It is strictly functional and does not require consent.
• ↘Account data (member portal, coming soon): once member login launches, we will collect an email address and authentication credentials to create and secure your account, and will process login-session data (via Supabase Auth) strictly to keep you signed in. This will be necessary to perform our contract with you as a member. We will update this Policy with full detail before that feature goes live.

We do not sell your personal data. We share it only with the service providers ("processors") that help us run the Site, under arrangements that require them to protect it and use it only as we instruct:

• ↘Netlify, Inc. — website hosting and deployment
• ↘Supabase, Inc. — database hosting for public content (teams, placements, publications) and, in future, member authentication
• ↘NocoDB — content and member-record management, used internally to maintain the data shown on the Site
• ↘Plausible Insights OÜ — cookieless website analytics
• ↘Our email provider — for messages sent to info@prometheuscapital.nl or partnerships@prometheuscapital.nl

Some of these providers may process data outside the European Economic Area (EEA), including in the United States. Where this occurs, we rely on the provider's certification under the EU-US Data Privacy Framework, or on the EU Standard Contractual Clauses, to keep your data protected to EU standards. Contact us for details of the specific safeguard used by a given provider.

We keep personal data only as long as necessary for the purpose it was collected for:

• ↘Enquiries and applications we do not act on: deleted or anonymized within 12 months.
• ↘Active member records: retained for the duration of membership.
• ↘Alumni records: retained for as long as you remain part of our alumni network, unless you ask us to remove you sooner.
• ↘Published reports and associated author attribution: retained indefinitely as part of our research archive, unless you request removal and we have no overriding legitimate interest (e.g. archival integrity) to retain it.
• ↘Analytics data: Plausible aggregates data and does not retain information that identifies individual visitors.

Subject to certain conditions and exceptions under the GDPR, you have the right to:

• ↘Access the personal data we hold about you
• ↘Correct inaccurate or incomplete data
• ↘Request erasure of your data
• ↘Restrict or object to certain processing
• ↘Receive your data in a portable format
• ↘Withdraw consent at any time, where processing is based on consent
• ↘Lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl)

To exercise any of these rights, contact us at info@prometheuscapital.nl. We will respond within one month, as required by the GDPR.

The Site is intended for university students and professionals and is not directed at children under 16. We do not knowingly collect personal data from children.

We may update this Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be reflected here; please check back periodically.

For any question, request, or concern about how we handle your personal data, contact us at info@prometheuscapital.nl. If you're not satisfied with our response, you have the right to lodge a complaint with the Autoriteit Persoonsgegevens.