499X Capital GmbH – Valid as of 30 November 2025

1. Controller
499X Capital
Dr. Christoph Lymbersky
Neuer Wall 80
20354 Hamburg
Germany
E-Mail: info@499x.capital
Managing Director: Dr. Christoph Lymbersky

2. Data Protection Officer
You can reach our external data protection officer at:
Datenschutzbeauftragter
c/o 499X Capital GmbH
Neuer Wall 80, 20354 Hamburg
E-Mail: info@499x.capital

3. Purposes and Legal Bases of Processing
We process your personal data only for the following purposes and on the following legal bases:
a) Performance of the share subscription agreement and ongoing shareholder relationship (Art. 6 (1) b GDPR)
b) Compliance with statutory obligations (commercial register, money laundering act, tax law, etc.) – Art. 6 (1) c GDPR
c) Protection of legitimate interests (fraud prevention, direct marketing to existing investors, IT security) – Art. 6 (1) f GDPR

4. Categories of Personal Data Processed

  • Full name, date and place of birth, nationality, address
  • Copy of passport or ID card (for AML/KYC)
  • Tax identification number and tax residency
  • Bank account details (IBAN/BIC)
  • Investment amount and shareholding
  • E-mail address, telephone number, correspondence

5. Recipients and International Transfers
Your data may be disclosed to:

  • Notary public and commercial register court
  • Tax advisor, auditor, and legal counsel
  • Contracted IT and cloud service providers (all bound by Art. 28 GDPR data-processing agreements)
  • Wholly-owned subsidiaries in Switzerland (adequacy decision), USA, UAE, and South Africa (standard contractual clauses + TIA where required)

No data is sold or disclosed to third parties for marketing purposes.

6. Storage Duration
Personal data is retained for the duration of your shareholding plus 10 years thereafter (statutory retention periods under German commercial and tax law – §§ 257 HGB, 147 AO). AML/KYC documentation is kept for 5 years after the end of the business relationship.

7. Your Rights
You have the right to:

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (“right to be forgotten”) (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Object to processing (Art. 21 GDPR)
  • Lodge a complaint with the supervisory authority (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit)

8. Cookies & Tracking
The website uses only technically necessary cookies. No marketing or analytics cookies are set without your explicit consent (§ 25 TTDSG).

9. Security
All data is transmitted via TLS 1.3 and stored encrypted (AES-256). Access is restricted on a strict need-to-know basis with two-factor authentication.

10. No Automated Decision-Making
There is no automated individual decision-making or profiling.

By submitting the contact/investment form or signing the subscription agreement, you confirm that you have read and understood this privacy policy.

499X Capital GmbH
Neuer Wall 80, 20354 Hamburg
Last updated: 30 November 2025