Last updated September 2026 · Effective 8 September 2026 · Version 7.1
How to exercise it
Email dpo@inovexus.com with “Data Access Request.”
How to exercise it
How to exercise it
How to exercise it
How to exercise it
How to exercise it
Data Controller and Contact Information
Our DPO is available for all questions relating to this privacy policy and the exercise of your data protection rights. dpo@inovexus.com · 4 rue Royale, 75008 Paris, France
Scope and Application
This privacy policy applies to the processing of personal data in the context of the activities of Inovexus, regardless of whether the processing takes place in the European Union or not, insofar as the processing relates to:
Key Takeaway: Our investment services are not intended for anyone under 18. We delete accounts if we discover underage use.
Age Restriction: Inovexus platform and services are intended for adults aged 18 and over. If you believe a child has provided personal data to us, please contact dpo@inovexus.com immediately with “Minor Account” in the subject line.
Definitions
“Personal Data”, “Processing”, “Data Subject”, “Controller”, “Processor”, “Profiling” and other key terms have the meanings given in Articles 4 and 9 GDPR.
Categories of Personal Data
Name, date and place of birth, nationality, gender where provided, postal address, email address, telephone number, profile photograph, and other contact details.
What it includes
Employment history, job title, role, company or organization, industry, professional experience, education, skills, professional interests, LinkedIn and similar professional profile information, and information contained in professional biographies or profiles.
What it includes
Bank account and payment details where required, investment history, investment preferences, investment capacity, source of funds or wealth where required, risk profile, transaction information, tax identifiers, and AML/KYC documentation.
What it includes
Account credentials, account identifiers, IP address, browser and device information, device identifiers, operating system, authentication information, cookies and similar technologies, login activity, usage logs, pages and features accessed, interactions, and technical or diagnostic information.
What it includes
Communications with us, email history, marketing preferences, event registrations and participation, survey and feedback responses, community posts and interactions, support requests, and other information you provide when communicating with us.
What it includes
Membership or subscription type, billing status, subscription dates, payment status, transaction records, invoices, and information relating to purchases or membership services. Payment card details may be processed directly by our payment service providers rather than stored by us.
What it includes
Information relating to your participation in events, workshops, community activities, registrations, attendance, networking interactions, and content or information you voluntarily share with other community members.
What it includes
Information used to measure and understand the effectiveness of our marketing activities, such as campaign identifiers, referral sources, advertising interactions, website visits, conversions, and engagement with marketing communications.
What it includes
Information you voluntarily submit or publish through the Platform, including comments, posts, profiles, messages, feedback, applications, documents, and other content.
What it includes
Information necessary to comply with legal and regulatory obligations, including identity verification, AML/KYC checks, sanctions screening, fraud-prevention checks, PEP screening, and information required to establish or verify your eligibility to use particular services.
What it includes
Where legally permitted and necessary, limited special-category or sensitive information, such as health or accessibility requirements for events. We do not intentionally collect sensitive personal data unless there is a lawful basis and a specific need to do so.
Purposes and Legal Basis for Processing
We process your personal data only where a valid legal basis under Article 6 and, where relevant, Article 9 GDPR applies.
When we rely on it
Platform account management, investment services, membership and subscription management, community services, customer support, service communications and personalization of services.
When we rely on it
MiFID II investor protection, EU and national AML/CTF requirements (KYC, PEP and sanctions screening), tax reporting (CRS, FATCA) and record-keeping obligations.
When we rely on it
Platform security and fraud prevention, business analytics and service improvement, and relevant opportunity recommendations — always subject to a balancing test.
When we rely on it
We process personal data where necessary to comply with applicable EU, French, and other national financial, investment, anti-money laundering, tax, and regulatory requirements, including, where applicable (non-exhaustive):
Examples of processing carried out for these purposes include:
Where applicable, statutory or regulatory retention requirements may require us to retain personal data for a specified period even if you request its deletion. During such periods, these obligations may limit or delay certain rights, including your rights to erasure, objection, restriction of processing, or data portability, to the extent permitted by applicable law.
Where we rely on legitimate interests, we conduct and periodically review a balancing test to assess whether our legitimate interests are proportionate and do not override your rights and freedoms.
Examples include:
You may object to processing based on our legitimate interests at any time, as described in Section 12. Where you object, we will stop the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defence of legal claims.
We rely on your consent where required by applicable law and where you have a genuine choice, including for:
Where we rely on consent, it will be obtained through a clear affirmative action and will be specific, informed, and freely given. You may withdraw your consent at any time. Withdrawal will not affect the lawfulness of processing carried out before withdrawal.
See Section 5.1.5 (Consent Management) and Section 13 (Cookies and Similar Technologies) for further details.
Detailed Processing Activities
Data collected: Name, email address, password or authentication credentials, and basic contact information. Why: To create and secure your account, provide access to the Platform, authenticate you, and communicate with you about your account.
Shared with: Portfolio companies and investment vehicles, service providers, professional advisers, co-investors where you have chosen to share your profile, and competent authorities where required or permitted by law.
Communications: Service and account messages, investment and portfolio updates, newsletters, educational content and event invitations. Control: Manage your preferences and withdraw consent at any time.
Key Takeaway: We take measures to protect confidential information relating to startups, investment opportunities, and other business information shared through the Platform.
Data Protected: Depending on the services provided, this may include pitch decks, financial projections, business plans, due-diligence materials, cap tables, commercial information, strategic plans, intellectual property information, and other confidential business information provided by startups or their representatives.
Access Controls:
Technical and Organizational Safeguards:
We maintain appropriate technical and organizational measures designed to protect confidential information, which may include encryption, authentication controls, access restrictions, secure storage, monitoring, backups, security testing, and employee security procedures. The specific safeguards may vary depending on the system, service provider, and nature of the information.
Legal and Contractual Protections:
Retention: Confidential startup information is retained for as long as reasonably necessary for the relevant investment, business, contractual, legal, or regulatory purpose. Information may be retained after an investment or relationship ends where necessary to comply with legal or regulatory obligations, resolve disputes, maintain appropriate records, or protect legitimate business interests.
Automated Decision-Making and Profiling
Email dpo@inovexus.com with “Human Review Request” in the subject line. Identify the recommendation or issue you would like reviewed and, where possible, explain why you believe it is inaccurate or inappropriate.
We use AI-assisted systems, including MatchAI and ScoutAI, to help analyze information and provide recommendations relating to investment opportunities and Platform services.
Depending on the service and information available, these systems may assist with:
These systems may consider information such as your stated investment preferences, professional background, investment experience, areas of interest, and characteristics of available opportunities.
The systems may rank or prioritize opportunities based on their predicted relevance to you. This can affect the order in which opportunities are presented to you, but it does not prevent you from accessing or considering other available opportunities where those opportunities are otherwise available to you.
AI-assisted recommendations do not replace human judgment in investment decisions. You remain responsible for deciding whether to pursue or make an investment. Where an investment decision requires human assessment or approval, that decision is not made solely by the AI system.
Our AI-assisted matching and recommendation systems are intended primarily to provide recommendations and organize information. They are not intended to make decisions based solely on automated processing that produce legal effects or similarly significant effects concerning you.
Where applicable law provides you with rights in relation to automated decision-making or profiling, including the right to obtain meaningful information about the logic involved, express your point of view, contest a decision, or request human intervention, we will provide those rights in accordance with applicable law.
If you believe an AI-assisted recommendation or profile assessment is inaccurate, unfair, or based on incorrect information, you may contact dpo@inovexus.com with “Human Review Request” in the subject line. Please identify the recommendation or issue you would like reviewed and, where possible, explain why you believe it is inaccurate or inappropriate.
We will review requests in accordance with applicable law and our internal review procedures.
We take reasonable measures to ensure that AI-assisted systems are operated responsibly and that personal data used by these systems is processed in accordance with applicable data-protection requirements.
Depending on the system and its use, safeguards may include:
AI systems may be updated, improved, retrained, or replaced from time to time. The specific models, techniques, data sources, and safeguards used may therefore change over time.
For questions about AI-assisted processing, to request correction of information used by our systems, or to request human review where applicable, contact dpo@inovexus.com.
Data Recipients and Transfers
Community platform and networking services
Data processed
Purpose
Data processed
Purpose
Data processed
Purpose
Data processed
Purpose
Data processed
Purpose
Data processed
Purpose
Data processed
Purpose
Data processed
Name, email address, scheduling information, and calendar-related information
Purpose
Data processed
Purpose
Data processed
Purpose
Data processed
Purpose
Data processed
Purpose
Data processed
Purpose
Data processed
Purpose
Access to personal data within Inovexus is limited to persons who need it to fulfil their tasks, e.g.:
Role‑based access controls apply.
Our primary processors may engage their own sub-processors, including cloud infrastructure, hosting, security, analytics, communications, and other technology providers, as necessary to provide their services.
We:
Where required by applicable law, we will provide information about relevant processors and material changes to sub-processing arrangements and, where applicable, provide an opportunity to object.
You may request information about our current processors and relevant sub-processors by contacting dpo@inovexus.com.
In certain circumstances, personal data may be shared with independent data controllers who determine their own purposes and means of processing. These parties may include:
Where a third party acts as an independent controller, that party is responsible for its own processing of personal data and may have its own privacy notice and data-protection obligations.
International Data Transfers (Focus: US Transfers)
Email dpo@inovexus.com with the subject “Data Location Preference” and specify the option you would like. Where technically and legally feasible, we implement it within 5 business days.
We use third-party technology, infrastructure, communications, payment, community, analytics, and other service providers that may operate or process data in countries outside the EEA, including the United States.
International processing may be necessary to provide, maintain, secure, and improve our Platform and services. We seek to limit international transfers to information that is reasonably necessary for the relevant purpose.
Where personal data is transferred outside the EEA, we rely on an appropriate legal transfer mechanism as required by applicable law. Depending on the recipient and circumstances, this may include:
Where SCCs or another mechanism requiring an assessment of the transfer is used, we consider the circumstances of the transfer and, where appropriate, conduct a Transfer Impact Assessment (TIA) and implement supplementary measures where necessary.
Depending on the nature of the processing and the risks associated with the transfer, we may apply appropriate technical, contractual, and organizational safeguards, including:
Technical and Organizational Safeguards:
Contractual Safeguards:
Transfer Assessments:
We assess international transfers on a risk-based basis and may consider factors including the destination country’s legal framework, the nature and sensitivity of the personal data, the purpose of the transfer, the recipient’s technical and organizational measures, and the availability of supplementary safeguards.
Our international-transfer arrangements may change as our service providers, technology infrastructure, and applicable legal requirements change. We will update our safeguards and transfer mechanisms where reasonably necessary to maintain compliance with applicable data-protection requirements.
You may request further information about the safeguards applicable to a particular international transfer by contacting dpo@inovexus.com.
Where available, Inovexus may provide options concerning the regional processing or storage of personal data. The availability and scope of these options depend on the Platform services you use, our technical infrastructure, and the capabilities of our service providers.
Standard Processing
EU-Priority Processing
Where this option is available, we will seek to prioritize processing and storage within the EEA where technically and operationally feasible.
EU-Only Processing
An EU-only processing arrangement may be available for specific services, customers, or regulatory requirements where our infrastructure and service providers can support it.
An EU-only arrangement means that we will seek to restrict the relevant processing and storage of personal data to the EEA. However, this does not necessarily guarantee that no data will ever be accessed from or transferred outside the EEA, particularly where third-party services, support functions, or other technical dependencies are involved.
Any limitations, additional requirements, or costs associated with a particular data-location option will be communicated before the option is implemented.
To Request a Data Location Preference:
Email dpo@inovexus.com with the subject “Data Location Preference” and specify the option you would like to request.
We will assess the request and, where technically and legally feasible, implement the requested preference within 5 business days. If the requested option is unavailable or cannot be fully implemented, we will explain the applicable limitations.
Inovexus and its service providers may receive requests for personal data from courts, regulators, law-enforcement agencies, or other public authorities.
Where we receive such a request, we will handle it in accordance with applicable law and will take reasonable steps to:
Where legally permitted and appropriate, we will notify affected individuals of a government or law-enforcement request. We will not provide such notification where prohibited by law or where doing so could prejudice an investigation, legal proceeding, or other legitimate legal interest.
Where appropriate and legally permissible, we may publish aggregated transparency information concerning government or law-enforcement requests. Such reporting will not identify individual users.
We do not guarantee that every government request will be challenged or that every affected individual will be notified, as these actions depend on applicable law, the circumstances of the request, and any restrictions imposed on us or our service providers.
We periodically review our international data-transfer arrangements and the safeguards applied to those transfers.
Reviews may be conducted when appropriate based on:
Where necessary, we will update our transfer mechanisms, contractual arrangements, technical safeguards, or organizational measures to maintain compliance with applicable data-protection requirements.
Our internal compliance records may contain more detailed information about individual transfer assessments, processors, safeguards, and review dates. Such information may be made available where required by applicable law.
Data Retention and Deletion
Standard retention period
Deletion / review trigger
Primary basis
Standard retention period
Deletion / review trigger
Primary basis
Standard retention period
Deletion / review trigger
Primary basis
Standard retention period
Deletion / review trigger
Primary basis
Standard retention period
Deletion / review trigger
Primary basis
Standard retention period
Deletion / review trigger
Primary basis
Standard retention period
Deletion / review trigger
Primary basis
Standard retention period
Deletion / review trigger
Primary basis
Standard retention period
Deletion / review trigger
Primary basis
We retain personal data only as long as necessary to fulfil the purposes described above, or as required by law.
10.2 Retention Factors
Our retention periods consider:
Retention periods may be extended where reasonably necessary:
When personal data is no longer required, we will delete it, anonymize it, or otherwise securely dispose of it in accordance with our applicable policies and technical capabilities.
Deletion from active systems may not result in immediate deletion from all backups. Backup copies may remain for a limited period until they are securely overwritten or otherwise deleted through the normal backup lifecycle. Such copies will remain protected and will not ordinarily be restored or used except where necessary for disaster recovery, security, or legal purposes.
We maintain procedures designed to ensure that personal data is deleted or anonymized when it is no longer required, subject to applicable legal, regulatory, contractual, and security requirements.
Our deletion processes may include:
We use security measures appropriate to the systems and storage technologies involved. These may include access controls, encryption, secure deletion mechanisms, logical deletion, cryptographic erasure, anonymization, and other appropriate technical measures.
We do not guarantee that every item of personal data can be physically or instantaneously removed from every backup, disaster-recovery copy, system log, or third-party system immediately upon expiry of a retention period. Where immediate deletion is not technically feasible, the information will remain appropriately protected and will be removed or anonymized in accordance with the relevant system’s normal retention and deletion lifecycle.
We periodically review our retention and deletion practices to ensure that they remain appropriate for our services and applicable legal requirements.
Technical and Organizational Security Measures
Where required, we notify the supervisory authority without undue delay and, where feasible, within 72 hours. If a breach is likely to result in a high risk to you, we will tell you directly without undue delay.
We apply access controls designed to ensure that personal data is accessible only to authorized persons who require access for legitimate business, contractual, legal, or security purposes.
Our measures may include:
Depending on the system and sensitivity of the information, we may use:
We seek to apply appropriate technical safeguards to sensitive information, including financial, identity-verification, and other information requiring enhanced protection.
We maintain procedures for detecting, investigating, containing, and responding to suspected security incidents.
Depending on the nature of the environment and risk, these procedures may include:
If we become aware of a personal-data breach, we will assess the incident promptly and take appropriate measures to contain, investigate, and remediate it.
Where required by applicable law, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of the breach, where the breach is likely to result in a risk to the rights and freedoms of individuals.
Where a personal-data breach is likely to result in a high risk to the rights and freedoms of affected individuals, we will communicate the breach to those individuals without undue delay where required by applicable law.
Not every security incident or personal-data breach will require notification to individuals or a supervisory authority. The applicable notification requirements depend on the nature and severity of the incident and the risks involved.
Incident Response Process
Our response may include:
Information Provided to Affected Individuals
Where notification to individuals is required, we will provide information appropriate to the circumstances, which may include:
Communication Channels
Depending on the circumstances and applicable legal requirements, notifications may be made through:
We maintain internal incident-response procedures and periodically review and test them based on the nature and risk of our processing activities.
Nothing in this section guarantees that a particular security measure, notification method, or response time will apply to every incident. Our response will depend on the circumstances of the incident and the requirements of applicable law.
Your Rights as a Data Subject
What it means
What it means
What it means
What it means
What it means
What it means
What it means
What it means
Email dpo@inovexus.com or write to Inovexus, 4 Rue Royale, 75008 Paris, France. You don’t need a specific form. We aim to respond within 15 days, and always within the legal deadline (generally one month).
You may request confirmation of whether we process your personal data and, where applicable, obtain a copy of that data and information concerning:
How to request:
Where appropriate, we may provide the information electronically in a commonly used format.
You may request correction of inaccurate personal data or completion of incomplete personal data.
For information that can be changed directly through the platform, you may update your profile or account settings.
For other information:
We will assess and correct information where appropriate. Information that must be maintained in an unchanged form for legal, regulatory, audit, evidentiary, or other lawful purposes may be retained, with appropriate contextual correction where necessary.
You may request deletion of your personal data where one of the grounds under Article 17 GDPR applies.
How to request:
We will assess the request and delete or anonymize personal data where legally required.
The right to erasure is not absolute. We may retain information where necessary to comply with legal or regulatory obligations, establish or defend legal claims, prevent fraud or abuse, maintain legally required records, or for another lawful exception under GDPR.
Where we have lawfully shared personal data with processors or other recipients, we will take appropriate steps to communicate an applicable erasure request where required by law and reasonably practicable.
Where the right to portability applies, you may request personal data that:
Where applicable, we will provide the data in a structured, commonly used, and machine-readable format.
How to request:
The portability right does not generally apply to data inferred or derived by us, such as internal scores, assessments, or proprietary analyses, unless otherwise required by applicable law.
You may object to processing based on our legitimate interests where you have grounds relating to your particular situation.
You may also object to the processing of your personal data for direct marketing at any time and without having to provide a reason.
Marketing objections:
Marketing suppression requests will be processed promptly.
For other objections:
We will stop the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is required for the establishment, exercise, or defense of legal claims.
You may request restriction of processing in circumstances provided by Article 18 GDPR, including where:
How to request:
Email dpo@inovexus.com and explain the circumstances supporting your request.
Where restriction applies, we will generally retain the relevant information but limit how it is processed, subject to the exceptions permitted by GDPR.
Where applicable, you may have rights under Article 22 GDPR in relation to decisions based solely on automated processing that produce legal effects or similarly significantly affect you.
Our AI systems may assist with recommendations, opportunity matching, prioritization, screening, and other platform functions. Where these systems are used only to provide recommendations or support human decision-making, they do not necessarily constitute automated decision-making within the meaning of Article 22.
Where an applicable Article 22 right arises, you may have the right to:
To request human review of an AI-supported outcome, contact dpo@inovexus.com with “Human Review Request” in the subject line and identify the recommendation or decision concerned.
We will assess the request and provide an appropriate response within the applicable GDPR timeframe.
We may take reasonable steps to verify the identity of a person making a rights request where necessary to protect personal data from unauthorized disclosure.
We will generally use information already associated with your account where sufficient. Additional identification may be requested only where reasonably necessary and proportionate to the risk.
You will not normally be charged for exercising your GDPR rights. Where permitted by GDPR, we may charge a reasonable fee or refuse to act on requests that are manifestly unfounded or excessive, particularly because of their repetitive nature.
If you believe that we have not handled your personal data appropriately, you may first contact our DPO:
You also have the right to lodge a complaint with a competent data protection supervisory authority.
For individuals in France, the relevant supervisory authority is the Commission Nationale de l’Informatique et des Libertés (CNIL).
You may also have the right to seek judicial remedies in accordance with applicable law.
Complete Cookie Policy
Cookies are small text files or similar technologies stored on your device when you visit our website or use our platform. We may also use related technologies, including pixels, web beacons, SDKs, local storage, and similar identifiers.
These technologies may be used for security, authentication, functionality, analytics, service improvement, and marketing.
Strictly necessary cookies are required for the website or platform to function securely and provide services you have requested. These cookies do not require consent where they are strictly necessary for the operation of the service.
Examples may include:
| Cookie / Technology | Purpose | Typical Duration | Data Stored |
| session_token | Authentication and maintaining a secure login session | Session / as configured | Session identifier |
| csrf_token | Protection against cross-site request forgery and related attacks | Session / as configured | Security token |
| cookie_consent | Records your cookie and consent preferences | Up to 6 months (re-requested periodically per CNIL guidance) | Consent choices |
| Load-balancing technology | Helps route requests and maintain service availability | Session / as configured | Technical routing identifier |
Legal basis: Where these technologies are strictly necessary, processing is based on the need to provide and secure the service and, where applicable, our legitimate interests in maintaining platform security and reliability.
These technologies cannot generally be disabled through our cookie preference mechanism because doing so may prevent the platform from operating correctly or securely.
Where analytics technologies are not strictly necessary for the service, we use them only where the required consent has been obtained.
Depending on the services currently implemented, analytics technologies may include:
| Service | Examples | Purpose | Types of Data |
| Google Analytics | _ga, _ga_* | Website usage, traffic measurement and service performance | Pages viewed, sessions, approximate device/browser information, interactions |
| Hotjar | _hj* | User-experience analysis, heatmaps and session analysis | Clicks, scrolling, navigation and interaction patterns |
| Mixpanel | mp_*, distinct_id | Product analytics and feature-usage analysis | Feature interactions, navigation paths, events and conversion events |
Analytics may help us understand:
Where reasonably possible, we use aggregation, pseudonymisation, data minimisation and appropriate retention limits.
Legal basis: Consent (Article 6(1)(a) GDPR) where consent is required.
You may withdraw your consent at any time by contacting dpo@inovexus.com.
We may use technologies that remember choices you make, such as language, interface preferences, dashboard configuration or notification settings.
Examples may include:
| Technology | Purpose | Typical Duration |
| language_pref | Remember language preferences | Up to 12 months |
| dashboard_layout | Remember dashboard or interface preferences | Up to 6 months |
| notification_settings | Remember notification preferences | Until changed |
Where a technology is strictly necessary to provide a feature you have specifically requested, it may be used without consent where permitted by applicable law.
Where a technology is not strictly necessary, we will request consent where required.
With your consent where required, we may use advertising and marketing technologies to measure campaigns, understand advertising effectiveness, build audiences, or deliver more relevant communications and advertising.
Depending on the campaigns we run, these technologies may include:
| Service | Examples | Purpose | Potential Data |
| LinkedIn Insight Tag | LinkedIn cookies/identifiers | Measure LinkedIn campaign conversions and website interactions | Device/browser information, page visits, conversion events |
| Google Ads | _gcl_*, related Google identifiers | Measure advertising performance and, where enabled, remarketing/audience measurement | Advertising identifiers, conversion events, website interactions |
| Meta Pixel | _fbp, _fbc | Measure Meta advertising performance and website conversions | Browser/device information, conversion events and advertising identifiers |
These technologies may allow the relevant advertising provider to receive information about interactions with our website or campaigns.
Legal basis: Consent (Article 6(1)(a) GDPR) where required.
You may refuse or withdraw consent without affecting your ability to use the core platform.
Withdrawing marketing-cookie consent does not necessarily stop all marketing communications. Email marketing preferences are managed separately through the unsubscribe mechanism in our emails or by contacting dpo@inovexus.com.
Our website or platform may contain content or functionality provided by third parties, including:
Depending on how the integration operates, the third party may process technical information or place cookies or similar technologies on your device.
Where required, non-essential third-party technologies will be activated only after the relevant consent has been obtained.
Third-party providers may process information under their own privacy policies and terms.
Where consent is required, we provide a mechanism allowing you to make granular choices about non-essential cookies and similar technologies.
You may:
Your browser may allow you to block or delete cookies. However, blocking strictly necessary cookies may affect the availability or security of certain platform functions.
We may ask you to renew your consent where required by applicable law, including when the technologies or purposes materially change or when the applicable consent period expires.
Where we provide mobile applications, the applications may use technologies such as:
Where consent is required for analytics or personalised advertising, the relevant permission will be requested through the application or the applicable operating-system controls.
In addition to website cookies, our marketing communications may use technologies such as tracking pixels, unique links, or similar mechanisms to determine whether communications have been delivered, opened, clicked, or otherwise engaged with.
We may use this information to:
Where consent is required for such tracking, we will obtain the appropriate consent. You may also opt out of marketing communications at any time using the unsubscribe mechanism provided in the communication or by contacting us at dpo@inovexus.com.
Most web browsers allow you to control or delete cookies through their settings. You can generally:
Browser controls may affect the functionality of our website or platform, particularly where strictly necessary cookies are involved.
Cookie lifetimes vary depending on their purpose and the technology involved. As a general benchmark, consent for non-essential cookies is treated as valid for approximately six months, in line with CNIL guidance, after which we will seek renewed consent.
Some cookies expire when you close your browser, while others may remain for a defined period or until you delete them or withdraw applicable consent.
We seek to configure non-essential cookies and similar technologies with retention periods appropriate to their purpose and to avoid retaining information for longer than necessary.
Where analytics or advertising information is linked to personal data held elsewhere, the applicable retention period may also be governed by our general data-retention policies.
We may update this Cookie Policy when we introduce, remove, or materially change cookies or similar technologies, or where applicable legal or regulatory requirements change.
Where legally required, we will obtain renewed consent before activating newly introduced technologies that require consent.
Last updated: September 2026
Special Categories of Personal Data
We do not routinely seek to collect special categories of personal data under Article 9 GDPR. Where such information is processed, we do so only where necessary and where an applicable legal condition under Article 9 GDPR is satisfied.
Where necessary for an event or service, we may process limited health or accessibility information, such as accessibility requirements or dietary information. Where required, this is processed on the basis of explicit consent or another applicable Article 9 condition.
Information relating to PEP status, sanctions screening, adverse media, criminal-record information or other compliance checks may be processed for AML/CTF, financial-regulatory and fraud-prevention purposes. Access is restricted to authorised personnel.
Data Protection for Minors
Our investment and membership services are intended for adults. We do not knowingly provide investment services or adult membership accounts to persons under 18.
If we become aware that personal data has been collected from a person under 18 in circumstances where the collection was not permitted, we will take appropriate steps to delete the information and, where appropriate, close or restrict the associated account. Where a particular service has different age requirements, those requirements will apply.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our services, technology, business practices or applicable legal and regulatory requirements.
Where changes are material, we will take reasonable steps to notify affected users, which may include email notification, a platform notice or another appropriate communication method. Where the law requires renewed consent, we will obtain that consent before continuing the relevant processing.
Complaint Rights
Email: dpo@inovexus.com
Postal address: 4 Rue Royale, 75008 Paris, France
Final Provisions
This Privacy Policy supplements our Terms of Service and other applicable agreements governing use of the Inovexus platform.
Where there is a conflict between this Privacy Policy and another provision specifically concerning the processing or protection of personal data, the provisions of this Privacy Policy will apply to the extent required by applicable data-protection law.
If any provision of this Privacy Policy is determined to be invalid, unlawful, or unenforceable by a competent authority or court, that provision will be interpreted or modified to the extent necessary to make it lawful and enforceable where possible.
The remaining provisions will continue to apply to the fullest extent permitted by law.
This Privacy Policy is drafted in English.
Translations may be provided for convenience. Where a translation differs from the English version, the English version will prevail, except where applicable law requires otherwise.
This Privacy Policy is governed by applicable French law and by the General Data Protection Regulation (EU) 2016/679 (GDPR), together with other applicable European and national data-protection legislation.
Any dispute concerning this Privacy Policy will be subject to the jurisdiction of the competent courts under applicable law.
Nothing in this section limits any mandatory rights you may have under applicable consumer, data-protection, or other laws, including any right to bring proceedings before the courts having jurisdiction under those laws.
We review this Privacy Policy periodically and at least annually, as well as when there are material changes to:
Next scheduled review: August 2027
The Privacy Policy will display its most recent update date.
For privacy questions, data-subject rights requests, complaints, or other matters concerning the processing of personal data, you may contact:
Data Protection Officer / Privacy Contact
Email: dpo@inovexus.com
Postal address: 4 Rue Royale, 75008 Paris, France
We do not publish a dedicated privacy telephone number. Where telephone contact is necessary, we will provide an appropriate contact method on request.
Version Control and Archive
Date
Consolidated the duplicated Cookie Policy section into one, corrected a legal-citation reference, and aligned cookie-consent renewal with the CNIL ~6-month benchmark
Date
Summary of changes
Date
Summary of changes
Date
Summary of changes
Date
Summary of changes
Date
Summary of changes
Date
Summary of changes
We will communicate material changes to this Privacy Policy in an appropriate manner, taking into account the nature and significance of the change.
Where a change materially affects how we process personal data, we may notify affected users through one or more of the following:
Where applicable law requires renewed consent, we will obtain the required consent before carrying out the affected processing.
We will not treat continued use of the platform as consent where applicable law requires an affirmative consent mechanism.
Changes that are administrative, corrective, security-related, or otherwise non-material may be reflected through an updated version and effective date without advance individual notification where permitted by law.
We maintain previous versions of this Privacy Policy for appropriate historical, accountability, and regulatory purposes.
Where reasonably necessary, you may request a copy of the version of the Privacy Policy that applied to the processing of your personal data during a particular period by contacting:
dpo@inovexus.com
When making such a request, please identify the approximate period or date for which you require the historical version.
We may also provide relevant historical versions to competent supervisory authorities where legally required or reasonably necessary for regulatory purposes.
End of Privacy Policy
For questions regarding this Privacy Policy, your personal data, or the exercise of your GDPR rights, contact dpo@inovexus.com or write to:
Inovexus
4 Rue Royale
75008 Paris, France
Appendices
The following table provides a high-level summary of the principal legal bases used for processing. The applicable legal basis may vary depending on the specific service, relationship, jurisdiction, and circumstances of the processing.
| Processing Activity | Data Categories | Primary Legal Basis (GDPR Art. 6) | Additional Basis / Context | Typical Retention |
| Account creation and management | Identity, contact information, account credentials | (b) Contract performance | (f) Legitimate interests for security and service protection | Account duration + applicable post-account period |
| KYC / AML verification | Identity, financial information, verification documents, compliance information | (c) Legal obligation | Applicable AML/CTF and financial-regulatory requirements | As required by applicable law |
| Investment processing | Identity, financial, transaction and contractual information | (b) Contract performance and (c) Legal obligation | Applicable financial, commercial and tax requirements | As required by applicable law |
| AI matching and recommendations | Profile information, investment preferences, professional information, relevant platform activity | (b) Contract performance and/or (f) Legitimate interests, depending on the specific processing | (a) Consent where required for optional profiling or non-essential processing | Account duration and/or applicable analytics period |
| Community platform | Profile, professional information, communications and community activity | (b) Contract performance | (f) Legitimate interests for security, moderation and service improvement; (a) Consent where required for optional visibility/sharing | Account duration + applicable post-account period |
| Marketing communications | Contact information, communication preferences and engagement information | (a) Consent where required | (f) Legitimate interests where permitted by applicable direct-marketing law | Until withdrawal or applicable suppression/record-keeping period |
| Analytics and service improvement | Technical information, usage data, interaction data and aggregated/pseudonymised information | (a) Consent where required for non-essential analytics | (f) Legitimate interests for strictly operational analytics where legally permitted | Typically up to 24 months, depending on purpose |
| Security and fraud prevention | Technical, account, authentication, transaction and other relevant information | (f) Legitimate interests | (c) Legal obligation where applicable | Varies according to incident, security and legal requirements |
| Tax reporting and compliance | Identity, financial and transaction information | (c) Legal obligation | Applicable tax legislation and reporting requirements | As required by applicable tax law |
| Event management | Contact, registration, attendance and event information | (b) Contract performance | (a) Consent for optional photography/media use or certain sensitive information where required | Typically limited to the period necessary for the event and related operational purposes |
| Customer support | Contact information, account information and support communications | (b) Contract performance | (f) Legitimate interests for service quality, security and legal claims | Typically up to 3 years after resolution, subject to applicable requirements |
| Legal claims and dispute management | Relevant account, communication, transaction and other evidence | (f) Legitimate interests | (c) Legal obligation where applicable | For the duration of the relevant claim or applicable limitation/retention period |
Key
The legal basis identified in this table does not override any specific limitation, exemption, or additional requirement applicable to a particular processing activity.
Our principal third-party processors are described in Section 8.2 — External Processors of this Privacy Policy.
Processors may engage approved sub-processors, including infrastructure, hosting, security, analytics, communication, payment, and other service providers necessary to provide their services.
We maintain appropriate contractual arrangements with processors and, where required, sub-processors, including data-processing agreements and applicable international-transfer safeguards.
Our processor-management practices include:
Where appropriate and legally required, we will inform users of material changes to relevant processors or sub-processors.
For questions regarding our processors or sub-processors, contact:
dpo@inovexus.com
C.1 Internal Breach Classification
We maintain an internal incident-response framework for assessing and managing security incidents and personal-data breaches.
Incidents may be classified according to their nature, scope and potential impact, including:
The classification may be revised as additional information becomes available.
C.2 Notification to Supervisory Authorities
Where a personal-data breach is likely to result in a risk to the rights and freedoms of individuals, we will notify the competent supervisory authority without undue delay and, where required by Article 33 GDPR, within 72 hours after becoming aware of the breach.
Where the breach is unlikely to result in a risk to individuals, notification to a supervisory authority may not be required.
Where notification is made after the 72-hour period, we will provide the reasons for the delay where required.
C.3 Notification to Affected Individuals
Where a personal-data breach is likely to result in a high risk to the rights and freedoms of affected individuals, we will notify those individuals without undue delay, unless an applicable GDPR exception applies.
Where appropriate, notification may include:
Notification may be provided by email, platform notification, postal communication, website notice, or another appropriate communication method depending on the circumstances and applicable law.
C.4 Incident Register
We maintain records of personal-data breaches and relevant security incidents as required by applicable law.
Records may include:
C.5 Post-Incident Review
Material personal-data breaches are subject to a post-incident review appropriate to their severity.
Where appropriate, the review includes:
We regularly test and update our incident-response procedures to improve our ability to detect, contain, investigate and respond to security incidents and personal-data breaches.
