This notice is issued jointly by the two BlackFin entities that manage and market the alternative investment funds of the BlackFin group (the Funds). Each is a controller of the personal data described below, in respect of the processing it carries out.
A société par actions simplifiée with registered office at 2 place Rio de Janeiro, 75008 Paris, France, registered with the R.C.S. Paris under number B 509 679 304. Authorised and supervised by the Autorité des marchés financiers (AMF) as a portfolio management company, approval number GP-09000005.
A société à responsabilité limitée with registered office at 2 rue Henri M. Schnadt, L-2530 Luxembourg, Grand Duchy of Luxembourg, registered with the Luxembourg Trade and Companies Register under number B 293277. Authorised and supervised by the Commission de Surveillance du Secteur Financier (CSSF) as an alternative investment fund manager under Chapter 2 of the Luxembourg law of 12 July 2013 on alternative investment fund managers, authorisation number A00004236.
In this notice, BlackFin, we, us and our mean both entities, each as and when applicable to the processing concerned.
This notice applies to personal data we process in the course of our activities as a fund manager, whether for our own account or as manager of a Fund. It covers investors and prospective investors in the Funds; individuals connected with the companies we invest in or consider investing in; individuals connected with our service providers, advisers, counterparties and other business contacts; job applicants; and visitors to our website.
Where any of these is a legal person, this notice also covers its Related Persons, meaning the individuals acting on its behalf or otherwise connected with it, including its contact persons, directors, officers, authorised signatories, employees, advisers and its beneficial owners and controlling persons.
It does not cover personal data of our own personnel, which is dealt with in a separate notice, nor personal data processed by a Fund’s administrator, depositary, transfer agent or auditor in its own capacity as controller.
We obtain personal data directly from you; from the legal person you are connected with, where you are a Related Person; from publicly available and commercial sources, including trade and beneficial ownership registers, sanctions and politically exposed person databases, adverse media and screening tools; and from intermediaries such as placement agents, distributors and recruitment agencies.
The categories of personal data we process are identification and contact details; professional and background information; financial, banking and tax information; investment, commitment and transaction records; due diligence and screening information, which may include information relating to criminal convictions and offences; correspondence and records of our dealings with you; and technical data generated when you use our website or systems.
We process personal data only where a legal basis under Regulation (EU) 2016/679 (the GDPR) applies.
| Purpose | Who it mainly concerns | Legal basis |
|---|---|---|
| Complying with our legal and regulatory obligations, including anti-money laundering and counter-terrorist financing checks, know-your-customer and ongoing due diligence, sanctions and politically exposed person screening, FATCA and CRS tax reporting, regulatory reporting to and requests from the CSSF, the AMF and other authorities, and record-keeping | Investors and prospective investors and their Related Persons; individuals connected with portfolio companies, counterparties and service providers | Compliance with a legal obligation (Article 6(1)(c) GDPR) under the anti-money laundering, tax transparency and fund management legislation applicable to us, in particular Directive (EU) 2015/849 as amended, Council Directive 2014/107/EU, Directive 2011/61/EU and Commission Delegated Regulation (EU) No 231/2013, together with the FATCA intergovernmental agreements, in each case as implemented in Luxembourg and in France |
| Entering into and managing investments in the Funds, including onboarding, subscriptions and transfers, capital calls and distributions, maintaining the register of partners, investor reporting, meetings and consents, and operating the investor portal | Investors and prospective investors and their Related Persons | Performance of a contract to which you are party, or steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR), where you are the investor; otherwise our legitimate interests (Article 6(1)(f) GDPR) in administering the Funds and the investor relationship |
| Running and developing our business, including marketing the Funds and maintaining our contacts, sourcing, evaluating and executing investments, monitoring and supporting portfolio companies and exit processes, appointing and overseeing service providers, advisers and counterparties, recruitment, and operating and securing our systems and website | Prospective investors and business contacts; individuals connected with portfolio companies, service providers, advisers and counterparties; job applicants; website visitors | Our legitimate interests (Article 6(1)(f) GDPR) in conducting and developing our business; performance of a contract or pre-contractual steps (Article 6(1)(b) GDPR) where we are contracting with you or assessing your application; your consent (Article 6(1)(a) GDPR) for non-essential cookies and, where required, electronic marketing |
| Protecting our legal position, including establishing, exercising or defending legal claims, and managing complaints, audits, insurance and corporate transactions | Any of the categories covered by this notice | Our legitimate interests (Article 6(1)(f) GDPR) in protecting our position, and compliance with a legal obligation (Article 6(1)(c) GDPR) where applicable |
Where personal data is required by law or under a subscription agreement, we cannot accept or maintain the investment, or continue the relationship, if it is not provided.
If you are a legal person and you provide us with personal data relating to any of your Related Persons, you must, to the extent required under applicable data protection law, give each of them a copy of this notice before, or as soon as reasonably practicable after, providing that data to us. We may assume that you have done so.
We do not sell personal data. We share it, only where necessary for the purposes set out above, with the following categories of recipient:
Where a recipient processes personal data on our instructions, we put in place a written agreement.
Some disclosures cannot be notified to you. In particular, where we make a report under anti-money laundering legislation, we are prohibited by law from informing you of it.
As part of our services to investors, we make available an Investor Portal. The Investor Portal is an internet-based hosted platform made available by Intralinks, Inc.
We draw your attention to the legal notices available on the Intralinks website (intralinks.com), including the End User Agreement ([www.intralinks.com/eula](https://www.intralinks.com/eula)) and the Privacy Policy ([www.intralinks.com/privacy-policy](https://www.intralinks.com/privacy-policy)) of Intralinks, which apply to investors when making use of the Investor Portal.
BlackFin Paris and BlackFin Luxembourg are both established within the European Economic Area, so sharing between them does not involve a transfer outside the EEA.
Personal data may nevertheless be transferred to, or accessed from, a country outside the EEA, in particular where an investor, a Related Person, a portfolio company, a counterparty or an adviser is established outside the EEA, where a service provider or a sub-processor engaged by it operates or provides support from outside the EEA, or in the course of FATCA reporting to the United States tax authorities.
We make such transfers only where a mechanism under Chapter V GDPR applies, namely an adequacy decision of the European Commission, the standard contractual clauses adopted by the European Commission supplemented where necessary by additional measures, or a derogation under Article 49 GDPR. Details of the safeguards we rely on are available on request.
We keep personal data only for as long as necessary for the purpose for which it was collected.
The period depends on that purpose and on any retention period prescribed by law. In particular, anti-money laundering and know-your-customer records are retained for the period required under applicable anti-money laundering legislation, and Fund records are retained for at least five years under Article 66 of Commission Delegated Regulation (EU) No 231/2013, and for longer where the CSSF or the AMF so requires or where accounting and commercial retention rules apply.
Beyond those periods we retain personal data where it remains necessary to establish, exercise or defend legal claims, or to respond to a claim, investigation, audit or regulatory request, until that matter is concluded and any applicable limitation period has expired.
Subject to the conditions and limits set out in the GDPR, you may ask us for access to your personal data and a copy of it, for the rectification of inaccurate or incomplete data, for erasure, for restriction of processing, and for portability where processing is based on your consent or on a contract and carried out by automated means. Where the processing is subject to French law, you may also give directions as to the retention, erasure and communication of your personal data after your death, and designate a person to carry them out. Where we rely on your consent, you may withdraw it at any time, without affecting the lawfulness of processing before withdrawal.
You may object at any time to processing based on our legitimate interests, and at any time to processing for direct marketing, including the marketing of our Funds to you.
Where you object to direct marketing we will stop. Otherwise we will stop unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless we need the data to establish, exercise or defend legal claims.
Before acting on a request we may ask you to confirm your identity, including by providing a copy of an identity document. We use anything provided for that purpose only to verify the request.
Much of what we hold is retained because the law requires it. We cannot erase or restrict personal data we are required to keep under anti-money laundering, tax, fund or accounting legislation, or that we need for legal claims. We may also be unable to give access to information subject to legal privilege, that would reveal another individual’s personal data, that is commercially confidential, or whose disclosure is restricted by law. Where we cannot act on a request in full, we will tell you why.
We may update this notice. Where we intend to process your personal data for a purpose other than that for which it was collected, we will inform you of that purpose before doing so. The version published on our website replaces any previous version.
To exercise a right, or for any question about this notice, write to dataprotection@blackfin.com
If you are not satisfied with how we have handled your personal data, we would ask you to contact us first so that we can try to resolve the matter.
You may in any event lodge a complaint with a supervisory authority, in particular in the Member State of your residence or place of work, or where the alleged infringement took place.
