Privacy Notice

Onboarding Application Collection Portal · VEA Corporate Finance

This notice explains how the VEA Corporate Finance ("VEA", "we") collects and processes your personal data when you complete an onboarding application through this portal. We are the data controller for this processing.

1. What we collect

• Identity and contact details you enter (such as name, email, phone, city, country, and any custom fields included in your invitation).
• Where requested, a copy of a valid identity document (e.g. passport or national ID).
• Technical data: your IP address and browser user-agent, recorded for security and fraud prevention.

2. Why we process it, and our lawful basis

We process your data to receive, verify and manage your onboarding application. Our lawful basis is your consent (Article 6(1)(a) GDPR), which you give by ticking the consent box on the form, and—where applicable—the performance of, or steps toward, an agreement with you (Article 6(1)(b)). You may withdraw consent at any time (see Section 7).

3. Data minimisation

Each invitation link requests only the fields necessary for that purpose. We do not require an identity document unless verification is genuinely needed.

4. Recipients and international transfers

Your submission is delivered directly to VEA's secure systems. We do not sell your data. This portal uses the following third-party services, which may process limited technical data (such as your IP address) outside the European Economic Area, including in the United States:

• Google reCAPTCHA — bot/fraud protection. Subject to Google's Privacy Policy.
• Google Translate — optional on-page translation, only if you enable it.

These transfers rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses.

5. Security of your data

All transmission is encrypted with TLS (HTTPS). Identity documents are stored in an access-controlled location, encrypted at rest, and are retrievable only by authorised VEA officers. Access to identity documents is logged.

6. How long we keep it

We retain application data only as long as necessary for the onboarding purpose. By default, identity documents and application records are deleted within 180 days of submission unless a specific legal obligation or an active onboarding process requires otherwise. Records past their retention horizon are automatically purged.

7. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, or port your data, to object to processing, and to withdraw consent at any time. To exercise any of these rights, contact us using your application reference number.

8. Cookies

This portal uses only what is necessary to operate securely. Non-essential third-party scripts (Google reCAPTCHA and Google Translate) load only after you accept them via the cookie banner.

9. Complaints

You have the right to lodge a complaint with your local data protection supervisory authority.

This notice may be updated. Please review it each time you submit an application.