Cookies & Storage
We use strictly necessary storage to run this website. With your consent we also store an anonymous identifier on your device to measure how the site is used, so we can improve it. You can decline without any loss of functionality, and change your choice at any time. Read more in our Privacy Policy.
Legal
Worthwhile Capital Partners Sweden Kommanditbolag (WCP KB) and Worthwhile Capital Partners Nordic AB (WCP AB), together "Worthwhile Capital Partners", "we", or "us" act as separate data controllers1 for our respective data processing activities:
Contact us at the address below for questions regarding our processing of personal data. The same applies if you wish to exercise your rights under section 5 below.
Contact details for both entities:
Email: info@worthwhilecap.com
Email GDPR contact person: carina.eklof@worthwhilecap.com
Address: Kungsgatan 8, 114 25, Stockholm, Sweden
This policy uses the following terms and definitions:
Personal data refers to all kinds of information that can be directly or indirectly attributed to a living natural person. Such information includes images and sound recordings that are processed electronically regarding which no names need to be mentioned. Encrypted information and various forms of electronic identification (e.g., IP numbers) are deemed as personal information if they can be linked to natural persons.
Processing of personal data refers to any operation regarding personal data. Every operation undertaken with regard to personal data constitutes a processing; irrespective of whether it is performed automatically or not. Examples of common operations are collection, registration, organisation, structuring, storage, processing or rectification, transfer and deletion.
The data subject refers to the person to whom the personal data refers, i.e., we will continually refer to the data subject as "you" or "your" in this privacy statement.
Sensitive data refers to personal data regarding racial or ethnic origin, personal opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, and data concerning a natural person's sex life or sexual orientation.
Rights refer to the rights of the data subject under the GDPR. Your rights are listed below in section 5. These rights are also described in more detail on the Swedish Authority for Privacy Protection website.
Third Country refers to any country outside the European Union (EU) or European Economic Area (EEA).
Investment Manager refers to our counterparties under their respective agreements.
The Investor refers to our clients for the purpose of soliciting and facilitating their commitment to an investment managed by the Investment Manager.
While we are not required by law to appoint a formal Data Protection Officer (DPO), our Chief Operating Officer ("COO") serves as our designated GDPR contact person. For contact information, see section 1.
Data controller: WCP KB
Purpose and legal basis: Under the Act (2017:630) on Measures against Money Laundering and Terrorist Financing ("AML Act"), we are legally required to conduct due diligence (KYC) to detect and prevent money laundering and terrorist financing. KYC is carried out before entering a business relationship, when existing information is uncertain, when circumstances change, or when suspicious activity is detected. Our KYC procedures include verifying the identity of Investment Managers and beneficial owners and determining whether they are Politically Exposed Persons (PEPs) or appear on sanctions lists.
The processing of personal data for these purposes is based on a legal obligation.
Categories of personal data:
In order to ensure that information processed by us is accurate and up to date, we may also obtain information from population registers, the company registers, the beneficial ownership register, the sanctions list, and the register of persons with PEP status.
Recipient of personal data: Personal data processed in connection to our KYC measures is stored in our Microsoft 365. Furthermore, we may share the information with other IT and system vendors that provide support for our systems and cloud services. We may also share information with the Financial Intelligence Unit within the Swedish Police if such disclosure is prescribed by law.
Storage of personal data: We retain the personal data collected in accordance with our obligations under the AML Act during the relationship with the Investment Manager and for five (5) years after the termination of the relationship.
If the conditions in the Swedish Financial Supervisory Authority's regulations and general guidelines (FFFS 2017:11) regarding measures against money laundering and terrorist financing are met, we are obligated to retain the personal data for ten (10) years. This may be the case, for example, if there is a suspicion of money laundering or terrorist financing, if suspected money laundering or terrorist financing has been reported to the Swedish Police Authority, or if a law enforcement authority has requested it.
Data controller: WCP KB
Purpose and legal basis: We process personal data for the purpose of entering into agreements with our Investment Managers and register them in our system. The legal basis for this treatment consists of the agreements.
We process your personal data for the following purposes in order to fulfil our contractual obligations:
The provision of your personal data is not a statutory requirement; however, it is a requirement that is necessary in order to enter into an agreement with us. If you do not provide your personal information to us, we will be able to neither fulfil our agreement nor our obligations in relation to you.
We process your personal data for the following purposes on the basis of our legitimate interest (in the balancing of interests, we have assessed that the Investment Manager has a legitimate interest in the assignment being handled in a satisfactory manner): to be able to perform and administer the assignment, to be able to manage and administer our fee accounting and to safeguard our rights in other legal claims against us.
Categories of personal data: We process the following categories of personal data:
Recipient of personal data: The information is stored in our CRM system HubSpot and Microsoft 365. In the event that an agreement is signed by electronic signature, the information is shared with the supplier DocuSign. We store data related to the execution of the assignment in Microsoft 365, which is where we store our agreement documents. Furthermore, we may share the information with other IT and system vendors that provide support for our systems and cloud services. We may also share information with business partners within the scope of the execution of the assignment. Other parties engaged by the Investment Manager may also receive information in accordance with the Investment Manager's instructions. In addition to the above, information may be shared with governmental authorities if such disclosure is prescribed by law.
Storage of personal data: The personal data is stored for the duration of the agreement and up to seven (7) years thereafter.
Data controller: WCP KB
Purpose and legal basis: We need to process personal data to conduct independent analyses, and research. We process your personal data for the following purposes on the basis of our legitimate interest (in the balancing of interests, we have assessed that the Investors have a legitimate interest to obtain reports and analyses): To be able to perform and administer independent analyses and to be able to perform marketing reports.
Categories of personal data: Name, role, employer, professional contact details, publicly available financial or market data.
Recipient of personal data: Our CRM system HubSpot and Microsoft 365.
Storage of personal data: The personal data is stored for the duration of the agreement and up to (7) seven years thereafter.
Data controller: WCP KB
Purpose and legal basis: We process personal data in order to administer our contractual relationship with suppliers and business partners. The processing of personal data of contact persons/representatives of suppliers/business partners is for the purposes of performing the agreement, fulfilling our obligations towards our suppliers/business partners, as well as handling deliveries, and communication. The legal basis for our processing in these cases is our legitimate interest in being able to perform and fulfil our agreements with our suppliers/business partners. In the balancing of interests, we have assessed that the contact person/representative has an interest in the fulfilling of our obligations to our suppliers/business partners.
Categories of personal data: We process names, telephone numbers and email addresses regarding the contact person/representatives of suppliers/business partners with whom we have a business relationship.
Recipient of personal data: We store the data in Microsoft 365 which is our cloud-based service for document storage. Furthermore, we may share the information with other IT and system vendors that provide support for our systems and cloud services.
Storage of personal data: We save personal data in order to fulfil our agreement with each individual supplier/business partner. Information regarding the contact person/representative is therefore processed for the time that is deemed necessary for us to be able to administer the contractual relationship, exercise our rights and fulfil our obligations in relation to each individual supplier/business partner. In the event that your employment or your assignment with the supplier/business partner ends, we will terminate our processing of your personal data as soon as we have received such information. Agreements that contain your personal information are stored for ten (10) years from the termination of our business relationship due to the limitation period set forth in the Limitation Act.
Data controller: WCP KB
Purpose and legal basis: In order for us to be able to handle invoices, we need to process personal data. The processing is for accounting purposes regarding invoicing or payment of services or products, which is based on the fulfilment of legal requirements that are incumbent on us under the Bookkeeping Act.
It is not a requirement to provide us with your personal data. However, without this data, we will be able to neither fulfil our agreement nor obligations in relation to you.
We process your personal data for the following purposes in order to fulfil our contractual obligations: To be able to handle invoicing and to be able to make payments for services or products.
We process your personal data for the following purposes in order to comply with legal requirements: To be able to perform our accounting in accordance with the Bookkeeping Act (1999:1078).
Categories of personal data: We process the following categories of personal data: name, address, email address and telephone number of the contact person/representative (employee) of suppliers/business partners with whom we have a business relationship, and invoice and payment information.
Recipient of personal data: We store the data in Microsoft 365 which is our cloud-based service for document storage. The information is also shared with IIAS AB which is engaged for financial and accounting services. Furthermore, we may share the information with other IT and system vendors that provide support for our systems and cloud services.
Storage of personal data: Information regarding payments, and any processing that is required under the Bookkeeping Act is stored for seven (7) years in accordance therewith.
Data controller: WCP KB
Purpose and legal basis: Our newsletters contain information about marketing updates and information about our activities, particular funds, and investment opportunities. Newsletters are sent out for two purposes: existing Investors, the newsletters form part of the service for the purpose of updating Investors on information that is relevant to the Investors' business. The legal basis in this case is the agreement with the Investment Manager. For other recipients of newsletters (stakeholders, other contact persons specified by the Investor, potential Investors), sending out newsletters constitutes a marketing measure. The legal basis in these cases is either consent provided when registering for a newsletter subscription or a legitimate interest as the recipients can benefit from the content in a professional context.
We may, from time to time, send postal correspondence or packages to Investors, for example in connection with seasonal greetings, such as Christmas cards or gifts, or other relationship management purposes. The legal basis for such processing is the Firm's legitimate interest in maintaining and developing relationships with its Investors in accordance with Article 6(1)(f) of the GDPR.
Categories of personal data: The personal data that is processed consists of the name, address and email address of the Investor and other interested parties that are employed by the Investor, or another contact person specified by the Investor.
Recipient of personal data: The information is stored in our CRM system HubSpot. When sending out invitations, WCP uses HubSpot, which means that information regarding name and email address is transferred to this system provider.
Storage of personal data: To facilitate future mailings, we keep mailing lists. We continuously erase data from mailing lists, partly if we no longer have a legitimate interest in sending out newsletters to you, and partly if you have requested not to receive further mailings.
Purpose and legal basis: We arrange seminars and other events for which invitations are sent out to Investors and other interested parties, partly for marketing purposes, partly for the purpose of informing a wider audience about news regarding macroeconomic and geopolitical activity and trends. The legal basis in these cases is a legitimate interest (in the balancing of interests, we have taken into account our interest in providing events and seminars to inform and market our activities whilst the attendees benefit from the content from a professional perspective).
Categories of personal data: The personal data that is processed for marketing purposes consists of the name and email address of the Investor and other interested parties who are employed by the Investor, or another contact person specified by the Investor.
Recipient of personal data: The information is stored in HubSpot, which is our cloud-based service for document storage. When sending invitations, we use HubSpot which means that information regarding name and email address is transferred to this system provider.
Storage of personal data: To facilitate future mailings, we maintain mailing lists. We continuously erase data from mailing lists and in the event that you request not to receive more mailings. Data erasure is also performed on an ongoing basis in this regard, and upon your request.
Purpose and legal basis: We process personal data to maintain the functionality and security of our website, and, where you consent, to measure how the website is used so that we can improve it. For strictly necessary storage required to operate and secure the website, the legal basis is our legitimate interest (in the balancing of interests, we have taken into account our interest in providing a relevant and secure website whilst the visitor benefits from the information on the website). This storage is used regardless of the choice you make in the cookie banner. For analytics, we store an anonymous identifier on your device to measure and analyse website usage. This is done only with your consent, which you give by selecting "Accept analytics" in our cookie banner. The legal basis is your consent under Article 6(1)(a) of the GDPR. You can decline without any loss of website functionality, and you can withdraw or change your choice at any time through the cookie banner. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
Categories of personal data: IP address, browser type, device identifiers and website activity data processed to run and secure the website; and, where you consent, an anonymous identifier and aggregated usage data collected for analytics purposes.
Recipients of personal data: Website hosting and IT service providers. Our website is operated by Clever Cloud (hosting), and its data, including the login used by our internal staff and the website usage data described above, is stored in a Supabase database. Both Clever Cloud and Supabase are configured to store data within the EU/EEA. We do not use a third-party analytics provider; the usage data is analysed by us internally. Access to the website login is limited to WCP staff.
Storage period: Technical information is processed only for as long as necessary to maintain website functionality and security. Your consent choice is stored so that we can respect it on future visits.
Data controller: WCP AB
Purpose: We collect and process personal data in order for us to be able to handle applications, interviews, and make decisions in a recruitment process. The overall purpose of a recruitment process is that we should be able to employ people with the right skillset for a vacancy. We may also save the personal information in our CV database in order to contact the applicant for a future recruitment process.
Legal basis: The legal basis for the processing consists of entering into an agreement and our legitimate interest in being able to receive and handle an application for employment.
It is not a requirement to provide us with your personal data. However, without this data, we will not be able to fulfil our obligations to you in the performance of our recruitment process.
Categories of personal data: Within the scope of a recruitment process, we process the following categories of personal data:
It is essential that, as an applicant, you refrain from providing information that is not relevant to your application. When applying, you are not required to disclose any sensitive personal data, including information concerning ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, or gender. As a job applicant, you need only submit personal information about yourself in the form of a cover letter. Should we obtain references regarding your application, personal information will be exchanged between us and the referees.
Recipients: The personal data that is collected and processed will only be available to selected employees.
Storage period: We retain personal data for the duration of the recruitment process. Personal information obtained from unsuccessful applicants is deleted after (2) two years, in accordance with the Discrimination Act. We may also retain applications from candidates who have expressed interest in future recruitment opportunities. In such cases, the data will be stored for a maximum period of (2) two years. However, you may at any time choose not to be contacted in the future by declining further processing of your data.
Individuals whose personal data we process have the following rights under applicable law:
The right to request access (so-called extract from the register)
You are entitled to be informed about the processing that we perform regarding you. This must include a description of the purpose and legal basis of the processing, which categories of personal data it concerns and who receives the personal data. We have compiled this information as outlined above for your ease of reference. An extract from the register means that you are provided with an overview of the processing so that you may understand if, and for what purpose, your personal data is processed.
The right to request rectification or deletion of incorrect or unnecessary data
If you believe that we have processed your personal data incorrectly, or that it may need to be rectified, you have the right to request that we correct the data, and, if you do not want us to continue processing the personal data, you have the right to request that we erase the data. We will rectify or delete the personal data if it is possible in respect of our purpose for the processing and the legal requirements that we are under a duty to follow. If you believe that the personal data we store about you is inaccurate, that our processing is illegal or that we do not need the data for a specific purpose, you have the right to request that we restrict our processing of your personal data. You can also request that we shall restrict the process of your personal data while we investigate whether your request to exercise any other rights can be granted.
The right to object under certain circumstances
You have the right to object at any time to the processing of your personal data if the legal basis for the processing consists of the performance of a task in the public interest, or a balancing of interests. If you object, we will examine whether our interest to process your data outweighs your interest in not having your personal data processed. You also have the right to object at any time to the processing of your personal data on the grounds of direct marketing.
The right to data portability
You have the right to retain the personal data that have been provided to us and have the right to transfer this data to another personal data controller subject to: a) it is being technically feasible; and b) the legal basis for the processing consists of consent, or that the processing was necessary for the fulfilment of an agreement.
The right to withdraw consent
If the processing of personal data is based on consent, you have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
The right to lodge a complaint regarding the processing of personal data
You always have the right to contact the Swedish Authority for Privacy Protection in order to lodge a complaint linked to our processing of personal data. Below you will find the contact information for the Swedish Authority for Privacy Protection. Telephone number: 08-657 61 00 and Email address: imy@imy.se.
If you, as a data subject, wish to exercise your rights or have a response to other questions, you can find our contact information set out in Section 1. You have the right to contact us as an alternative to contacting the Swedish Authority for Privacy Protection.
We use IT systems to protect the confidentiality, privacy and access to personal data. We have taken special security measures to protect your personal data against illegal or unauthorized processing (illegal access, loss, destruction, or damage). Access is granted only to those persons that need to process your personal data in order for us to fulfil the purposes set forth herein.
We may, from time to time, disclose information to relevant third parties (including, but not limited to, situations where we have a legal obligation to do so). In order to ensure that personal data is processed in a safe and secure manner in each case, we have a routine of drawing up a personal data assistant agreement with each external party that processes personal data on our behalf. The sharing of personal data with third parties is to be found in Section 4.
We always aim to only process personal data within the EU/EEA. Where appropriate we may share personal data with a third party in a country outside the EU/EEA, a so-called third country. In the event of a transfer to a third country, we will ensure that such transfer is made in accordance with applicable data protection legislation, either by basing the transfer on an adequacy decision by the European Commission or by using the European Commission's standard contractual clauses in combination with organizational and technical safeguards.
Personal data may be transferred to the following recipients outside the EU/EEA:
Foreign representatives
We may contact foreign representatives outside the EU/EEA and therefore personal data may be transferred to third countries (e.g. in cross-border Investor matters). The countries concerned depend on the circumstances in the individual case.
System providers
Microsoft Office 365
In the operation of our business, we use Microsoft Office 365 as system provider. In connection with Microsoft receiving personal data about you, your personal data may be transferred to, for example, the United States. For more information about how Microsoft processes personal data see: https://privacy.microsoft.com/en-us/privacystatement. To read more about the transfer of personal data to third countries and to access the standard contractual clauses, see: https://learn.microsoft.com/en-us/compliance/regulatory/offering-eu-model-clauses.
HubSpot
In the operation of our business, we use HubSpot as system provider. In connection with HubSpot receiving personal data about you, your personal data may be transferred to, for example, the United States. For more information about how HubSpot processes personal data, about the transfer of personal data to third countries, and to access the standard contractual clauses, see: https://legal.hubspot.com/privacy-policy.
AI tool providers
Claude (Anthropic)
In the operation of our business, we use Claude, an AI assistant provided by Anthropic, under Anthropic's commercial terms for business customers. Under these terms, Anthropic does not use our inputs or outputs to train its models. In connection with Anthropic receiving personal data about you, your personal data may be transferred to, for example, the United States; for customers in the EEA, the contracting entity is Anthropic Ireland, Limited. Such transfers are made on the basis of the European Commission's standard contractual clauses. For more information about how Anthropic processes personal data, see: https://www.anthropic.com/legal/privacy and https://www.anthropic.com/legal/commercial-terms.
ChatGPT (OpenAI)
In the operation of our business, we use ChatGPT, an AI assistant provided by OpenAI, under a business plan for which OpenAI does not use our data to train its models by default. For customers in the EEA, the contracting entity is OpenAI Ireland Limited. In connection with OpenAI receiving personal data about you, your personal data may be transferred to, for example, the United States. Such transfers are made on the basis of the European Commission's standard contractual clauses. For more information about how OpenAI processes personal data, see: https://openai.com/policies/eu-privacy-policy/ and https://openai.com/policies/data-processing-addendum/.
Lovable
In the operation of our business, we use Lovable, an AI-assisted software development tool, under a business plan governed by Lovable's Data Processing Agreement. Lovable is operated by Lovable Labs Incorporated, with an EU representative, Lovable Labs AB, in Stockholm, Sweden. In connection with Lovable receiving personal data about you, your personal data may be processed in the United States or other jurisdictions outside the EU/EEA, including by Lovable's subprocessors. Such transfers are made on the basis of the European Commission's standard contractual clauses and, where applicable, the UK and Swiss addenda. For more information about how Lovable processes personal data and its subprocessors, see: https://lovable.dev/privacy and https://trust.lovable.dev/.
Jamie
In the operation of our business, we use Jamie to record and transcribe meetings. Jamie is operated by wespond UG, based in Germany, which processes meeting data mainly within the EU/EEA. Certain processing, such as voice processing carried out by its subprocessor Eleven Labs, takes place in the United States. Such transfers are made on the basis of the EU-U.S. Data Privacy Framework and, where applicable, the European Commission's standard contractual clauses. For more information about how Jamie processes personal data, see: https://www.meetjamie.ai/privacy-policy.
Social media:
When you visit our social media platform LinkedIn, your personal data is also collected and processed by the company providing such platform (LinkedIn). By using the service, your personal data is processed by LinkedIn Ireland Unlimited Company. For more information on the processing, transfer of personal data to third countries and to read the standard contractual clauses, see:
We reserve the right to amend and update the privacy statement. We will provide information in an appropriate manner in the event of material changes to the privacy statement, or if existing data is to be processed in another way than stipulated herein. The latest version is available on our website.
1 Although the two entities share certain administrative functions and technical infrastructure, each entity independently determines the purposes and means of its respective processing of personal data. Accordingly, they are not considered joint controllers within the meaning of Article 26 of the GDPR.