Privacy Policy (US & RoW)

This Privacy Policy explains how we use the personal information that Index Ventures collects or generates both in relation to this website and our products and services.

1. Background

1.1 — Index Ventures (UK) LLP with its registered office at 5–8 Lower John Street, London W1F 9DY and other companies in the Index Ventures group collect and use certain Personal Data. Index Ventures is responsible for ensuring that it uses that Personal Data in compliance with data protection laws.

1.2 — At Index Ventures we respect the privacy of our clients and we are committed to keeping all your Personal Data secure. This Privacy Policy governs the handling of Personal Data by Index Ventures in the course of carrying on commercial activities.

1.3 — We use the following definitions in this Privacy Policy: “Index Ventures” “we” or “us” means Index Ventures (UK) LLP and other companies and funds in the Index Ventures group. “Personal Data” means any data which relates to a living individual who can be identified from that data or from that data and other information, which is in the possession of, or is likely to come into the possession of, Index Ventures (or its representatives or service providers). In addition to factual information, it includes any expression of opinion about an individual and any indication of the intentions of Index Ventures or any other person in respect of an individual.

2. The products and services we provide.

2.1 — This Privacy Policy concerns the following categories of information that we collect about you when providing the following products and services:

2.1.1 — Information we receive through our websites ("Index Ventures Websites"); and

2.1.2 — Information we receive through or in connection with the provision of our products and services ("Services").

3. The types of Personal Data we collect.

3.1 — Many of the Services offered by Index Ventures require us to obtain Personal Data about you to perform the services we have been engaged to provide. In relation to each of the Services described at section 2.1 above, the below chart details the categories of Personal Data that we collect and have collected over the past 12 months:

3.2 — Anonymized data. In addition to the categories of Personal Data described above, Index Ventures will also process further anonymized information and data that is not processed by reference to a specific individual.

4. How we use your information.

4.1 — Your Personal Data may be stored and processed by us in the following ways and for the following purposes:

4.1.1 — For ongoing review and improvement of the information provided on or operation and security of Index Ventures Websites;

4.1.2 — To assess your application for our Services, where applicable;

4.1.3 — To set you up as a customer;

4.1.4 — To provide you with our Services

4.1.5 — To understand feedback on our Services and to help provide more information on the use of those products and services quickly and easily;

4.1.6 — To communicate with you to provide you with services or information about Index Ventures and our products and services;

4.1.7 — To understand your needs and interests;

4.1.8 — For the management and administration of our business;

4.1.9 — To comply with and to assess compliance with applicable laws, rules and regulations, and internal policies and procedures;

4.1.10 — For the administration and maintenance of databases storing Personal Data; and / or

4.1.11 — We may process business communications traffic data sent and received by us for the purposes of evaluating our existing or prospective business relationship.

4.2 — However we use Personal Data we make sure that the usage complies with law and the law allows us and requires us to use Personal Data for a variety of reasons. These include where:

4.2.1 — We need to do so in order to perform our contractual obligations with our customers;

4.2.2 — We have obtained your consent;

4.2.3 — We have legal and regulatory obligations that we have to discharge;

4.2.4 — We may need to do so to establish, exercise or defend our legal rights or for the purpose of legal proceedings;

4.2.5 — The use of your Personal Data as described is necessary for our legitimate business interests, such as:

4.2.5.1 — Allowing us to effectively and efficiently manage and administer the operation of our business;

4.2.5.2 — Conducting market research or business analysis;

4.2.5.3 — Maintaining compliance with internal policies and procedures; and

4.2.5.4 — Promoting our business or Index Ventures Services.

4.3 — We will take steps to ensure that the Personal Data is accessed only by employees of Index Ventures that have a need to do so for the purposes described in this Privacy Policy.

5. Disclosure of your information to third parties.

5.1 — We may share your Personal Data within the Index Ventures group of companies for the purposes described above.

5.2 — We may also share your Personal Data outside of the Index Ventures group for the following purposes:

5.2.1 — With our business partners. For example, this could include intermediaries that introduced you to us or through whom you purchased our Services. Personal Data will only be transferred to a business partner who is contractually obliged to comply with appropriate data protection obligations and the relevant privacy and confidentiality legislation;

5.2.2 — With our Service Providers (i.e. third party agents, vendors and contractors) for the purposes of providing services to us (for example, Index Ventures’ accountants, professional advisors, IT and communications providers and debt collectors). These third parties will be subject to appropriate data protection obligations and they will only use your Personal Data as described in this Privacy Policy;

5.2.3 — To the extent required by law, for example if we are under a duty to disclose your Personal Data to comply with any legal obligation (including, without limitation, to comply with tax reporting requirements and disclosures to regulators), or to establish, exercise or defend our legal rights;

5.2.4 — If we sell our business or assets, in which case we may need to disclose your Personal Data to the prospective buyer for due diligence purposes; and

5.2.4 — If we are acquired by a third party, in which case the Personal Data held by us about you will be disclosed to the third party buyer.

5.2.6 — Data that is Not Personal Data. We may create aggregated, de-identified or anonymized data from the Personal Data we collect, including by removing information that makes the data personally identifiable to a particular user. We may use such aggregated, de-identified or anonymized data and share it with third parties for our lawful business purposes, including to analyze, build and improve the Services and/or the Index Ventures Website, and promote our business, provided that we will not share such data in a manner that could identify you.

6. International transfers of personal data.

6.1 — Index Ventures is a global business. Our operations are spread around the world. As a result, we collect and transfer Personal Data on a global basis. That means that we may transfer your Personal Data to locations outside of your country.

6.2 — Where we transfer your Personal Data to another country outside the EEA or UK (as applicable), we will ensure that it is protected and transferred in a manner consistent with legal requirements. In relation to data being transferred outside of Europe or UK (as applicable), for example, this may be done in one of the following ways:

6.2.1 — The country that we send the data to might be approved by the European Commission or UK Government (as applicable) as offering an adequate level of protection for Personal Data;

6.2.2 — The recipient might have signed up to a contract based on “model contractual clauses” approved by the European Commission or UK Government (as applicable), obliging them to protect your Personal Data; or

6.2.3 — In other circumstances the law may permit us to otherwise transfer your Personal Data outside Europe.

6.3 — You can obtain more details of the protection given to your Personal Data when it is transferred outside the EEA or the UK (including a copy of the standard data protection clauses which we have entered with recipients of your Personal Data) by contacting us as described in paragraph 13 below.

7. How we safeguard your information.

7.1 — We have extensive controls in place to maintain the security of our information and information systems. The information that we handle is protected with safeguards appropriate to the sensitivity of the relevant information. Appropriate controls (such as restricted access) are placed on our computer systems. Physical access to areas where Personal Data is gathered, processed, or stored is limited to authorized employees.

7.2 — As a condition of employment, Index Ventures employees are required to follow all applicable laws and regulations, including in relation to data protection law. Access to sensitive Personal Data is limited to those employees who need to it to perform their roles. Unauthorized use or disclosure of confidential client information by an Index Ventures employee is prohibited and may result in disciplinary measures.

8. How long we keep your personal data.

8.1 — How long we will hold your Personal Data for will vary and will be determined by the following criteria:

8.1.1 — The purpose for which we are using it – Index Ventures will need to keep the data for as long as is necessary for that purpose; and

8.1.2 — Legal obligations – laws or regulation may set a minimum period for which we have to keep your Personal Data.

9. EU and UK resident rights.

9.1 — In all the above cases in which we collect, use, or store your Personal Data, you may have the following rights and, in most cases, you can exercise them free of charge. These rights include:

9.1.1 — The right to obtain information regarding the processing of your Personal Data and access to the Personal Data which we hold about you;

9.1.2 — The right to withdraw your consent to the processing of your Personal Data at any time. Please note, however, that we may still be entitled to process your Personal Data if we have another legitimate reason for doing so. For example, we may need to retain Personal Data to comply with a legal obligation;

9.1.3 — In some circumstances, the right to receive some Personal Data in a structured, commonly used, and machine-readable format and/or request that we transmit those data to a third party where this is technically feasible. Please note that this right only applies to Personal Data which you have provided directly to Index Ventures;

9.1.4 — The right to request that we rectify your Personal Data if it is inaccurate or incomplete;

9.1.5 — The right to request that we erase your Personal Data in certain circumstances. Please note that there may be circumstances where you ask us to erase your Personal Data but we are legally entitled to retain it;

9.1.6 — The right to object to, or request that we restrict, our processing of your Personal Data in certain circumstances. Again, there may be circumstances where you object to, or ask us to restrict, our processing of your Personal Data but we are legally entitled to refuse that request; and

9.1.7 — The right to lodge a complaint with the relevant data protection regulator if you think that any of your rights have been infringed by us.

9.1.8 — You can exercise your rights by contacting us using the details listed further below.

10. California Resident Rights.

10.1 — If you are a resident of California, you have the rights set forth in this section. If there are any conflicts between this section and any other provision of this Privacy Policy, the portion that is more protective of Personal Data shall control to the extent of such conflict. If you have any questions about this section or whether any of the following rights apply to you, please contact us at dataprotection@indexventures.com.

10.1.1 — Access: You have the right to request certain information about our collection and use of your Personal Data over the past 12 months, including the:

10.1.1.1 — Categories of Personal Data that we have collected about you.

10.1.1.2 — Specific pieces of Personal Data that we have collected about you.

10.1.1.3 — Categories of sources from which that Personal Data was collected.

10.1.1.4 — Business or commercial purpose for collecting your Personal Data.

10.1.1.5 — Categories of third parties with whom we have shared your Personal Data.

10.1.1.6 — Categories of Personal Data shared with third parties for a business purpose over the past 12 months, if applicable.

10.1.2 — Deletion. You have the right to request that we delete the Personal Data that we have collected about you, subject to certain exceptions under the CCPA: for example, we may need to retain your Personal Data to provide you with the Site or services or complete a transaction or other action you have requested, or if deletion of your Personal Data involves disproportionate effort. If your deletion request is subject to one of these exceptions, we may deny your deletion request

10.1.3 — Correction. You have the right to request that we correct any inaccurate Personal Data we have collected about you. Under the CCPA, this right is subject to certain exceptions: for example, if we decide, based on the totality of circumstances related to your Personal Data, that such data is correct. If your correction request is subject to one of these exceptions, we may deny your request.

10.2 — Exercising Your CCPA Rights. To exercise the rights described above, you must send us a request that (1) provides sufficient information to allow us to verify that you are either the person about whom we have collected Personal Data or are an agent authorized by that person, and (2) describes your request in sufficient detail to allow us to understand, evaluate and respond to it. Each request that meets both of these criteria will be considered a “Valid Request.” We may not respond to requests that do not meet these criteria. We will only use Personal Data provided in a Valid Request to verify your identity and complete your request. You may submit a Valid Request by emailing us at dataprotection@indexventures.com.

10.2.1 — We will work to respond to your Valid Request within 45 days of receipt. We will not charge you a fee for making a Valid Request unless your Valid Request(s) is excessive, repetitive or manifestly unfounded. If we determine that your Valid Request warrants a fee, we will notify you of the fee and explain that decision before completing your request.

10.2.2 — You may also authorize an agent (an “Authorized Agent”) to exercise your rights on your behalf. To do this, you must provide your Authorized Agent with written permission to exercise your rights on your behalf, and we may request a copy of this written permission from your Authorized Agent when they make a request on your behalf.

10.3 — We Do Not Sell Your Personal Data. We will not “sell” your Personal Data, as that term is defined in the CCPA, and have not done so over the last 12 months. We also do not sell the Personal Data of minors under 16 years of age.

10.4 — Personal Data Sharing Opt-Out and Opt-In. Under the CCPA, California residents have certain rights when a business “shares” Personal Data with third parties for purposes of cross-contextual behavioral advertising. We will not share your Personal Data for cross-contextual behavioral advertising, and have not done so over the last 12 months. To our knowledge, we do not share the Personal Data of minors under 16 years of age for purposes of cross-contextual behavioral advertising.

10.5 — We Will Not Discriminate Against You for Exercising Your Rights Under the CCPA. We will not deny you access to our Site or provide you a lower quality of services if you exercise your rights under the CCPA. If you have any questions about this section or whether any of the above rights apply to you, please contact us at dataprotection@indexventures.com.

11. Nevada resident rights.

11.1 — If you are a resident of Nevada, you have the right to opt-out of the sale of certain Personal Data to third parties who intend to license or sell that Personal Data. If you are a Nevada Resident, you can exercise this right by contacting us at dataprotection@indexventures.com with the subject line “Nevada Do Not Sell Request” and providing us with your name. Please note that we do not currently sell your Personal Data as sales are defined in Nevada Revised Statutes Chapter 603A.

12. Designated representative.

12.1 — Index Ventures (UK) LLP’s registered office may be contacted using the following contact information: Index Ventures (UK) LLP, 5–8 Lower John Street, London W1F 9DY dataprotection@indexventures.com.

13. Questions and concerns.

13.1 — If you are a resident of the EU or UK and have any questions or concerns about Index Ventures’ handling of your Personal Data, or about this Policy, please contact the Data Protection Team using the following contact information: Index Ventures (UK) LLP, 5–8 Lower John Street, London W1F 9DY dataprotection@indexventures.com. We are usually able to resolve privacy questions or concerns promptly and effectively. If you are not satisfied with the response you receive, you may escalate concerns to the applicable privacy regulator in your jurisdiction, in the UK this is the Information Commissioner’s Office (www.ico.org.uk).

13.2 — If you are a resident of the United States and have any questions or concerns about Index Ventures’ handling of your Personal Data, or about this Policy, please contact the Data Protection Team at dataprotection@indexventures.com.