Investor Pre-Registration Privacy Policy

The data controller responsible for your personal data is:

Pre-registration is deliberately minimal. When you pre-register as an investor, we collect only:

• Email address
• Password (stored securely using one-way hashing — we never see or store your plain-text password)
• Account creation timestamp

We do not ask for your name, date of birth, address, phone number, tax ID, or any bank or identity documents at pre-registration. Those will only be requested — and independently verified — as part of a separate, mandatory identity (KYC) and suitability process before you can actually invest, once investing launches.

We process your personal data based on the following legal grounds (GDPR Article 6):

• Contract Performance - To create and maintain your pre-registration account
• Legitimate Interests - To notify you when investing launches, and for security and fraud prevention

We use your personal data to:

• Create and manage your pre-registration account
• Authenticate you when you sign in
• Notify you by email once investing on CIM launches
• Provide customer support

We do not sell your data, and we do not use it for advertising or share it with marketing third parties.

We use the following third-party service:

• Pre-registration account data: Retained until launch (to notify you) or until you request deletion, whichever is earlier
• Session data: Expires after 24 hours
• Server logs: Retained for 90 days

We use only strictly necessary cookies, for which no consent is required under Art. 5(3) of the ePrivacy Directive:

Under the GDPR, you have the following rights:

• Right to Access - Request a copy of your personal data
• Right to Rectification - Request correction of inaccurate data
• Right to Erasure - Request deletion of your data ("right to be forgotten")
• Right to Restrict Processing - Request limitation of processing
• Right to Data Portability - Receive your data in a machine-readable format
• Right to Object - Object to processing based on legitimate interests

To exercise these rights, please contact us at: rihhard.rekkaro@creatorinvestmentmarket.com

We implement appropriate security measures to protect your data:

• Passwords are hashed using industry-standard algorithms
• All data is transmitted over HTTPS encryption
• Session cookies are HttpOnly and Secure
• CSRF protection on all forms

Your data is stored on servers located in Frankfurt, Germany (EU), hosted by DigitalOcean. As DigitalOcean is a US-based company, some data may be transferred to or accessible from the United States for operational and support purposes. DigitalOcean participates in the EU-US Data Privacy Framework, ensuring adequate protection for your data in accordance with GDPR requirements.

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with your local data protection supervisory authority.

When investing launches, a new Privacy Policy covering the full investment product (including identity verification and financial data) will apply. We may also update this pre-registration Privacy Policy from time to time by posting the new version here and updating the "Last updated" date.