1. Data Controller & Compliance Contact
The data controller responsible for the processing of personal data on this platform within the scope of Regulation (EU) 2016/679 (General Data Protection Regulation – "GDPR") and the Italian Legislative Decree no. 196/2003 (Codice in materia di protezione dei dati personali, as amended by Legislative Decree no. 101/2018) is:

Assetseeds Italy S.r.l. (operating the ASSETSEEDS transaction platform)
Registered Address: Rome, Italy
Represented by: Dr. Rassul Khalilzadeh, Managing Director
Corporate Contact: info@assetseeds.com
Dedicated Privacy & Data Protection Inquiries: privacy@assetseeds.com

2. Scope and Nature of Platform Activities
Assetseeds operates strictly as a specialized, cross-border infrastructure transaction advisory, joint development structuring, and pipeline origination platform. The platform does not target retail consumers or provide regulated MiFID II retail investment services. All data processing is strictly conducted within a professional business-to-business (B2B) framework with institutional counterparties, project developers, independent power producers (IPPs), and corporate investors.

3. Categories of Personal Data Collected
We collect and process personal data exclusively to the extent necessary to evaluate transaction alignment, manage introductory briefings, and structure bilateral pipeline partnerships:

a) Mandate & Intake Data (/mandate): Full name, corporate email address, corporate phone number, represented entity/fund name, counterparty role (e.g., Head of M&A, Investment Director, Developer), investment criteria, target verticals (Energy & Renewables, Digital & AI Infrastructure, Industrial Grid), MW capacity thresholds, target ticket sizes, jurisdictions, and stage preferences.

b) Scheduling & Communication Data: Meeting availability, calendar appointment notes, corporate email correspondences, and communications initiated via our Calendly briefing interface.

c) Server Log Data: Automatically collected technical connection data, including IP address, operating system, browser type and version, date and time of request, requesting domain, and referrer URL.

4. Legal Bases for Processing (Art. 6 GDPR)
We process personal data strictly under valid European legal bases:

- Art. 6(1)(b) GDPR (Pre-contractual Measures): Processing mandate and parameter intake forms to evaluate bilateral transaction viability, arrange non-binding exploratory meetings, and initiate potential transaction agreements upon your request.

- Art. 6(1)(f) GDPR (Legitimate Interests): Processing server logs, corporate credentials, and professional contact data to protect infrastructure stability, verify counterparty legitimacy in high-value B2B transactions, prevent fraudulent spam, and maintain operational efficiency.

- Art. 6(1)(c) GDPR (Legal Obligations): Retaining corporate communications and fiscal identification records to satisfy mandatory EU and Italian corporate, tax, anti-money laundering (AML) pre-checks, and commercial screening regulations.

5. Strict Non-Binding Parameter Exchange & Commercial Discretion
Submitting an acquisition profile or pipeline asset via the Mandate Intake Form is entirely non-binding and free of charge. Parameter submissions do not constitute an advisory mandate, financial obligation, or brokerage retainer. All commercial metrics, development stage details, and capacity allocations shared via the platform are treated under strict bilateral commercial confidentiality. Assetseeds does not sell, rent, commercialize, or share user data with third-party advertising or marketing networks.

6. Technical Hosting Infrastructure & Server Logging
This platform is deployed and hosted on Wix.com Ltd. When accessing this website, Wix servers automatically record temporary server log files to ensure platform stability, DDoS mitigation, and continuous system security.

7. Third-Party Integrations & International Data Transfers

a) Calendly LLC (USA): For scheduling confidential calls, we embed scheduling tools from Calendly LLC and Google LLC (USA). When you reserve a briefing slot, contact details (name, corporate email, booking time) are transmitted to Calendly servers. International transfers to the United States are governed by Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR and the EU-U.S. Data Privacy Framework.

b) Encrypted Enterprise Communications: All corporate email exchanges and form intake transfers are transmitted via end-to-end TLS-encrypted protocols.

8. Technical and Organizational Security Measures (TOMs - Art. 32 GDPR)
Taking into account the state of the art, implementation costs, and the nature of institutional deal flow data, Assetseeds maintains rigorous technical and organizational security measures to protect data against accidental or unlawful destruction, loss, alteration, and unauthorized disclosure. These include Transport Layer Security (TLS/HTTPS), role-based access restrictions limited to executive transaction principals, multi-factor authentication (MFA), and routine system logging.

9. Data Retention & Archiving
Personal data collected through mandate inquiries and calendar reservations is retained only as long as necessary to evaluate transaction alignment, manage active pipeline interactions, or fulfill statutory retention obligations (e.g., up to 10 years for corporate records and transaction documentation under Italian civil and commercial law). Inquiries that do not mature into active advisory dialogues are purged periodically from active databases.

10. Statutory Rights of the Data Subject (Articles 15–22 GDPR)
Under the GDPR, qualified individuals and counterparty representatives hold enforceable rights regarding their personal data:

- Right of Access (Art. 15 GDPR): The right to request confirmation and details regarding processed personal data.

- Right of Rectification (Art. 16 GDPR): The right to demand immediate correction of inaccurate or incomplete corporate contact data.

- Right to Erasure / "To Be Forgotten" (Art. 17 GDPR): The right to request deletion of data once legal grounds or retention mandates expire.

- Right to Restriction of Processing (Art. 18 GDPR): The right to restrict data processing under statutory dispute conditions.

- Right to Data Portability (Art. 20 GDPR): The right to receive provided personal data in a structured, commonly used, machine-readable format.

- Right to Object (Art. 21 GDPR): The right to object at any time, on grounds relating to your particular situation, to data processing based on Art. 6(1)(f) GDPR.

To exercise any statutory data protection rights, please contact our compliance desk directly at: privacy@assetseeds.com