Dr. Oliver Heiland

Capital for Resilience Advisors

Technology Park Heidelberg

Im Neuenheimer Feld 582

69120 Heidelberg

Phone: +49 152 37158467

E-Mail: info@cfr-advisors.com

VAT-ID: DE 453 785 961

Legally responsible person:

Dr. Oliver Heiland

Legal Notice regarding regulated services:

Please note that Capital for Resilience Advisors does not provide any of the following regulated services:

• financial advice

• investment advice

• investment brokerage

Capital for Resilience Advisors does not provide any legal services under German law. Legal advice may be offered separately through Heiland Legal. Dr. Oliver Heiland is admitted to practice as an attorney (Rechtsanwalt) in the Federal Republic of Germany. He is a member of the Karlsruhe Bar Association (Rechtsanwaltskammer Karlsruhe), Reinhold-Frank-Straße 72, 76133 Karlsruhe, Germany.

Contact: heiland@heiland-legal.com

Photo Credit:

• Contact: Photo by Brillux

Limitation of Liability:

We regularly check and update the information on our website. Despite all due care, data may have changed. Therefore, no liability or guarantee can be assumed for the accuracy and completeness of the information provided. The same applies to all websites referred to via hyperlinks. The content and structure of this website are protected by copyright.

Data Protection Notice (Privacy Policy)

Controller

Dr. Oliver Heiland
Capital for Resilience Advisors
Im Neuenheimer Feld 582
69120 Heidelberg, Germany

Email: privacy@cfr-advisors.com
Alternatively: heiland@cfr-advisors.com
Telephone: +49 152 3715 8467

Applies to: www.cfr-advisors.com (“Website”), forms, email communications, online and physical events, webinars and related professional interactions.

Last updated: 14 September 2026

1. Scope

This notice explains how Capital for Resilience Advisors (“CFRA”, “we” or “us”) processes personal data when you:

• visit our Website;

• use a contact or registration form;

• communicate with us by email, telephone or other professional channels;

• register for or participate in an online or physical event;

• receive professional communications or event invitations from us; or

• interact with us in connection with an enquiry, engagement or other business relationship.

The Website is hosted by Squarespace. Domain and DNS services are provided by IONOS. Email, productivity and online-event services may be provided through Microsoft 365 and Microsoft Teams.

We may also use software incorporating artificial intelligence, including large language models (“LLM tools”), to support defined internal and professional work processes as described below.

2. Personal data we process

Depending on the interaction, we may process:

• Contact and professional data: name, organisation, professional position, email address, telephone number and other professional contact information.

• Communication data: emails, messages, call details, meeting notes, enquiries and other information you provide to us.

• Event and webinar data: registration details, organisation, position, attendance status, participation information, questions, poll responses, chat contributions and feedback.

• Event engagement data: attendance duration, joining and leaving times and interactions with event functions such as chat, Q&A and polls, where this information is made available to and used by us.

• Audio, video or recording data: where an event or meeting is recorded, subject to prior notice and any additional requirements applicable to the recording.

• Engagement and work-product data: instructions, documents, drafts, correspondence and other materials provided or generated in connection with an enquiry or professional engagement, to the extent that they contain personal data.

• Technical and usage data: IP address, device and browser information, pages viewed, timestamps, referrers and cookie identifiers used for security, performance and basic analytics.

• Publicly available professional information: information available from professional websites, publications, event programmes, company websites or professional networks where relevant to a legitimate business interaction.

We ordinarily obtain personal data directly from you. We may also receive professional contact information from your organisation, an introducer, an event partner or a publicly available professional source.

We do not knowingly seek to collect special categories of personal data. Please do not provide such information unless it is necessary for the relevant purpose and its processing has been agreed in advance.

We do not use personal data for automated decision-making or profiling that produces legal or similarly significant effects.

3. Purposes and legal bases

Enquiries, contracts and professional communication

We process personal data to respond to enquiries, arrange meetings, prepare proposals, manage professional relationships and perform or administer engagements.

Legal basis: Article 6(1)(b) GDPR where processing is necessary for a contract or pre-contractual steps; otherwise Article 6(1)(f) GDPR, based on our legitimate interest in effective professional communication and business administration.

Events and webinars

We process registration, attendance and participation data to:

• administer registrations and attendance;

• assess eligibility where participation is restricted or subject to approval;

• provide joining instructions and event materials;

• conduct the event, including questions, discussions and polls;

• ensure the security and proper operation of the event; and

• send communications directly related to the event, including appropriate follow-up materials.

Legal basis: Article 6(1)(b) GDPR where registration creates an event-related contractual relationship; otherwise Article 6(1)(f) GDPR, based on our legitimate interest in organising and conducting relevant professional events.

Events are not recorded unless this is communicated in advance. Where a recording includes identifiable participant contributions, we will provide any additional information or obtain consent where required.

Professional information and event invitations

We may use professional contact details to send individually relevant business communications or invitations where there is a reasonable professional connection.

Legal basis: Article 6(1)(f) GDPR, based on our legitimate interest in maintaining professional relationships and communicating about relevant CFRA activities. You may object to this processing at any time.

Newsletters or broader electronic marketing communications will only be sent with consent or where otherwise permitted by applicable law.

LLM-supported and AI-assisted work processes

We may use LLM tools and other AI-assisted software to support activities such as:

• structuring and summarising information;

• drafting, editing and translating text;

• reviewing and analysing documents;

• conducting research;

• preparing meeting notes and work products;

• organising internal knowledge; and

• supporting quality assurance and administrative processes.

Where materials contain personal data, we assess whether their use is necessary and appropriate for the relevant purpose. We seek to minimise, redact or pseudonymise personal data before using an LLM tool where reasonably possible.

LLM tools support our work but do not replace professional assessment. Outputs intended for substantive professional use are subject to appropriate human review.

We do not authorise LLM providers to use personal data submitted by us to train general-purpose models. We select services and configurations with regard to confidentiality, data protection, access controls, retention settings and contractual safeguards.

Legal basis: Article 6(1)(b) GDPR where processing is necessary to prepare or perform an engagement; otherwise Article 6(1)(f) GDPR, based on our legitimate interest in providing efficient, consistent and quality-assured professional services. Where another legal basis is required for particular data, we will apply that basis before processing.

Website operation and security

We process technical data to provide, secure and maintain the Website, including availability, load balancing, fraud and spam prevention and security logging.

Legal basis: Article 6(1)(f) GDPR, based on our legitimate interest in operating a secure and reliable Website.

Domain and DNS services

Technical identifiers may be processed to route traffic, resolve domain requests and maintain security and operational logs.

Legal basis: Article 6(1)(f) GDPR, based on our legitimate interest in providing and securing the Website.

Website performance and analytics

We may process aggregated or basic performance information to understand Website use and maintain its performance.

Server-side or aggregated performance measurement that does not require consent is based on Article 6(1)(f) GDPR. Non-essential analytics or technologies that access or store information on a user’s device will only be activated with consent where required.

Legal obligations and claims

We may process and retain personal data to comply with legal obligations and for the establishment, exercise or defence of legal claims.

Legal basis: Article 6(1)(c) and Article 6(1)(f) GDPR.

4. Cookies and similar technologies

Squarespace may place essential cookies required for Website functionality and security, including cookies used to prevent fraud or cross-site request forgery, maintain sessions and remember necessary preferences.

The storage of or access to information on a user’s device that is strictly necessary to provide a requested service is based on Section 25(2) TDDDG. The associated processing of personal data is based on Article 6(1)(f) GDPR.

Non-essential cookies, analytics services, marketing technologies or third-party embeds will only be activated with consent where required under Section 25(1) TDDDG and Article 6(1)(a) GDPR.

You may withdraw consent at any time through the cookie settings displayed on the Website and may also manage cookies through your browser. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

5. Recipients and service providers

Personal data may be disclosed to the following categories of recipients where necessary:

• Website hosting and platform providers: including Squarespace and its infrastructure providers.

• Domain and DNS providers: including IONOS.

• Email, productivity and online-event providers: including Microsoft 365 and Microsoft Teams.

• AI and LLM service providers: providers of AI-assisted software and their hosting or infrastructure subprocessors, where such tools are used for the purposes described in this notice.

• Professional advisers and service providers: including IT, legal, tax, accounting and other specialist providers subject to appropriate confidentiality obligations.

• Public authorities or courts: where disclosure is required by law or necessary for the establishment, exercise or defence of legal claims.

Where a service provider processes personal data on our behalf, we use appropriate contractual arrangements, including data-processing agreements where required.

We do not sell personal data.

6. International transfers

Some service providers or their subprocessors may process personal data outside the European Economic Area.

Transfers to recipients in the United States may be based on the European Commission’s adequacy decision for the EU–US Data Privacy Framework where the relevant recipient is actively certified and the transfer falls within the scope of that certification.

Where the EU–US Data Privacy Framework is unavailable or does not apply to a particular transfer, we rely on other appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and, where appropriate, supplementary technical and organisational measures.

Information about the safeguards applicable to a particular processing activity may be requested by contacting privacy@cfr-advisors.com.

7. Retention

We retain personal data only for as long as necessary for the relevant purpose, subject to statutory retention requirements and the need to establish, exercise or defend legal claims.

In particular:

• Enquiries and general professional correspondence: generally for up to 24 months after the last substantive contact, unless an ongoing relationship or legal reason requires longer retention.

• Event and webinar data: generally for up to 24 months after the event or last event-related contact, unless you object earlier or the data becomes part of an ongoing professional relationship.

• Event recordings: according to the period communicated for the relevant event or for as long as reasonably necessary for the stated publication or documentation purpose.

• Engagement and contract-related records: for the duration of the engagement and the applicable contractual, statutory and limitation periods.

• Professional contact information: for as long as the professional relationship or connection remains relevant, subject to periodic review and your right to object.

• Technical and security logs: according to the operational and security retention periods applied by the relevant service provider.

• Data processed through LLM tools: according to the retention settings and contractual arrangements applicable to the selected service. Where reasonably available, we use settings designed to limit provider-side retention.

Where processing is based on consent, we retain the relevant data until consent is withdrawn or the purpose ceases to apply, unless continued retention is required by law.

8. Your rights

Subject to the applicable legal requirements, you may have the right to:

• obtain access to your personal data;

• request rectification of inaccurate data;

• request erasure;

• request restriction of processing;

• receive data in a portable format;

• object to processing based on legitimate interests; and

• withdraw consent at any time with effect for the future.

Where we process personal data on the basis of Article 6(1)(f) GDPR, you have the right to object on grounds relating to your particular situation. You may object to processing for direct-marketing purposes at any time without providing reasons.

To exercise your rights, contact privacy@cfr-advisors.com.

You may also lodge a complaint with a data-protection supervisory authority. The authority responsible for our location is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20
70173 Stuttgart, Germany
www.baden-wuerttemberg.datenschutz.de

9. Security

We apply appropriate technical and organisational measures designed to protect personal data, including HTTPS, access controls, data minimisation, least-privilege principles, confidentiality requirements and service-provider due diligence.

Where LLM tools are used, we consider the sensitivity of the material, the need for personal data, available account and retention settings, contractual protections and the possibility of redaction or pseudonymisation.

No method of transmission or storage can guarantee absolute security.

10. Requirement to provide data

Providing contact details is generally voluntary. However, without the minimum information required for a particular interaction, we may be unable to respond to an enquiry, administer an event registration or perform an engagement.

Fields marked as mandatory on a registration or contact form are required for the stated purpose.

Essential cookies and certain technical data are necessary for the Website and online services to operate securely.

11. Automated decision-making

We do not use automated decision-making, including through LLM tools, to make decisions about individuals that produce legal or similarly significant effects.

Decisions concerning access to restricted events, professional engagements or other substantive matters remain subject to human assessment.

12. Changes to this notice

We may update this notice to reflect legal, technical or business developments, including changes to our service providers or the digital tools we use.

The date shown at the beginning of this notice indicates when it was last updated.

“Our knowledge… finite; our ignorance… infinite.” — Karl Popper. We help journalists and hosts bring clarity to complex private-markets topics with board-level perspectives. Contact us for interviews, expert comment, or keynotes—prompt response with insights and availability.

info@cfr-advisors.com