Privacy Policy

The data controller pursuant to Article 4(7) of the GDPR is

Cherry Ventures Management GmbH has appointed an external data protection officer, who can be contacted as follows:

The GDPR sets out a number of rights to which you are entitled when we process your personal data. We explain these rights in more detail below:

Please send all enquiries for information or access requests, or any objections to data processing, by email to datenschutzbeauftragter@gb21.eu or to hi@cherry.vc.

We have technical measures in place to ensure data security, in particular to protect your personal data from risks during data transmission and from unauthorised access by third parties. These measures are kept up to date with the latest technological developments.

This website uses SSL or TLS encryption to ensure the security of data processing and to protect the transmission of confidential content, such as enquiries you send to us as the operator. You can recognise an encrypted connection by the fact that the browser’s address bar displays “https://” instead of “http://”, and by the padlock symbol in your browser bar. When SSL or TLS encryption is enabled, the data you transmit to us cannot be read by third parties.

Please note that data transmission over the internet (e.g. when communicating by email) may be subject to security vulnerabilities. It is not possible to guarantee complete protection of data against access by third parties.

Whenever you visit our website, we collect certain personal data, about which we would like to inform you below.

General connection data and hosting

For technical reasons, we always collect the information that your browser transmits to our server. The collection of this general connection data is necessary to ensure the page is displayed correctly, to guarantee the stability of the connection and to defend against cyber-attacks. The data is not analysed for marketing purposes in this context.

This general connection data comprises:

• IP address
• Browser type, browser language and version number
• Operating system
• Website from which the request originates (referrer)
• Internet service provider (ISP)
• Amount of data transferred
• Subpages visited on our website
• Date and time of the request, with the time zone difference relative to Coordinated Universal Time (UTC)

The legal basis for processing this data is Article 6(1)(f) of the GDPR for the purposes of pursuing the interests set out above. The collection of data for the provision of the website and the storage of data in log files is strictly necessary for the operation of the website. Consequently, you do not have the right to object.

We use the Cloudflare service provided by Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA, to host this website. Cloudflare acts on our behalf under a data processing agreement. The website’s server is located in the USA, and data may be transferred to the USA. Cloudflare is certified under the EU-US Data Privacy Framework; an adequacy decision pursuant to Article 45 of the GDPR is therefore in place, meaning that personal data may be transferred without the need for further safeguards or additional measures.

In addition, standard contractual clauses are used. Further information on data protection at Cloudflare can be found at https://www.cloudflare.com/de-de/privacypolicy/.

Cloudflare stores the data mentioned above until the end of the session (IP address) or for a period of seven days (all other general connection data).

Cookies

Our website uses a Cloudflare cookie to store your potential consent to specific processing purposes. The processing of your personal data in connection with this cookie is strictly necessary for the operation of our website and is carried out on the basis of Article 6(1)(f) of the GDPR. Your consent to the setting of this cookie is therefore not required.

Google Web Fonts

This website uses so-called web fonts, provided by Google, to ensure consistent font display. The Google Fonts are installed locally; no connection is made to Google’s servers.

You can find further information on Google Web Fonts at https://developers.google.com/fonts/faq and in Google’s privacy policy: https://policies.google.com/privacy?hl=de.

You can contact us via the email addresses provided on our website. If you contact us by email, your enquiry, including all data contained therein (email address, name, enquiry), will be stored and processed for the purpose of dealing with your request. We will not pass on this data without your consent.

The legal basis for processing the data transmitted when sending an email is Article 6(1)(f) of the GDPR. Our legitimate interest lies in providing the best possible response to the enquiry you send to us by email. If the purpose of the email contact is to conclude a contract, the additional legal basis for processing is Article 6(1)(b) of the GDPR.

Personal data sent by email will be deleted as soon as you request us to do so or as soon as it is no longer necessary for the purpose for which it was collected. This is the case once the relevant conversation has ended and the matter in question has been conclusively resolved.

If you contact us by email, you may object to the storage of your personal data at any time. In such a case, the conversation cannot be continued. As set out under ‘2. Rights’, the objection must be made in the form of a written request to opt out sent to hi@cherry.vc.

In this case, all personal data stored in the course of the contact will be deleted.

We maintain our own pages on social media platforms so that we can communicate with you there and provide information about our services. We are not the original provider (data controller) of these pages, but merely use them within the scope of the options offered to us by the respective providers.

We therefore wish to draw your attention, as a precaution, to the fact that your data may also be processed outside the European Union or the European Economic Area. Using these platforms may therefore pose data protection risks for you, as it may be more difficult to exercise your rights – such as the right to access, erasure, objection, etc. – and processing on social media platforms is often carried out directly by the providers for advertising purposes or to analyse user behaviour, without us being able to influence this.

Where providers create user profiles, cookies are often used, or usage behaviour is directly linked to your own social media profile (provided you are logged in).

The processing of personal data described above is carried out in accordance with Article 6(1)(f) of the GDPR on the basis of our legitimate interest and the legitimate interest of the respective provider, in order to be able to communicate with you in a modern manner and to inform you about our services. If you are required to give your consent to data processing as a user with the respective providers, the legal basis is Article 6(1)(a) of the GDPR in conjunction with Article 7 of the GDPR.

Please exercise your rights – such as the right to access, rectification or erasure – directly with the relevant provider, as we do not have access to the providers’ data holdings. Further information on the processing of your data on social media platforms and the possibility of exercising your right to object or withdraw consent (opt-out) is set out below for the social media providers we use:

If you engage us, we will process the following personal data as part of our consultancy services:

• Master data (e.g. name, address, contact details such as email, telephone number and website address)
• Assignment-related data (e.g. contracts, correspondence, invoices)
• Consultancy data (e.g. content of enquiries, consultancy documentation, documents, case notes, legal assessments)
• Activity data (e.g. consultancy documentation, service records, invoices)
• as well as any other data that you voluntarily provide to us within the scope of the client relationship or that is necessary for us to provide our services or to communicate with you

Processing is carried out in particular for the following purposes:

• Preparing or responding to requests for quotations
• Establishing the terms of the contractual relationship
• Concluding or performing contracts
• internal administrative purposes (e.g. for accounting and to comply with tax and commercial law requirements)
• other communication purposes, which we will explain to you separately
• Ensuring our company’s IT security and IT operations
• Mitigating the risks of default and fraud

The legal basis for processing your data when you contact us is our legitimate interest in responding to your enquiry in accordance with Article 6(1)(f) of the GDPR. If your contact is aimed at concluding a contract, the processing of your personal data is additionally based on Article 6(1)(b) of the GDPR. The same applies to processing operations necessary for the implementation of pre-contractual measures, such as in the case of enquiries regarding our products or services. Where our company is subject to a legal obligation requiring the processing of personal data, such as to fulfil tax or anti-money laundering obligations, the processing is based on Article 6(1)(c) of the GDPR.

We may share personal data with third parties.

This applies, for example, to service providers whom we engage to process your personal data for the purposes described in this privacy notice. These service providers process the data solely on our behalf, in accordance with our instructions and under our control, in line with this privacy notice.

These service providers generally process personal data within the EU. Where processing takes place outside the EU, we ensure an adequate level of data protection to comply with the requirements of European law. This is achieved primarily through the use of EU Standard Contractual Clauses published by the European Commission.

We store and process your personal data only for the period necessary to fulfil the purpose for which it was collected. Once this purpose has been fulfilled, we will delete your personal data.

Furthermore, we only retain data where required by legislation to which we, as a company, are subject, such as under Article 17(3) of the GDPR. This is particularly relevant in connection with compliance with statutory retention periods (Article 17(3)(b) of the GDPR) and with the establishment, exercise or defence of legal claims (Article 17(3)(e) of the GDPR). In doing so, we observe sector-specific regulations.

Statutory provisions on data retention arise in particular from the retention periods set out in the German Commercial Code (HGB) or the German Tax Administration Regulations (AO). According to these, the retention period is between 6 and 10 years following the completion of the transaction.

This Privacy Policy is currently valid and is dated: 01 November 2026

Changes to statutory or regulatory requirements, or the further development of our website and services, may make it necessary to amend this Privacy Policy. We will publish any changes to the Privacy Policy here. You should therefore check this Privacy Policy regularly when you visit the website.