LEGAL
Privacy Policy
Status: October 2026
This policy explains which personal data StegX GmbH processes when you visit stegx.finance, contact us or use the contact form. The marketplace at marketplace.stegx.finance, including investor registration and onboarding, has its own privacy notice there.
1 Controller
StegX GmbH, Platz der Einheit 2, c/o Techquartier, 60327 Frankfurt am Main, Germany. Managing Director: Daniel Radwansky. HRB 128423, Local Court Frankfurt am Main. Email: team@stegx.finance. Phone: +49 151 221 008 63.
For any privacy request, write to team@stegx.finance or to the postal address above.
2 Hosting and server logs
This website is hosted on Cloudflare Pages, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you open a page, Cloudflare processes technical access data: IP address, date and time, the page requested, referrer, browser and operating system. This is necessary to deliver the website securely and to detect misuse. Fonts, images and all other files of this website are delivered from the same host; the website loads nothing from third parties.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a secure and working website. Cloudflare processes the data on our behalf under a data processing agreement (Art. 28 GDPR). Data may be transferred to the USA; Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework, and the EU standard contractual clauses in Cloudflare's data processing agreement apply as well.
3 Contact form
If you use the contact form, we process the data you enter: whether you write as a sponsor, manager or introducer, company, name, role, email address, phone number if you give one, project type, amount sought, target date, country, a short description and, if you choose, an uploaded file. Required fields are marked. We use the data only to answer your enquiry and, if you wish, to prepare a proposal.
Legal basis: Art. 6(1)(b) GDPR where your enquiry concerns a possible engagement; otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering enquiries addressed to us.
When you send the form, a function on Cloudflare Pages checks the entries and passes them to Resend, which delivers them as an email to our mailbox team@stegx.finance. The website itself does not store form entries. Resend is a service of Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA, acting as our processor under Art. 28 GDPR; data is transferred to the USA on the basis of the EU-U.S. Data Privacy Framework, under which Resend is certified, and the EU standard contractual clauses in Resend's data processing agreement.
Our email is hosted by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, as our processor under Art. 28 GDPR. Data may be transferred to Microsoft Corporation in the USA, which is certified under the EU-U.S. Data Privacy Framework. Please do not upload confidential documents with the first enquiry; a non-confidential overview is enough.
4 Email and phone
If you write to us or call us, we process your contact details and the content of your message to answer you. Legal basis as in section 3.
5 No cookies, no tracking
This website sets no cookies and uses no analytics, tracking or marketing tools. It loads no fonts, scripts, videos or other content from third parties. Links to other websites, such as marketplace.stegx.finance, securitixation.com, rwa-link.com and the BaFin register, are plain links; no data is sent to those sites until you click one.
6 Recipients
We share personal data only with the service providers named in this policy (Cloudflare, Resend and Microsoft), who act on our instructions, and with authorities where the law requires it. We do not sell personal data.
7 Retention
Enquiries that do not lead to an engagement are deleted six months after our last contact with you. If an engagement follows, the data becomes part of the client file and is kept for the statutory retention periods under German commercial and tax law, generally six or ten years. Server logs are kept by Cloudflare, and delivery logs of the email by Resend, for a limited period for security and operation and then deleted.
8 Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20).
Right to object: where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then stop the processing unless we have compelling legitimate grounds.
You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.
9 No automated decisions
We do not use automated decision making or profiling within the meaning of Art. 22 GDPR. You are not obliged to provide personal data; without the data in the contact form we cannot answer the enquiry through the form.