Aviso de privacidad

1. Who is responsible

Geometri Technologies, Kingdom of Bahrain (“Geometri”, “we”) provides CapitalPrism. For the personal data of people who visit this website, register interest, or hold an account, Geometri is the data controller. For personal data contained in a Customer’s records (for example, names of people at portfolio companies inside a board pack), the Customer is the controller and Geometri processes that data on the Customer’s behalf under the Terms of service. For customer-hosted deployments the data never reaches Geometri’s systems unless the Customer grants support access.

2. What we collect

• Account data: your name, email address, a hash of your password, multi-factor authentication secrets and recovery codes (stored encrypted), and the organisations and roles you hold.
• Session and security data: session identifiers, sign-in attempts and their outcome, the time and network origin of security events such as MFA enrolment, and rate-limit counters.
• Audit trail: every change to an organisation’s records is written with the acting user, the reason given, and the time. This is a core function of the Service and is retained with the organisation’s data.
• Enterprise interest: if you use the form on the website, the name, work email, organisation, hosting preference and message you submit, with a request identifier and receipt.
• Company reporting: if you submit a document through a reporting link, the document itself, its fingerprint, the note you add, and the time of submission. We do not create an account for you.
• Support access: when a Customer owner grants support access, the identity of the operator, the scope and expiry of the grant, and every read performed under it.
• Technical data: standard server logs (request line, status, time, IP address) kept for security and operations. The website sets no advertising or analytics trackers.

3. Why we use it

• To provide the Service and perform our contract with the Customer: authentication, authorisation, keeping the record, sending notifications you have opted into (such as the daily brief).
• To keep the Service secure and to detect and investigate misuse (our legitimate interest, and a legal requirement for a system of record).
• To respond to an enquiry you sent us, on the basis of the consent you gave when submitting it. You can withdraw it by telling us.
• To meet legal obligations, including record-keeping and responding to lawful requests.

We do not sell personal data and we do not use it for advertising.

4. Where data is kept and transfers

The cloud-hosted Service runs on virtual machines in the European Union operated for Geometri by a hosting provider under a data-processing agreement. Geometri’s staff in Bahrain may access account and security data to operate the Service, and Customer records only under a support grant (section 2). Where personal data leaves the jurisdiction in which it was collected, we rely on the mechanisms permitted by the Bahrain Personal Data Protection Law and, for EU data subjects, on the GDPR’s transfer safeguards. Customer-hosted deployments keep all data in the Customer’s own environment.

5. Who we share with

• Our hosting provider, for the cloud-hosted Service.
• An email delivery provider, for sign-in security messages, invitations and notifications you opted into.
• An external AI or search provider, only where a Customer owner has enabled that provider for their organisation; the Service records each enablement and the provider’s own terms then apply.
• Professional advisers, authorities or courts where the law requires.

6. Retention

• Account and organisation data: for the life of the Customer’s subscription or licence, then deleted from the hosted service after the offboarding export, within ninety days of termination unless the law requires longer.
• Audit trail: retained with the organisation’s data, because it is part of the record.
• Enterprise-interest enquiries: twelve months from the last contact, unless a contract follows.
• Company-reporting submissions: as part of the receiving organisation’s records.
• Server logs: ninety days.
• Backups: encrypted, rotated on a fixed schedule; data deleted from the live system leaves backups as they expire.

7. Security

Access is by password with optional or policy-enforced multi-factor authentication; MFA secrets and recovery codes are stored encrypted. Every organisation’s data is isolated by database policy, so a query for one organisation cannot return another’s rows. Reviews of proposed figures and approvals require a second person by design. Backups are encrypted and restoration is tested. Support access to a Customer’s data requires a grant from that Customer and is written to its audit trail.

8. Your rights

Under the Bahrain Personal Data Protection Law, and under the GDPR if you are in the European Economic Area, you may ask to access the personal data we hold about you, to have it corrected, to have it erased where there is no longer a reason to keep it, to object to or restrict processing, to receive a copy in a portable form, and to withdraw consent where processing is based on it. Because the audit trail is a record the Customer is required to keep, requests concerning data inside a Customer’s records are passed to that Customer as controller. You may also complain to the Personal Data Protection Authority in Bahrain or to your local supervisory authority in the EEA.

9. Cookies

The Service uses a session cookie to keep you signed in, a short-lived cookie during multi-factor sign-in, and a cookie that remembers the language you chose. These are necessary for the Service to work and no consent banner is shown for them. There are no advertising, tracking or third-party analytics cookies.

10. Changes and contact

We will update this notice when the Service changes in a way that affects personal data, and change the date at the top of this page. To exercise your rights or ask a question: ops@capitalprism.ai.