Privacy Policy
Last updated: October 2026
In short
- Dealroom.co runs a data platform on start-ups, scale-ups, investors, and the people behind them. Most information about people on our platform is professional information from public and licensed sources.
- We process that information on the basis of legitimate interest. You can object at any time, and we will remove your profile.
- Being listed on Dealroom.co does not mean you have agreed to be contacted by anyone. Our customers are responsible for their own use of our data, including any outreach.
- Our platform is hosted in the European Union. We do not collect sensitive data about you, such as your ethnic origin, health, or home address.
- You can exercise your rights through our privacy request form or by emailing [email protected].
1. Who we are
This policy explains how Dealroom.co B.V. processes personal data. Dealroom.co B.V. is a private limited company registered with the Dutch Chamber of Commerce (KvK) under number 59237368, with its registered address at Baarsjesweg 252H, 1058 AB Amsterdam, the Netherlands (Dealroom.co, we, us). We are the controller for the processing described in this policy.
You can reach us at [email protected].
2. Who this policy covers
This policy covers four groups of people:
- People on our Platform: founders, team members, investors, advisors, and other people linked to companies and investors on our platform (section 3);
- Users: people with an account on our platform, our API, or an ecosystem platform we operate, including staff of our customers (section 4);
- Website visitors and business contacts: people who visit our websites, attend our events, or receive our communications (section 5);
- Ecosystem platform users: people who use a platform we operate for a partner, such as a regional development agency (section 6).
3. People on our Platform
What we collect
We collect professional information about people who play a role in the start-up and investment ecosystem:
- Name, current and past job titles, and the companies, funds, or organisations you are linked to;
- Education and professional background;
- Investments, funding rounds, exits, board seats, and other roles relevant to the ecosystem;
- City or country of your professional activity;
- Links to your public professional profiles, such as LinkedIn or X;
- A profile photo, where published by you or your company;
- A business email address (see "Business email addresses" below);
- News articles, publications, and patents that mention you in a professional capacity;
- Gender, as stated publicly by you, or estimated for company tags and statistics only (see "Gender, nationality, and age" below);
- Nationality, where publicly available;
- An estimated age range, used only for aggregated statistics and not shown on your profile or provided through our API.
We do not collect special categories of personal data, such as ethnic origin, religion, health, or political opinions, and we do not collect home addresses or private contact details. If such data reaches us, we delete it.
Where it comes from
- Public sources: company websites, press releases, news articles, public registers (such as trade and patent registers), regulatory filings, job postings, and public professional profiles.
- You and your company: information you or your company give us, for example, when you claim or update a profile.
- Our customers and partners: information that customers and ecosystem partners contribute to the platform.
- Licensed data providers: providers who license company, people, and contact data to us.
We use automated tools, including web crawlers and AI models, to find, verify, and update this information. We limit collection to professional information relevant to the ecosystem. We do not collect information from private profiles, closed groups, or behind logins, and we filter out special categories of data. Human analysts review data quality, and you can ask us for the source of any information about you.
Why we process it and on what basis
We provide transparency on the start-up and venture capital ecosystem. Investors use our data to find companies, companies use it to find investors and partners, and governments and researchers use it to understand and support their local ecosystems. Information about the people who found, lead, and fund companies is an essential part of that picture.
We process this information on the basis of our legitimate interest, and that of our customers and the public, in this transparency (Article 6(1)(f) GDPR). We have assessed that this interest is not overridden by your interests, because we limit ourselves to professional information that is largely already public, we do not collect sensitive or private data, and you can object at any time. Our Legitimate Interest Statement sets out this assessment for each purpose.
Business email addresses
We may add a business email address to a profile. We obtain these from licensed data providers.
Gender, nationality, and age
We record gender on a person's profile only where that person has stated it publicly, for example in their own biography or in an interview. For company tags, such as "woman founder", and for statistics on diversity in the ecosystem, such as the share of funding going to companies with female founders, we also use gender estimated from public information. Estimated gender is never shown on individual profiles.
We record nationality where it is publicly available. We estimate age from professional history, such as graduation year; estimated age is not shown on profiles or provided through our API, and is used only for aggregated statistics.
We never use this information to estimate ethnic origin. You can ask us to correct or remove your gender, nationality, or age, or a company tag based on it, at any time.
Scores and rankings
We calculate scores and rankings for companies and investors, and signals about founders, such as whether they previously founded a successful company. These help our users find and compare companies. They are opinions based on data, not facts about you. We do not take decisions about you based solely on automated processing that have legal or similarly significant effects on you (Article 22 GDPR).
Who can see it
More detailed information is available to our paying customers through our platform and API, and on ecosystem platforms we operate for partners. Business email addresses are available to paying customers only.
Our customers use this information under our Terms & Conditions. Each customer is an independent controller for its own use of the data, including any outreach, and must have its own legal basis for it. Being listed on Dealroom.co is not consent to be contacted by us, our customers, or anyone else.
How long we keep it
We keep profile information for as long as it is relevant to the ecosystem. Past roles, funding rounds, and exits form part of the historical record of a company and remain on the platform for that reason. When information is no longer accurate, we update or remove it. If you object or ask us to remove your profile, we delete it and keep only a minimal record (your name, company, and a hashed email address) so that we do not add you again.
Your choices
You can claim your profile to correct or complete it, object to its processing, or ask us to remove it entirely through our Privacy Request Form. Removing your profile does not remove the company profile, but your name will no longer be linked to it.
4. Users
What we collect
- Account data: name, business email address, company, job title, and, if you choose to add them, phone number and profile photo.
- Login and security data: IP address, device and browser information, and login times.
- Usage data: searches, features used, and exports, to the extent needed to provide the service, enforce usage allowances, and detect misuse.
- Billing data: billing contact details, invoices, and payment status. We do not store card details ourselves.
- Communications: support requests and other messages you send us.
Why we process it and on what basis
| Purpose | Legal basis |
|---|---|
| Creating and running your account, and providing the platform and API | Contract (Article 6(1)(b) GDPR) |
| Invoicing and bookkeeping | Legal obligation (Article 6(1)(c) GDPR) |
| Security, fraud prevention, and enforcing our Terms & Conditions, including usage allowances and the ban on automated scraping | Legitimate interest (Article 6(1)(f) GDPR) |
| Service messages, such as product updates and changes to our terms | Contract or legitimate interest |
| Improving our products, using aggregated usage statistics | Legitimate interest |
| Informing your organisation's account administrator about seat usage, where your organisation holds the subscription | Legitimate interest of your organisation and ours |
| Marketing emails | See section 5 |
AI features
Some features, such as Ask AI, use AI models. If you use them, we process your questions and the relevant data using AI providers under contracts that do not allow them to use this data to train their own models. Answers generated by AI are shown as such in the product.
How long we keep it
| Data | Retention |
|---|---|
| Account data | For as long as your account is active, and up to 5 years after it closes, in case of questions or claims about our services. |
| Login and security logs | Up to 2 years, so we can investigate security incidents and misuse. |
| Usage data | For the duration of the subscription; after that only in aggregated form |
| Invoices and billing records | 7 years, as required by Dutch tax law |
| Support requests | For as long as your account is active, and up to 5 years after it closes. |
5. Website visitors and business contacts
Cookies
We use cookies and similar technologies on our websites. Cookies that are not strictly necessary, such as functional, analytics, and marketing cookies, are only placed with your consent. You can change or withdraw your consent at any time through the "Cookie settings" link at the bottom of every page. Our Cookie Policy lists the cookies we use.
Visit tracking
With your consent, we use HubSpot to recognise returning visitors and, if you are already in our CRM system, to link your website visits to your contact record. You can withdraw this consent at any time through "Cookie settings".
Marketing and sales communications
We send business-to-business marketing and sales emails, for example about our products, reports, and events. We keep business contact details (name, company, job title, business email address, and your interactions with our emails) in our CRM system.
- Where the law of your country allows it, for example because you are an existing customer or gave us your details, we rely on our legitimate interest.
- Where the law requires your prior consent for marketing email, for example in Germany, we only email you if you have given us that consent.
- Every marketing email contains an unsubscribe link, and you can object to marketing at any time. We then stop immediately and keep your email address on a suppression list so that we do not contact you again.
We keep business contact details until you unsubscribe or object, or until they are no longer accurate, for example because you have left the company.
Events and partners
If you register for an event we organise or co-organise, we use your details to run the event. If a partner shares attendee details with us, we only use them for our own marketing if you agreed to that when registering.
Newsletters and reports
If you subscribe to a newsletter or download a report, we use your details to send it and, if you agreed, related updates. You can unsubscribe at any time.
6. Ecosystem platform users
We operate ecosystem platforms for partners, such as government agencies and regional development organisations. Dealroom.co is the controller of your account on an ecosystem platform, and this policy applies to it.
With your consent, we share your name, email address, and user type with the partner that runs the platform, so the partner can, for example, invite you to its programmes. The partner uses this information as an independent controller under its own privacy policy. You can withdraw your consent at any time in your account settings or by emailing [email protected].
7. Who we share personal data with
- Service providers who process data on our behalf under a data processing agreement, in the categories below. A current list is available on request.
- Our customers and ecosystem partners, as described in sections 3 and 6.
- Professional advisers, such as lawyers, auditors, and insurers, where needed.
- Authorities, where we are legally required to.
- A buyer or investor, in connection with a merger, acquisition, or sale of our business, subject to confidentiality.
| Category | Examples |
|---|---|
| Hosting and infrastructure | Google Cloud Platform (EU), Cloudflare |
| Login and authentication | Auth0 (Okta) |
| CRM, marketing, and email | HubSpot |
| Payments | Mollie, Stripe |
| AI models | Anthropic, Google |
| Analytics and advertising (with consent) | See our Cookie Policy |
8. International transfers
Our platform is hosted in the European Union, on Google Cloud Platform europe-west4 (Netherlands), with europe-west3 (Frankfurt) as the fallback. Some of our service providers are based in, or have access from, countries outside the European Economic Area, such as the United States. We only transfer personal data outside the EEA where:
- the European Commission has decided the country offers adequate protection, including for providers certified under the EU-U.S. Data Privacy Framework; or
- we have agreed the European Commission's Standard Contractual Clauses with the recipient.
You can ask us for a copy of the relevant safeguards at [email protected].
9. How we protect your data
Our platform runs on Google Cloud Platform. We encrypt data in transit and at rest, give employees access only to the data they need for their role and review that access regularly, require multi-factor authentication (with hardware security keys for privileged access), keep encrypted backups in a separate region, and test our platform continuously for vulnerabilities. We are SOC 2 Type II audited and hold UK Cyber Essentials certification. If a data breach is likely to put your rights at risk, we will inform you and the supervisory authority as the law requires.
10. Your rights
You have the right to:
- access the personal data we hold about you, and learn where it came from;
- correct inaccurate or incomplete data;
- delete your data;
- object to processing based on legitimate interest, including profiling. For profiles on our platform, we will remove your profile. For direct marketing, we will always stop;
- restrict processing, for example while we check the accuracy of your data;
- data portability for data you provided to us under a contract or with consent;
- withdraw consent at any time, as easily as you gave it: through "Cookie settings" for cookies, the unsubscribe link for emails, and your account settings or [email protected] for anything else. Withdrawal does not affect processing before it.
To exercise your rights, use our Privacy Request Form or email [email protected]. We aim to respond within 3 business days, and always within one month. For complex requests, we may extend this by up to two further months, and we will tell you if we do. We may ask you to confirm your identity, for example by replying from the email address on your profile.
Complaints
If you are unhappy with how we handle your data, please contact us first at [email protected] and we will try to resolve it. We acknowledge complaints within 30 days. You also have the right to lodge a complaint with a supervisory authority: in the Netherlands, the Autoriteit Persoonsgegevens, or the authority in the country where you live or work.
11. Children
Our services are not intended for anyone under 16, and we do not knowingly collect their data or create profiles about them. If you believe we hold data about a child, contact us, and we will delete it.
12. Changes to this policy
We update this policy when our processing changes. The date at the top shows the current version. If we make material changes, we will inform account holders by email or in the product.