Privacy Policy

This notice explains what happens to personal data when you visit this website or write to us. It is written to be read. If anything here is unclear, write to office@boxwood.group and we will explain it in plain terms.

Who is responsible for your data
This site sets no cookies and does not track you
What we collect
Why we process it, and on what legal basis
Who else handles your data
Data outside the European Economic Area
How long we keep things
Your rights
How to exercise your rights
Complaining to a supervisory authority
Do you have to give us your data
Automated decisions and profiling
If someone else sends us your details
How we protect the data
Children
Changes to this notice
Language versions

1. Who is responsible for your data

The controller — the party that decides why and how your data is processed — is:

BOXWOOD CAPITAL DOO BEOGRAD, trading as Boxwood Group Registration number (matični broj): 21846244 Tax identification number (PIB): 113327345 Cara Lazara 5–7, 11000 Belgrade, Republic of Serbia Email: office@boxwood.group

No other company decides jointly with us what happens to the data described here, and we have not appointed a data protection officer: our core activity is investment rather than the processing of personal data, we do not monitor people regularly and systematically on a large scale, and we do not handle special categories of data on a large scale, so the criteria in Art. 37(1) GDPR are not met.

We are established in Serbia, and two bodies of law apply to us at once. The EU General Data Protection Regulation (Regulation (EU) 2016/679 — “GDPR”) applies directly under Art. 3(2)(a), because this site is published in German and Polish and invites enquiries from people in the Union. The Serbian Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti, Official Gazette of the Republic of Serbia No. 87/2018) applies because we are established here; the Serbian version of this page is written under that law. Where the two differ, we apply whichever gives you the stronger protection.

2. This site sets no cookies and does not track you

This website uses no cookies at all. Not for analytics, not for advertising, not for “functionality”. There is no cookie banner because there is nothing to ask you about.

There is no analytics on this site: no measurement tool, no visitor counter, no pixels, no tag manager. Nothing on these pages is loaded from a third party — no external fonts, no scripts, no embedded media — so no other company learns that you were here.

No more than two things are stored on your device, and each only if you yourself trigger it:

a localStorage entry named bw_langhint_dismissed, written only if you close the small notice suggesting another language version, so that it does not reappear;

a localStorage entry named bw_theme with the single value light, written only if you yourself press the colour-scheme switch in the page header and choose the light scheme, so that the site opens in the light scheme on your next visit. The site is dark by default. If you switch back to the dark scheme, the entry is deleted.

Neither holds an identifier, neither says anything about you, neither is ever sent to us or to anyone else, neither is a cookie, and each stays in your browser until you clear your site data (the second also disappears when you return to the dark scheme). Storing them does not require your consent: each remembers a choice you made yourself, in a service you asked for, and the colour scheme is an interface setting strictly necessary for the function you explicitly requested.

This is a deliberate design decision, and it is enforced mechanically — the site’s content security policy forbids loading anything from another host, and the release fails if a third-party script, font, tracker or tag manager is introduced.

3. What we collect

3.1 This site collects nothing through forms

This site does not collect personal data through forms. There is no contact form, no sign-up and no field on these pages that sends what you type to us. If you want to reach us, write to office@boxwood.group.

There is no marketing list either: we do not run a newsletter and we do not add you to one.

3.2 When you write to us by email

Everything in your message and any attachments, plus the routine technical headers of the email itself. If you send us a deck, a teaser or a data room link, whatever personal data it contains comes with it — see §13.

3.3 Automatically, when you load a page

Delivering a web page requires the technical data every web server receives: the address requested, the time, the response status, your IP address, and the browser identification string your browser sends. Our hosting provider records this in operational logs to deliver the site and to protect it from attack and abuse. We do not analyse these logs to identify visitors, we do not connect them to the emails we receive, and we build no profiles from them.

3.4 What we do not collect

We take no payments through this site, we use no advertising or cross-site tracking technology, we buy no contact lists, and we do not enrich what you send us with data from other sources.

We do not want special categories of data. Please do not send us health data, data about political or religious views, trade union membership, biometric or genetic data, sex life or sexual orientation, or details of criminal convictions. There is no purpose for which we need it. If you send it anyway, we will delete it as soon as we notice it, unless we need it to establish or defend a legal claim.

4. Why we process it, and on what legal basis

#	Purpose	Data	Legal basis
4.1	Reading your email, replying to it, and continuing the conversation that follows	§3.2	Art. 6(1)(b) GDPR — steps taken at your request before entering into a contract
4.2	The same, where a contract with you personally is not in prospect — a journalist, or an adviser writing about someone else’s business	§3.2	Art. 6(1)(f) — our legitimate interest in answering business correspondence addressed to us
4.3	Keeping the site available and defending it against attack and automated abuse	§3.3	Art. 6(1)(f) — our legitimate interest in a working, non-abused website
4.4	Meeting legal obligations — accounting, tax, and know-your-customer and anti-money-laundering checks where a transaction actually proceeds	as the relevant law requires	Art. 6(1)(c)
4.5	Establishing, exercising or defending legal claims	whatever is relevant	Art. 6(1)(f)

We do not ask for your consent, and we do not process anything on the basis of consent. There is no consent tick box anywhere on this site, and there is nothing on it that would need one. What you send us, we handle because you asked us to (4.1) — which is a firmer footing than consent, not a weaker one: consent can be withdrawn mid-negotiation, and using it here would mean we might have to stop a correspondence you are relying on.

Where we rely on a legitimate interest (4.2, 4.3, 4.5), we have weighed it against your interests and can produce that assessment on request. In short: 4.2 concerns data you deliberately sent us, for a purpose you chose, in a context where being answered is exactly what you wanted; 4.3 is the minimum needed to keep a public website standing. You can object to any processing based on a legitimate interest — see §8.

5. Who else handles your data

We do not sell personal data and we do not share it for anyone else’s marketing. There is no customer database behind this site: it is a set of static pages, and nothing you read here is assembled from stored records about visitors.

Hosting. These pages are hosted for us by Fornex Hosting S.L., a company incorporated in Spain, which delivers them through its own network of servers. The servers that store and serve this site are in Frankfurt am Main, Germany. Serving a page to you means that provider’s infrastructure handles the request, including the technical data in §3.3. It acts as our processor and only on our instructions, and we use it for nothing but delivering these pages.
Email. Correspondence with us lives in our mailboxes, which are run for us by an email service provider. If the identity of that provider matters to you — as it reasonably may — ask us at office@boxwood.group before you write anything confidential, and we will tell you who it is and the country its servers are in.
Professional advisers — lawyers, auditors, accountants — where a matter genuinely requires it, under their own duties of confidentiality.
Public authorities, where a law obliges us to disclose.

These are the recipients we work with at present. We use no analytics provider, no marketing platform and no CRM.

6. Data outside the European Economic Area

We would rather state this than bury it: we are established in Serbia, and the European Commission has not adopted an adequacy decision for Serbia. Data you send us is therefore held in a third country. Your own act of sending it to us is not a “transfer” in the sense of Chapter V GDPR — you are the one transmitting it — but you should know where it ends up before you write.

Hosting these pages takes no data out of the European Economic Area. Our hosting provider, Fornex Hosting S.L., serves this site from servers in Frankfurt am Main, Germany — a Member State of the European Union and so of the EEA. The platform data described in §3.3 is therefore handled inside the EEA, which under Chapter V GDPR is not a transfer to a third country at all: no adequacy decision is needed for it, no safeguard under Art. 46 GDPR is required, and we rely on none. That the provider is a Spanish company changes nothing — Spain is in the EEA too. Under Serbian law the same engagement needs no authorisation from the Commissioner either, because Germany is on the list of countries deemed to provide an adequate level of protection (Government Decision, Official Gazette of the Republic of Serbia No. 55/2019, section I, item 31). If this site ever moves to servers outside the EEA, we will rewrite this section before the move, not after.

Our email is run for us by an email service provider — see §5. On request we will tell you who it is and the country its servers are in.

If our email provider’s servers are outside the EEA and we rely on a safeguard under Art. 46 GDPR for that transfer, you may ask us which safeguard applies, and we will tell you and give you a copy of the relevant document.

7. How long we keep things

We do not keep personal data longer than the purpose it was collected for requires.

What	For how long
Your email and the correspondence that follows	While the matter it concerns is live, and afterwards only for as long as we may need it to establish or defend a legal claim. Correspondence that leads nowhere is deleted once it is plainly closed
Server logs	For the retention period of our hosting platform, which we do not extend, and from which we extract nothing
Records that accounting, tax or anti-money-laundering law requires us to keep, where a transaction proceeds	For the period that law prescribes — which is longer than anything above — and then deleted

There is no database of correspondence behind this site, so there is nothing standing behind these periods that quietly outlives them, and there are no backups of such a database to survive a deletion. If you ask us to erase your data, what we erase is the correspondence itself.

8. Your rights

Right	What it means here
Access (Art. 15 GDPR)	Ask whether we hold data about you and get a copy of it
Rectification (Art. 16)	Have inaccurate data corrected and incomplete data completed
Erasure (Art. 17)	Have your data deleted where we no longer need it, or where you successfully object. Not absolute: we may keep what a law requires, or what we need to defend a legal claim
Restriction (Art. 18)	Have processing frozen — for example while we check an accuracy dispute
Portability (Art. 20)	Receive the data you gave us in a structured, machine-readable format, and have it sent to another controller where technically feasible. This covers the data processed under 4.1
Objection (Art. 21)	Object at any time to processing based on our legitimate interest (4.2, 4.3, 4.5). We must then stop unless we can show compelling grounds that override your interests
Complain (Art. 77)	See §10

There is no right to withdraw consent listed here for one reason: we rely on no consent, so there is none to withdraw.

You are never charged for exercising these rights, and exercising them will not affect how we deal with your correspondence.

9. How to exercise your rights

Write to office@boxwood.group, or by post to the address in §1. You do not need a particular form of words, an article number, or a reason.

We answer without undue delay and within one month. If a request is genuinely complex we may extend that by up to two further months, and we will tell you within the first month that we are doing so, and why.
We may ask for information that helps us identify you — but only what is genuinely necessary, and never as an excuse to collect more than we already hold.
If we refuse a request, we will tell you why, and tell you that you can complain to a supervisory authority and go to court.

10. Complaining to a supervisory authority

If you think we have handled your data wrongly, please tell us first — it is usually the fastest way to fix it. But you do not have to, and your right to complain does not depend on contacting us.

If you are in the EU or EEA, you may complain to the supervisory authority of the state where you live, where you work, or where you believe the infringement took place — your choice (Art. 77 GDPR). The list of authorities is published by the European Data Protection Board at edpb.europa.eu. In Germany this is the Federal Commissioner (BfDI) and the authorities of the federal states; in Poland it is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa). Because we have no establishment in the Union, the GDPR’s “one-stop-shop” does not apply to us: there is no lead authority, and your own national authority is competent.

In Serbia:

Commissioner for Information of Public Importance and Personal Data Protection (Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti) Bulevar kralja Aleksandra 15, 11120 Belgrade, Serbia office@poverenik.rs · poverenik.rs

You may also bring proceedings before the courts. Nothing in this notice limits that.

11. Do you have to give us your data

No. There is no statutory or contractual obligation to give us anything.

There is no form to fill in. If you write to us by email, what you include is up to you. We need only an address to reply to and a message to reply to — not because a law requires them, but because without them there is nothing we can answer.
The consequence of not providing data is simply that we cannot answer you. There is no other effect.

12. Automated decisions and profiling

We make no decisions about you by automated means within the meaning of Art. 22 GDPR, and we do not profile you. No algorithm scores your email, ranks you, or decides whether we will respond. Every decision about whether and how to answer is taken by a person.

13. If someone else sends us your details

Sometimes we receive personal data about someone who did not send it to us — most often when an adviser, intermediary or founder sends us a teaser, a deck or a data room containing the names, roles and contact details of a management team, shareholders or beneficial owners.

Where that happens: the data is typically name, role, business contact details and information about the person’s involvement in the business under discussion; the source is the party that sent it to us, and we will tell you which one on request; the legal basis is Art. 6(1)(f) — our legitimate interest, and that of the party who approached us, in assessing a potential transaction. We will tell you that we hold your data within one month of receiving it, or at the latest when we first contact you, unless one of the exceptions in Art. 14(5) GDPR applies. You have all the rights in §8. We expect whoever sent it to have had a lawful basis for doing so; that expectation does not diminish our own obligations to you.

14. How we protect the data

Security measures are means, not promises, and we describe them as such:

All traffic to this site is encrypted in transit (HTTPS, HSTS). Email is sent and received over TLS where the other side supports it.
A strict content security policy prevents this site from loading scripts, fonts or frames from any other host — which is what makes §2 enforceable rather than aspirational. An automated check fails the release if such a host appears.
Access to correspondence is limited to the people who need it to answer you, over individually authenticated accounts.
Preview and staging deployments are password-protected and excluded from search engines.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of it, and we will inform you directly where the risk is high.

15. Children

This site is addressed to founders, advisers, investors and journalists acting professionally. It is not directed at anyone under 16, and we do not knowingly collect their data. If you believe a child has sent us personal data, write to office@boxwood.group and we will delete it.

16. Changes to this notice

This notice is versioned, and the version and the date it took effect are shown with it. We keep earlier versions, so that it is always possible to establish what we told you at the time you wrote.

Editorial changes — clearer wording, corrected links — take effect on publication.
Substantive changes — a new purpose, a new recipient, a longer retention period, a new transfer — are published here before they take effect, and where we hold your contact details and the change materially affects you, we will tell you directly.
We will not treat your continued use of the site as agreement to anything.

17. Language versions

This notice is published in English, German and Polish, and each version says the same thing: they are translations of one text, because the processing they describe is one and the same. Each version is equally authoritative. We deliberately do not say that the English text prevails: a privacy notice exists to inform you, and making your understanding of your own rights subordinate to a text in another language would work against that.

The Serbian version is not a translation of this page but a separate document, written under the Serbian Law on Personal Data Protection, which is a different statute with a different supervisory authority.

If you find a discrepancy between versions, tell us at office@boxwood.group. We will correct it, and until we do, we will apply whichever reading is more favourable to you.