Legal · GDPR
Privacy Policy
1. Introduction & Identity of the Data Controller
Blue Prosperity Fund ("we", "us", "our") is committed to protecting the privacy and personal data of every visitor to our websites www.blueprosperityfund.com and www.blueprosperityfund.eu (together, the "Site").
This Privacy Policy explains what personal data we collect, why we collect it, the legal basis for processing, how long we retain it, with whom we share it, and your rights under Regulation (EU) 2016/679 of the European Parliament and of the Council ("GDPR") and any applicable national implementing legislation.
Data Controller:
Blue Prosperity Fund · c/o Arènes Partners
Paris, France & Luxembourg
Contact: privacy@blueprosperityfund.com
2. Personal Data We Collect
2.1 Technical Data (collected automatically)
- IP address — collected by our hosting provider (Vercel) and Google Analytics for geolocation and security purposes; your IP address is anonymised before storage in analytics.
- Browser type and version — e.g., Chrome 120, Safari 17.
- Device type and model — e.g., desktop, mobile, tablet.
- Operating system — e.g., Windows 11, macOS Sonoma, iOS 17.
- Screen resolution and language preference — used for analytics aggregation only.
2.2 Usage Data (collected automatically)
- Pages visited — which pages of the Site you viewed and in what order.
- Time spent on site — session duration and per-page engagement time.
- Referring URL — the web address that directed you to our Site.
- Click and interaction events — buttons clicked, links followed (e.g., CTA tracking).
2.3 Cookies & Similar Technologies
We use cookies (small text files stored on your device) as described in Section 6 below.
2.4 Data You Provide Voluntarily
When you submit the Investor Waiting List registration form (hosted by Google Forms), you provide:
- Name and surname
- Email address
- Organisation / company name (optional)
- Country of residence
- Investor type / accreditation status
- Any additional information you voluntarily include in free-text fields
The registration form is operated by Google LLC (Google Forms / Google Sheets). When you submit the form, your data is processed under Google's Privacy Policy in addition to ours. Google LLC transfers data to the United States (see Section 8).
3. How We Collect Your Data
| Collection Method | Data Types | Trigger |
|---|---|---|
| Google Analytics 4 (GA4) | Technical data, Usage data, Cookies | Only after you click Accept on the cookie banner |
| Vercel (hosting infrastructure) | IP address, request logs | Every page load (legitimate interest — security & DDoS protection) |
| Google Forms | Name, email, organisation, investor type | When you voluntarily submit the waiting list form |
| Browser localStorage | Cookie consent preference (accepted / declined) | When you interact with the cookie banner |
4. Purposes & Legal Basis for Processing
| Purpose | Data Used | Legal Basis (GDPR Art.) |
|---|---|---|
| Website analytics & performance measurement | Technical data, Usage data, Cookies | Consent — Art. 6(1)(a) |
| Security, fraud prevention & DDoS protection | IP address, request logs | Legitimate interests — Art. 6(1)(f) |
| Processing investor waiting list registrations | Name, email, org, investor type | Consent — Art. 6(1)(a) & Pre-contractual steps — Art. 6(1)(b) |
| Sending fund-related communications to registered interest parties | Email address, name | Consent — Art. 6(1)(a) |
| Compliance with legal obligations (e.g., AML/KYC pre-screening) | Name, country, investor type | Legal obligation — Art. 6(1)(c) |
| Cookie preference management | localStorage consent flag | Legitimate interests — Art. 6(1)(f) |
5. Data Retention Periods
| Data Category | Retention Period |
|---|---|
| Google Analytics session data | 14 months (GA4 default, reduced from maximum) |
| Server access logs (Vercel) | 30 days (then automatically deleted) |
| Waiting list registration data (Google Sheets) | Until fund close or 3 years from collection, whichever is earlier |
| Email communications | 3 years from last meaningful interaction |
| Cookie consent record (localStorage) | 12 months (stored locally on your device) |
6. Cookies & Tracking Technologies
We use a cookie consent mechanism. No analytics cookies are set before you give consent. You can change your preference at any time by clicking Cookie Preferences in the footer.
6.1 Essential cookies (no consent required)
| Name | Purpose | Duration |
|---|---|---|
| bpf_cookie_consent | Stores your cookie consent choice (localStorage, not a cookie) | 12 months |
6.2 Analytics cookies (consent required)
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| _ga | Google Analytics 4 | Distinguishes unique users for aggregate reporting | 2 years |
| _ga_SHBW166B6Q | Google Analytics 4 | Maintains session state for this property | 2 years |
IP addresses sent to Google Analytics are anonymised before storage
(anonymize_ip: true). We do not use analytics for advertising or
cross-site tracking purposes.
7. Recipients of Personal Data
We share your data only with the following third-party processors, and solely to the extent necessary:
| Recipient | Role | Location | Safeguards |
|---|---|---|---|
| Vercel Inc. | Website hosting & CDN | USA (with EU edge nodes) | EU–US Data Privacy Framework, SCCs |
| Google LLC (Analytics) | Analytics processor | USA | EU–US Data Privacy Framework, SCCs; IP anonymisation enabled |
| Google LLC (Forms / Sheets) | Form collection & data storage | USA | EU–US Data Privacy Framework, SCCs |
We do not sell your personal data. We do not share data with advertising networks, data brokers, or any party not listed above.
8. International Data Transfers
Some of our processors (Vercel, Google) are based in the United States. Transfers to the US are made in compliance with GDPR Chapter V through one or more of the following mechanisms:
- The EU–US Data Privacy Framework (adequacy decision of 10 July 2023).
- Standard Contractual Clauses (SCCs) as adopted by the European Commission.
You may request a copy of the applicable transfer safeguards by contacting us at privacy@blueprosperityfund.com.
9. Your Rights Under GDPR
As a data subject under GDPR, you have the following rights. To exercise any right, contact us at privacy@blueprosperityfund.com. We will respond within 30 calendar days (extendable by 2 months for complex requests). You will not be charged for exercising your rights.
Right of Access (Art. 15)
Obtain a copy of all personal data we hold about you and information about how it is processed.
Right to Rectification (Art. 16)
Request correction of inaccurate or incomplete personal data.
Right to Erasure (Art. 17)
Request deletion of your data where there is no compelling reason for us to continue processing ("right to be forgotten").
Right to Restriction (Art. 18)
Request that we restrict processing of your data in certain circumstances (e.g., while accuracy is contested).
Right to Data Portability (Art. 20)
Receive your data in a structured, machine-readable format or have it transferred to another controller where processing is based on consent.
Right to Object (Art. 21)
Object to processing based on legitimate interests at any time. We will stop unless we can demonstrate compelling legitimate grounds.
Right to Withdraw Consent (Art. 7(3))
Withdraw consent at any time without affecting the lawfulness of prior processing. Use the Cookie Preferences link or email us.
Right to Lodge a Complaint
Lodge a complaint with your national data protection authority (e.g., CNIL in France, CNPD in Luxembourg) if you believe we have infringed GDPR.
10. Automated Decision-Making & Profiling
We do not engage in automated decision-making or profiling as defined in GDPR Article 22 that produces legal or similarly significant effects on individuals. Google Analytics aggregates data for statistical purposes only.
11. Data Security
We implement appropriate technical and organisational measures to protect your personal data, including:
- HTTPS / TLS encryption for all data in transit.
- Secure headers (HSTS, X-Content-Type-Options, X-Frame-Options) deployed via Vercel.
- Access controls limiting who in our team can access registration data.
- Regular review of our sub-processor security postures.
No system is 100% secure. In the event of a personal data breach that poses a high risk to your rights and freedoms, we will notify you without undue delay in accordance with GDPR Article 34.
12. Children's Privacy
Our Site is intended exclusively for professional and institutional investors. We do not knowingly collect personal data from anyone under the age of 18. If we become aware that we have collected data from a minor, we will delete it immediately.
13. Third-Party Links
Our Site may contain links to third-party websites (e.g., Google Forms). We are not responsible for the privacy practices of those sites. We encourage you to read their privacy policies.
14. Updates to This Policy
We may update this Privacy Policy from time to time to reflect changes in law, our practices or our service. The date at the top of this page indicates the most recent version. Material changes will be signalled on the Site. Continued use of the Site after an update constitutes acceptance of the revised policy.
15. Contact & Supervisory Authority
For any privacy-related questions, requests or complaints, contact us at:
Blue Prosperity Fund — Privacy
Email: privacy@blueprosperityfund.com
Website: www.blueprosperityfund.com
If you are located in France, you may also contact the CNIL (Commission Nationale de l'Informatique et des Libertés): www.cnil.fr · +33 1 53 73 22 22
If you are located in Luxembourg, you may contact the CNPD (Commission Nationale pour la Protection des Données): cnpd.public.lu
You also have the right to contact the supervisory authority in your country of residence within the European Union.