Privacy Policy
1. Who We Are
Prytaneum Partners ("we", "us", "our") is a member of the Valkyrie Revival Fund complex of entities, a BVI Exempt Private Fund Complex operating globally. Prytaneum Partners acts as a data controller in respect of the personal data it collects and processes in connection with its investment management, advisory, and operational activities.
Registered Address: Prytaneum Partners, [Registered Address — BVI]
Data Protection Contact: Todd Ramsey — Managing Director (Legal Oversight)
Email: [email protected]
Subject line: Privacy Enquiry / DSAR
All data held within our internal systems is stored and managed within the VALHROS Governance Repository, our proprietary centralised platform for governance, compliance, and data management.
2. Scope of This Policy
This policy applies to all individuals whose personal data is collected, processed, or stored, including:
- —Investors (Limited Partners) and prospective investors
- —Portfolio company representatives
- —Employees, contractors, and consultants
- —Website visitors
Covers all jurisdictions: BVI, EU, UK, US, Canada. All processing is conducted through the VALHROS platform or connected systems. This policy should be read alongside our Cybersecurity & Data Privacy Policy and Compliance & Governance Policy.
3. Regulatory Framework
This policy is designed to comply with:
- —EU GDPR — Regulation (EU) 2016/679
- —UK GDPR — as retained by the EU (Withdrawal) Act 2018
- —BVI Data Protection Act, 2021 (GDPR-equivalent standards)
- —Securities and Investment Business Act, 2009 (SIBA)
- —BVI Anti-Money Laundering Regulations, 2008 (as amended)
- —Canada: PIPEDA and applicable provincial legislation
- —United States: applicable federal and state privacy standards under Regulation D (Rule 506(c)) and Regulation S
4. What Personal Data We Collect
4.1 Identity & Contact Information
Full legal name, date of birth, nationality, passport/ID number, residential and business address, telephone, and email.
4.2 Financial & Investment Information
Net worth declarations, accredited/qualified investor certifications, source of funds, bank account details, investment history, and subscription amounts.
4.3 KYC / AML Compliance Data
Beneficial ownership, PEP status, sanctions screening, risk classification, and supporting ID documentation.
4.4 Professional Information
Employment history, professional credentials, directorships, regulatory registrations, and business affiliations.
4.5 Communications Data
Records of written and electronic communications including emails, letters, meeting notes, and call logs retained in the VALHROS Repository.
4.6 Technical & System Data
IP addresses, access logs, authentication records, and usage data relating to the VALHROS platform or connected portal.
4.7 Special Category Data
Not routinely processed. Where exceptionally required, explicit consent is obtained and lawful basis documented.
5. How We Collect Personal Data
Directly from you — Through investor subscription documents, onboarding questionnaires, KYC/AML forms, communications, and interactions with the VALHROS portal.
From authorised third parties — Including fund administrators, custodians, legal counsel, placement agents, and background screening providers operating under Data Processing Agreements.
From public sources — Including regulatory registers, company registries, and sanctions databases, where required for compliance.
6. Purposes and Lawful Bases for Processing
| Purpose | Lawful Basis (GDPR Art. 6) |
|---|---|
| Investor onboarding and KYC/AML verification | Legal obligation (Art. 6(1)(c)) |
| Administration of investment subscriptions and capital accounts | Performance of a contract (Art. 6(1)(b)) |
| Regulatory filings and reporting to the BVI FSC | Legal obligation (Art. 6(1)(c)) |
| Investor relations, fund reporting, and communications | Legitimate interests (Art. 6(1)(f)) |
| Conflict of interest screening and disclosure | Legal obligation / Legitimate interests |
| IT security, fraud prevention, and system access management | Legitimate interests (Art. 6(1)(f)) |
| Compliance monitoring and internal audit | Legal obligation / Legitimate interests |
| Direct marketing or commercial communications (where applicable) | Consent (Art. 6(1)(a)) |
| Portfolio company due diligence and operational support | Legitimate interests (Art. 6(1)(f)) |
Where legitimate interests is the lawful basis, we have assessed that our interests are not overridden by your rights and freedoms. You have the right to object — see Section 9.
7. Data Retention
7.1 Standard Retention Periods
| Data Category | Retention Period |
|---|---|
| Investor KYC/AML records | 7 years from end of investor relationship, or as required by applicable AML regulations |
| Subscription and transaction records | 7 years from date of transaction |
| Communications and correspondence | 7 years from date of communication |
| Compliance and governance records | 7 years from creation, per the VALHROS Data Classification & Retention Standard |
| Security logs and incident records | 7 years from date of event |
| Employee and contractor records | 7 years from end of engagement |
| Website and system access logs | 12 months from date of access, unless required for longer by ongoing investigation |
7.2 Extended Retention
Where a legal claim is pending or reasonably anticipated, or a regulatory authority has requested records be preserved, data is retained beyond standard periods until the matter is resolved.
7.3 Secure Disposal
Upon expiry of the retention period, data will be securely and irreversibly destroyed or anonymised per our Data Classification & Retention Standard. All destruction is logged in the VALHROS Repository.
8. Data Security
Encryption: AES-256 at rest; TLS 1.3 in transit.
Access controls: Role-based, least-privilege, mandatory MFA for all system users.
Monitoring: Continuous 24/7 security monitoring and endpoint detection under CIO Jeff Moyer.
Incident response: Tiered framework with escalation to Managing Director and Board for material breaches; regulatory notification within 24 hours.
Vendor security: All third-party vendors required to sign DPAs and demonstrate ISO 27001 / SOC 2 certifications reviewed annually.
Penetration testing: Annual penetration testing and vulnerability assessments mandatory.
All security incidents are logged in VALHROS Sentinel, our internal compliance and monitoring system.
9. Your Rights as a Data Subject
9.1 Right of Access (DSAR)
Request a copy of personal data held and information about how and why it is processed. See Section 10 for the DSAR process.
9.2 Right to Rectification
Request correction of inaccurate or incomplete data. Corrections implemented within 10 business days of verification.
9.3 Right to Erasure ("Right to be Forgotten")
Request deletion where no longer necessary, consent withdrawn, or no other lawful basis. Limited where retention is required by law (e.g. AML) or for legal claims.
9.4 Right to Restriction of Processing
Request restriction in certain circumstances (e.g. while accuracy is contested, or pending objection resolution).
9.5 Right to Data Portability
Where processing is based on consent or contract and carried out by automated means, you have the right to receive data in a structured, machine-readable format.
9.6 Right to Object
Right to object to processing based on legitimate interests, including profiling. We will cease unless compelling legitimate grounds are demonstrated.
9.7 Rights in Relation to Automated Decision-Making
We do not make legally significant decisions based solely on automated processing without human review.
9.8 Right to Withdraw Consent
Where processing is based on consent, you may withdraw at any time. Withdrawal does not affect the lawfulness of prior processing.
10. Data Subject Access Request (DSAR) Process
10.1 How to Submit a DSAR
By email: [email protected] — Subject: Data Subject Access Request — [Your Full Name]
By post: Data Subject Access Request, Prytaneum Partners, [Registered Address — BVI]
Please include: (i) full name; (ii) relationship to Prytaneum Partners; (iii) description of personal data or specific right; (iv) copy of valid photo ID for identity verification.
10.2 Identity Verification
We verify identity before processing to protect data from unauthorised disclosure. Requests will not be processed until identity is confirmed. Authorised representatives must provide written evidence of authority.
10.3 Response Timeline
Acknowledged within 5 business days. Full response within one calendar month (30 days) of identity verification, per GDPR Article 12. An extension of up to two further months is permitted for complex or high-volume requests, with notification provided within the initial 30-day period.
10.4 Exemptions
Data may be withheld where disclosure would: (i) prejudice ongoing legal or regulatory proceedings; (ii) require disclosure of another individual's data without consent; (iii) be subject to legal professional privilege; or (iv) be prohibited by applicable law. Reasons for withholding will be provided.
10.5 No Fee
No charge for handling a DSAR. For manifestly unfounded, repetitive, or excessive requests, we reserve the right to charge a reasonable administrative fee or refuse to act, per GDPR Article 12(5).
10.6 DSAR Log
All DSARs are logged in the VALHROS Repository and reviewed by the Managing Director (Legal Oversight).
11. International Data Transfers
Prytaneum Partners operates across multiple jurisdictions. Personal data transferred outside the EEA or UK is protected by:
Adequacy decisions: Transfers to countries with recognised adequate data protection.
Standard Contractual Clauses (SCCs): EU or UK-approved SCCs where no adequacy decision exists.
Data Processing Agreements (DPAs): Executed with all third-party vendors processing personal data on our behalf.
No personal data is transferred outside approved jurisdictions without prior legal review by the Managing Director (Legal Oversight) and, where required, Conyers Dill & Pearman (BVI). Cross-border transfer arrangements are reviewed annually.
12. Sharing Your Personal Data
We do not sell, rent, or trade personal data. We may share with:
Regulatory and legal obligations: Disclosure to BVI FSC, tax authorities, law enforcement, or competent regulators where required by law.
Professional advisers and service providers: Fund administrators, auditors, legal counsel (Conyers Dill & Pearman), custodians, and technology service providers under appropriate DPAs and confidentiality obligations.
Within the Fund complex: Between entities within the Valkyrie Revival Fund complex for operational, compliance, or governance purposes, under equivalent data protection standards.
AML / Fraud prevention: Background screening and sanctions checking providers for KYC/AML compliance.
Business transactions: In connection with a merger, restructuring, or change in control of the Fund, subject to appropriate confidentiality protections.
All third-party recipients are required to maintain data protection standards equivalent to those in this policy.
13. Cookies and Tracking Technologies
Where Prytaneum Partners operates website properties or investor portals, we may use cookies and similar tracking technologies to improve functionality and user experience. A separate Cookie Policy governs the use of cookies on our web properties. You may adjust your cookie preferences through the settings panel on the relevant site at any time.
14. Data Breach Notification
In the event of a personal data breach, Prytaneum Partners will:
- 1.
Internally: Log the incident in VALHROS Sentinel within 30 minutes of detection and escalate to CIO (Jeff Moyer) and Managing Director (Todd Ramsey) immediately.
- 2.
Regulatory notification: Notify relevant supervisory authority (BVI FSC and, where applicable, EU/UK supervisory authorities) within 72 hours of becoming aware of a breach likely to result in risk to rights and freedoms of natural persons, per GDPR Article 33.
- 3.
Individual notification: Where a breach is likely to result in high risk to individuals, notify those individuals without undue delay in clear and plain language, per GDPR Article 34.
Material incidents are escalated to the Board of Managers and, where investor interests are affected, to relevant Limited Partners within 24 hours.
15. Changes to This Policy
We review this Privacy Policy annually, or sooner where required by a change in law, regulatory guidance, or our processing activities. Material amendments are communicated to affected data subjects via the VALHROS Governance Portal and, where appropriate, by direct notification. Version history is maintained in the VALHROS Repository. All amendments require approval by the Board of Managers.
16. Supervisory Authority and Right to Complain
You have the right to lodge a complaint with a competent supervisory authority if you believe we have processed your personal data inconsistently with applicable data protection law.
Relevant authorities depending on jurisdiction:
EU: Your local EU Member State Data Protection Authority (DPA), or lead supervisory authority
We encourage you to contact us first using the details in Section 1 so that we can seek to resolve your concern directly.
17. Governing Law
This Privacy Policy is governed by and interpreted in accordance with the laws of the British Virgin Islands, without prejudice to your rights under applicable local data protection legislation in your jurisdiction of residence.
18. Automated Behavioural Analysis
The VALHROS platform uses AI and automated analysis to support institutional relationship management. The following activities involve deriving inferred attributes from interaction data held in our CRM. These activities are disclosed here under GDPR Articles 13/14 and are documented in our internal Records of Processing Activities (RoPA).
18.1 LP Interaction Archetype Classification
We classify LP representatives into one of eight relationship archetypes based on information you or your organisation have provided (allocator type, commitment preferences, conviction signals) and engagement metrics computed from your interaction history with us. The resulting archetype is used to inform the tone, timing, and content of capital formation communications prepared by our relationship managers.
This processing is based on legitimate interests (GDPR Art. 6(1)(f)) — specifically, our interest in conducting effective institutional relationship management during capital formation. Classification relies on information already held for primary CRM purposes and does not involve submitting your data to any external AI model.
18.2 Behavioural Signal Analysis and Concern Pattern Inference
Where we have sufficient interaction history (a minimum of three paired communication events), our platform analyses behavioral signals derived from your communications with us. These signals include: response latency patterns, question deflection frequency, hedging language density in written responses, tone shift across the engagement window, and positional consistency across communications. This analysis is used to infer concern patterns where they may differ from the concerns you have stated to us, so that our relationship managers can adapt their engagement approach accordingly.
Hedging language density is assessed by submitting sanitized, length-capped excerpts of your inbound email text to Anthropic's Claude API. Anthropic processes this as a data processor under its API terms. No raw email content is retained in derived data tables — only normalized numerical scores.
This processing is based on legitimate interests (GDPR Art. 6(1)(f)). All concern pattern hypotheses are presented to human relationship managers with an explicit confidence rating (Speculative / Probable / High Confidence / Validated). No automated action is taken on the basis of a hypothesis without human review.
18.3 Churn Risk Scoring
We compute a churn risk score for each LP relationship using engagement velocity trends, conviction decay metrics, and close probability signals derived from your interaction history. The output is a numerical probability score and an Expected Recoverable Loss figure used internally to prioritise retention activity. All computation is deterministic and rule-based; no personal data is submitted to any external AI model for this activity.
This processing is based on legitimate interests (GDPR Art. 6(1)(f)). The score is an internal prioritisation tool only; it does not affect your subscription terms, distribution entitlements, or any legal or financial rights.
18.4 Retention of Inferred Profiles
All derived profiling records (archetype classifications, concern hypotheses, churn risk scores) are retained for a rolling period of 90 days from the date of computation. They are automatically purged thereafter and are cascade-deleted upon fulfilment of a GDPR erasure request under Section 9.3.
18.5 Article 22 — Automated Decision-Making
None of the three profiling activities described above produce decisions that have legal or similarly significant effects on you as an individual. All outputs are presented to human relationship managers for review before any action is taken. GDPR Article 22 safeguards (the right not to be subject to solely automated decisions) are therefore not engaged; however, you retain the right to object to profiling under Article 21 and the right to request erasure of inferred profiles under Article 17.
How to request deletion of inferred profiles
To request deletion of your archetype classification, concern hypotheses, or churn risk scores under GDPR Article 17, contact us at [email protected] with the subject line Profile Erasure Request — [Your Full Name / Organisation]. We will action the request within 30 days in accordance with Section 10 of this policy. Note that retention obligations under AML and regulatory law do not apply to inferred AI profiles, so erasure requests for these records will be fulfilled without exception.
© 2026 Prytaneum Partners. All rights reserved. This document is part of the Prytaneum Partners / Valkyrie Revival Fund governance framework and is stored in the VALHROS Governance Repository.