Draft subject to legal review before final publication.
Last updated: 3 October 2026
1. Legal framework
This policy is issued under Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR"), the Luxembourg Law of 1 August 2018 on the organisation of the National Data Protection Commission and the general data protection framework, and, for cookies and browser storage, Article 4(3)(e) of the amended Luxembourg Law of 30 May 2005 on electronic communications, which implements Directive 2002/58/EC (ePrivacy Directive). Storage that is not strictly necessary is used only with your prior consent.
2. Data controller
The controller of your personal data is BRIGHTFLIXX FINANCE (LUXEMBOURG) S.A., a société anonyme registered with the Luxembourg Trade and Companies Register (RCS) under number B283083, with its registered office at 12C, Rue Guillaume J. Kroll, L-1882 Luxembourg.
You may contact the controller at office@brightflixxfinance.com. The company has not appointed a data protection officer, as it is not required to do so under Article 37 GDPR; data protection requests are handled by the controller at the address above.
3. Exercising your rights
Requests may be sent to office@brightflixxfinance.com. We respond without undue delay and in any event within one month of receipt, extendable by two further months where necessary given the complexity or number of requests (Art. 12(3) GDPR). We may ask for information to confirm your identity. Requests are free of charge unless manifestly unfounded or excessive.
Providing personal data through our forms is voluntary; however, without the data marked as required we cannot respond to your enquiry or process your request.
No decision producing legal effects or similarly significant effects is taken about you solely by automated means, including profiling (Art. 22 GDPR).
4. Data we collect
Identification and contact data you provide (name, email address, organisation).
Content of enquiries, project registrations and document-access requests.
Your email address and language preference when you subscribe to the quarterly newsletter.
Account data for the investor portal (email, authentication data, access status).
Technical data strictly necessary to operate and secure the website (e.g. IP address, browser type, session information).
5. Purposes and legal bases
Responding to enquiries and reviewing project registrations — your consent and our legitimate interest (Art. 6(1)(a) and (f) GDPR).
Sending the quarterly newsletter — your consent (Art. 6(1)(a) GDPR); you may unsubscribe at any time by replying to any newsletter email.
Managing investor-portal accounts and controlled document access — steps prior to entering into a contract and legitimate interest (Art. 6(1)(b) and (f)).
Complying with legal obligations, including anti-money-laundering and record-keeping duties (Art. 6(1)(c)).
Securing the website and preventing abuse — legitimate interest (Art. 6(1)(f)).
6. Recipients and processors
Data is accessed only by authorised persons within the company. We use a hosting and database provider to store submissions and documents securely; scheduling requests made through Calendly are processed by Calendly under its own policy.
Data may be shared with auditors, legal advisers or authorities where required by law. We do not sell personal data.
7. International transfers
Where a service provider processes data outside the European Economic Area, transfers rely on an adequacy decision or the European Commission’s standard contractual clauses.
8. Retention
Personal data is kept only for as long as necessary for the purpose for which it was collected. Enquiries and project registrations are retained while they are being handled and, where necessary, for a limited period afterwards to establish, exercise or defend legal claims. Newsletter contact data is retained until consent is withdrawn or the subscription is ended. Portal account and document-access data is retained while access remains active and afterwards only where needed for security, audit or legal obligations. Records subject to Luxembourg statutory record-keeping requirements may be retained for up to 10 years. Data is deleted or anonymised when the applicable period expires, unless a legal hold or another legal obligation requires longer retention.
9. Your rights
You have the right to access, rectify, erase and port your data, to restrict or object to processing, and to withdraw consent at any time without affecting prior processing.
You may lodge a complaint with the Commission nationale pour la protection des données (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg — cnpd.public.lu.
10. Security
We apply technical and organisational measures including encrypted connections, role-based access, private document storage and expiring download links.
11. Cookies and browser storage
Essential storage supports authentication, security and your cookie choice. The local-storage record bf-cookie-consent contains your choice, timestamp and notice version; it expires after 180 days, when we ask again. Authentication storage is managed by the sign-in service and is cleared on sign-out. Full details are set out in our Cookie Policy (see the Cookie policy link in the page footer).
Optional preference storage is off by default. With your consent, bf-lang remembers your selected language until you withdraw consent or clear browser storage, and bf-newsletter-offered avoids repeated newsletter invitations during a browser session. Rejecting optional storage does not prevent browsing, changing the current language or using the investor portal. Newsletter email consent is separate from cookie consent.
No advertising or analytics cookies are currently active on this website. If analytics or marketing cookies are introduced, they will be used only with your consent. You can accept, reject or customise optional storage in the consent bar and change or withdraw your choice at any time using Cookie settings in the footer. Withdrawal removes the optional preference records. External services such as Calendly are opened through links rather than embedded and apply their own privacy and cookie policies. Requests for externally hosted fonts and images may disclose technical connection data to their providers even without cookies.
12. Changes
We may update this policy. The date at the top shows the latest version.