Privacy Policy

Version 1, last update: June 2026

Information on the Processing of Your Data

Pursuant to Art. 12 of the General Data Protection Regulation (hereinafter: “GDPR”), we are required to inform you about the processing of your data when using our website. We take the protection of your personal data very seriously, and this privacy policy informs you of the details of the processing of your data as well as your related statutory rights.

We reserve the right to amend this privacy policy with effect for the future, in particular in the event of further development of the website, the use of new technologies, or changes to the legal framework or relevant case law. We recommend that you review this privacy policy from time to time and keep a printout or copy for your records.

Definitions

“Website” or “Online Presence” means all pages of the controller at https://collectible-investment.com/.
“Personal Data” means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to that person.
“Processing” means any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, dissemination, alignment, combination, restriction, erasure, or destruction.
“Consent” means any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

Scope

This privacy policy applies to http://www.collectible-invest.com/. It does not extend to any linked websites or online presences operated by other providers.

Controller

The controller responsible for the processing of personal data within the scope of this privacy policy is:

New Horizon GmbH, Neue Schönhauser Str. 2, 10178 Berlin, Germany

Email: contact@collectible-invest.com

Data Protection Inquiries

If you have any questions regarding data protection in relation to our company or our website, you may contact our data protection officer:

SPIRIT LEGAL Fuhrmann und Hense Partnerschaft von Rechtsanwälten

Attorney and Data Protection Officer Peter Hense

Postal address:

Data Protection Officer c/o New Horizon GmbH, Neue Schönhauser Str. 2, 10178 Berlin, Germany

Contact by email:

datenschutzbeauftragter@collectible-invest.com

Security

We have implemented comprehensive technical and organisational measures to protect your personal data against unauthorised access, misuse, loss, and other external interference. We regularly review our security measures and adapt them to the state of the art.

Your Rights

With respect to the personal data concerning you, you have the following rights, which you may assert against us:

Right to access: You may request information pursuant to Art. 15 GDPR about the personal data concerning you that we process.
Right to rectification: If the information concerning you is inaccurate or no longer accurate, you may request rectification pursuant to Art. 16 GDPR. If your data is incomplete, you may request that it be completed.
Right to erasure: You may request the erasure of your personal data pursuant to Art. 17 GDPR.
Right to restriction of processing: You have the right, pursuant to Art. 18 GDPR, to request a restriction of the processing of your personal data.
Right to object to processing: You have the right, on grounds relating to your particular situation, to object at any time, pursuant to Art. 21(1) GDPR, to the processing of your personal data carried out on the basis of Art. 6(1) sentence 1 lit. e) or lit. f) GDPR. In this case, we will no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms.
Right to withdraw consent: To the extent you have given consent to a processing operation, you have the right to withdraw that consent at any time pursuant to Art. 7(3) GDPR.
Right to data portability: You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format, and to have that data transmitted to another controller (Art. 20 GDPR).

You may exercise your rights by contacting us using the details given in the section “Controller” or by contacting our data protection officer.

If you believe that the processing of your personal data infringes data protection law, you have the right, pursuant to Art. 77 GDPR, to lodge a complaint with a supervisory authority, in particular the authority responsible for us: Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationssicherheit), Friedrichstr. 219, 10969 Berlin, Germany.

Legal Bases for Processing

We process your personal data on the basis of Art. 6(1) GDPR. The relevant legal bases are, in particular:

Art. 6(1) sentence 1 lit. a) GDPR – consent of the data subject
Art. 6(1) sentence 1 lit. b) GDPR – performance of a contract or pre-contractual measures
Art. 6(1) sentence 1 lit. c) GDPR – compliance with a legal obligation
Art. 6(1) sentence 1 lit. f) GDPR – protection of the legitimate interests of the controller

We do not disclose your personal data to third parties beyond what is described above, unless you have effectively consented to such disclosure or a statutory authorisation exists.

Use of the Website, Access Data

In principle, you can use our website for purely informational purposes without disclosing your identity. When you access individual pages of the website, certain access data is transmitted to our hosting provider solely to enable the website to be displayed to you. This includes the following data:

Browser type / browser version
Operating system used
Language and version of the browser software
Host name of the accessing device
IP address
Website from which the request originates (referrer URL)
Content of the request (specific page)
Date and time of the server request
Access status / HTTP status code
Volume of data transferred
Time zone difference from Greenwich Mean Time (GMT)

The temporary processing of this data is necessary to technically enable the course of a website visit and the delivery of the website to your device. The access data is not used to identify individual users and is not combined with other data sources. The data is additionally stored in log files to ensure the functionality of the website and the security of the information technology systems. The legal basis for this processing is Art. 6(1) sentence 1 lit. f) GDPR. Our legitimate interests lie in ensuring the functionality of the website as well as the integrity and security of the website. Storing access data in log files, in particular the IP address, for a longer period allows us to detect and defend against misuse. This includes, for example, defending against requests that overload the service or any potential bot usage. The access data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of data collected for the purpose of providing the website, this is the case once your visit to the website ends. As a rule, the log data is kept accessible directly and exclusively to administrators and is deleted after seven days at the latest. After that, it remains available only indirectly through the reconstruction of backup tapes (backups) and is permanently deleted after a maximum of four weeks.

You may object to this processing. Your right to object applies on grounds relating to your particular situation. You may send us your objection using the contact details given in the section “Controller”.

Cookies and Similar Technologies

In addition to the access data mentioned above, so-called cookies, pixels, or other tracking technologies are used when using the website. Cookies are small text files containing a string of numbers that are stored locally in the cache of the browser used. Pixels are one-pixel images that are made transparent or set to the background colour of the website and are therefore not visible to the user. A pixel likewise collects information about your user behaviour on the website. Fingerprinting technologies generate a unique fingerprint based on browser settings and thereby identify an individual browser. By means of a script that every internet browser automatically executes, information such as screen resolution, fonts used, operating system, hardware information, and installed browser plug-ins can be collected, which, in their specific combination, can ultimately allow identification of a particular user. The tracking technologies serve to make our website user-friendly. The use of tracking technologies may be technically necessary or may serve other purposes (e.g., analysis/evaluation of website usage).

Technically Necessary Website Elements

Some elements of our website require that the accessing browser can be identified even after navigating to a different page. Within the technically necessary elements, such as cookies or similar methods of accessing the end device, the following data is processed for the purpose of carrying out or facilitating electronic communication and providing a service of the information society requested by the user:

Language settings,
Font settings,
Login information.

The user data collected through technically necessary elements is not processed to create user profiles. We also use so-called “session cookies”, which store a session ID that allows different requests from your browser to be associated with the same session. “Session cookies” are necessary for the use of the website. In particular, they allow us to recognise the device used when you return to the website. We use this cookie to recognise you on subsequent visits to the website if you have a customer account with us; otherwise, you would have to log in again each time you visit. The legal basis for this processing is Art. 6(1) sentence 1 lit. f) GDPR. Our legitimate interest in this processing lies in providing the aforementioned special functionalities and thereby making the use of the website more attractive and effective. The “session cookies” are deleted as soon as you log out or, depending on the browser you use and the browser settings you have made, when you close the browser.

Technically Non-Essential Website Elements

To the extent that we integrate third-party cookies, pixels, or similar tracking technologies into our website that are not technically necessary, we will separately inform you of this below.

Registration for the Waitlist

On our landing page, you can register for a waitlist for Collectible Invst via the “Register Now” button. The purpose of this waitlist is to inform you about current developments, news, and the launch of Collectible Invest. For this purpose, the following personal data is collected:

Full name (first and last name)
Email address
IP address
Date and time of registration

The registration and the associated data processing take place exclusively on the basis of your express consent (Art. 6(1) sentence 1 lit. a) GDPR). You may withdraw your consent at any time with effect for the future, without affecting the lawfulness of the processing carried out prior to the withdrawal. To withdraw your consent, an informal notice to the contact details given in the section “Controller” is sufficient, or you may click the unsubscribe link in the emails we send.

Your data is stored and processed exclusively for the purpose of sending Collectible Invst news and updates. After your withdrawal or once the purpose of the waitlist has been fulfilled, your data will be deleted, provided no statutory retention obligations preclude this.

Direct Marketing

Informational Emails to Waitlist Registrants

We use the email address you provided during registration exclusively on the basis of your consent (Art. 6(1) sentence 1 lit. a) GDPR) to send you the following content:

News and updates regarding Collectible Invst
Information about the launch of Collectible Invst and access
Relevant information about our offering
Invitations to events hosted by our company

Further information about the marketing service used to send these emails can be found in the section “Braze”.

We would like to point out that you may object at any time to receiving informational emails and to the related data processing for direct marketing purposes, without incurring any costs other than the transmission costs at the basic rates. To do so, click the unsubscribe link in the respective email or send your objection to the contact details given in the section “Controller”.

Suppression List

If you unsubscribe from our informational emails, we process your email address to ensure that you no longer receive any further messages from us. For this purpose, we add your email address to a so-called “suppression list”. The legal basis for this processing is Art. 6(1) sentence 1 lit. c) GDPR, in order to comply with our record-keeping obligations, otherwise Art. 6(1) sentence 1 lit. f) GDPR.

Email Marketing Service Braze

We use the services of the provider Braze, Inc. (330 W 34th St., 18th Floor, New York, NY, USA; hereinafter: “Braze”) to send informational emails to individuals who have registered on our waitlist. Braze processes user data such as email address, interaction data, and IP address in order to manage the sending of messages and to analyse user interactions.

The emails sent by Braze may contain so-called “web beacons” or “tracking pixels” – pixel-sized files that are retrieved from Braze’s server when the email is opened. In doing so, information about your browser and system, your IP address, and the time of retrieval are collected. This information is used for the technical improvement of the services as well as for statistical analysis (e.g., open rates, click counts, reading duration).

The legal basis for the processing is your consent pursuant to Art. 6(1) sentence 1 lit. a) GDPR; with regard to the storage of, and access to, information on your device, Section 25(1) TTDSG applies. We delete your data once you end your registration on the waitlist. You may withdraw your consent at any time – via the unsubscribe link in the respective email or by notifying us (see section “Controller”).

In carrying out the functions described above, Braze also transfers personal data to servers in the USA. Braze is certified under the EU-U.S. Data Privacy Framework, which constitutes an adequacy decision of the EU Commission for certified companies.

Further information on Braze’s privacy policy can be found at: https://www.braze.com/company/legal/privacy

Support Communication: Intercom

We use Intercom, a service provided by Intercom, Inc. (55 2nd Street, 4th Floor, San Francisco, CA 94105, USA; hereinafter: “Intercom”), to process our users’ support requests in a structured and efficient manner. If you contact us via our support widget or by email, your requests and the personal data arising in connection with the communication (in particular email address, name, and message content) are processed via Intercom.

The legal basis for the processing is Art. 6(1) sentence 1 lit. f) GDPR. Our legitimate interests lie in optimising and improving our customer service and ensuring customer satisfaction. Intercom may also process data in the USA. We have entered into standard contractual clauses with Intercom to bind Intercom to an adequate level of data protection. We will provide you with a copy upon request.

We delete the data arising in this context once processing is no longer necessary, or we restrict processing to compliance with existing mandatory statutory retention obligations.

Further information on data protection at Intercom can be found at: https://www.intercom.com/legal/privacy

Hosting

We use external hosting services provided by Amazon Web Services (Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109, United States; hereinafter: “AWS”) to make our landing page available to you. In doing so, all data required for the operation and use of our website is processed (in particular access data as described in the section “Use of the Website, Access Data”). Amazon also processes data in the USA. We have entered into standard contractual clauses with Amazon to bind Amazon to an adequate level of data protection. We will provide you with a copy upon request.

The legal basis for the processing is Art. 6(1) sentence 1 lit. f) GDPR. Our legitimate interest in using external hosting services lies in the efficient and secure provision of our website.

Further information on data protection at AWS can be found at: https://aws.amazon.com/de/privacy/

Cloudfront

In addition, we use on our website the services of the content delivery network (hereinafter “CDN”) provided by Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, United States; hereinafter “Cloudflare”) for the purpose of faster availability of our online offering. When you visit the website, a library is cached by the CDN on your device to avoid having to reload the content again. In doing so, your IP address is transmitted to the provider in the USA. Cloudflare processes some of its data in the USA. No adequacy decision of the EU Commission exists for a data transfer to the USA. We have entered into standard contractual clauses with Cloudflare to bind Cloudflare to compliance with an adequate level of data protection. We will provide you with a copy upon request. The legal basis for the processing is Art. 6(1) sentence 1 lit. f) GDPR. By using Cloudflare, we pursue the legitimate interest of faster availability as well as a more effective and improved presentation of our online offering.

Further information on data protection and the retention period at Cloudflare can be found at: https://www.cloudflare.com/de-de/privacypolicy/

Website Analytics with Google Analytics

We use the web analytics service Google Analytics on our website (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; hereinafter: “Google”). Google Analytics uses cookies and similar technologies to analyse the use of our website and to generate reports on website activity. The information collected in this process is generally transmitted to and stored on a Google server in the USA.

In connection with Google Analytics, the following data is processed in particular:

• IP address (in abbreviated, anonymised form)

• Pages visited and time spent

• Origin of the access (referrer URL)

• Browser type and operating system

• Date and time of access

• Approximate location (based on IP address)

We use Google Analytics with the IP anonymisation function (“AnonymizeIP”) activated. As a result, your IP address is shortened by Google within the Member States of the European Union or in other contracting states of the Agreement on the European Economic Area before being transmitted to the USA. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there.

The legal basis for the processing is your consent pursuant to Art. 6(1) sentence 1 lit. a) GDPR, as well as Section 25(1) TTDSG with regard to the storage of cookies and access to information on your device. You may withdraw your consent at any time with effect for the future by adjusting the cookie settings on our website or by contacting us using the contact details given in the section “Controller”.

Google processes your data in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, which constitutes an adequacy decision of the EU Commission and legitimises the data transfer.

The data collected through Google Analytics is automatically deleted after 14 months. Further information on the terms of use and data protection for Google Analytics can be found at:

https://policies.google.com/privacy

https://support.google.com/analytics/answer/6004245

Contact

If you contact our company, for example by email, the personal data you provide is processed by us to respond to your inquiry. The legal basis for the processing is Art. 6(1) sentence 1 lit. f) GDPR. The data is used exclusively for processing in the context of the conversation. We delete the data arising in this context once processing is no longer necessary, or we restrict processing to compliance with existing statutory retention obligations.

Legal Defence

We process the aforementioned data for the establishment, exercise, or defence of legal claims. The legal basis for the processing is Art. 6(1) lit. c) GDPR and Art. 6(1) lit. f) GDPR. In these cases, our legitimate interest lies in asserting or defending claims.