Privacy Policy

Last updated: August 6, 2026

This Privacy Policy describes how Boosta Start Up Factory OÜ ("Company", "we", "us", "our") collects, uses, and shares information about you when you use our website https://rebels.fund/ (the "Site") and related services (the "Services"). Please read this policy carefully. By using the Services, you agree to the practices described below.

The data controller responsible for your personal data is Boosta Start Up Factory OÜ, registration number 16638584, with registered address at Narva mnt 7-636, Kesklinna linnaosa, Tallinn, Harju maakond, 10117, Estonia.

1. WHAT INFORMATION WE COLLECT

Information you provide to us. We collect personal information that you voluntarily provide when you submit an application through the Site (for example, "Apply for investment" or "Apply to co-found"), contact us, or otherwise interact with the Services. This may include:

full name;
email address;
phone number and/or messenger contact (Telegram, WhatsApp);
company name;
any information you choose to include in your message or application, including pitch decks and other files you upload;
testimonials and success stories (published only with the prior consent of both parties).

Information collected automatically. When you visit the Site, we automatically collect certain technical information, including your IP address, browser type, operating system, referring URLs, pages visited, and timestamps. This data is used to maintain security, analyse performance, and improve the Services.

Cookies and tracking technologies. We use cookies and similar technologies as described in Section 5 below.

2. HOW WE USE YOUR INFORMATION

We use the information we collect for the following purposes:

to provide, operate, and improve the Services;
to review and evaluate applications for investment or co-founding opportunities;
to communicate with you about your application, including providing feedback (normally within 5 business days of receiving your application);
to publish testimonials, case studies, or success stories - only with the prior consent of both parties;
to monitor and ensure the security of the Services and prevent fraud;
to comply with legal obligations;

3. LEGAL BASES FOR PROCESSING (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data on the following legal bases:

Performance of a contract (Art. 6(1)(b) GDPR) - processing necessary to provide the Services you have requested.
Legitimate interests (Art. 6(1)(f) GDPR) - processing necessary for our legitimate business interests, such as fraud prevention and improving our Services, provided these interests are not overridden by your rights.
Consent (Art. 6(1)(a) GDPR) - where you have given explicit consent, for example to the publication of a testimonial or to the placement of non-essential cookies. You may withdraw consent at any time by contacting us at pitch@rebels.fund.
Legal obligation (Art. 6(1)(c) GDPR) - where processing is required to comply with applicable law.

4. SHARING YOUR INFORMATION

We do not sell your personal information to third parties. We may share your data in the following circumstances:

Service providers. We share data with trusted third-party vendors who perform services on our behalf (e.g. website hosting and security (Webflow, Cloudflare), email delivery, internal communication and lead-management tools (Slack, Notion), and analytics). These parties are contractually bound to process data only as instructed by us. Within the Company, applications are accessible to the members of our investment team and investment analysts who review them.
Business transfers. If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.
Legal requirements. We may disclose your information where required by law, court order, or to protect the rights and safety of us or others.

5. COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar tracking technologies to operate and improve the Services.

In summary, we use the following types of cookies:

Essential cookies and similar technologies. Required for the Site to function and to protect it from spam and abuse (including a security entry placed in your browser’s local storage by Cloudflare, which is built into our hosting platform). They cannot be disabled.
Analytics cookies. Help us understand how visitors interact with the Site. We use this data in aggregate form.

You can control or disable cookies through your browser settings. Disabling certain cookies may affect the functionality of the Services.

6. DATA RETENTION

We retain your personal data for as long as necessary to fulfil the purposes set out in this Privacy Policy, unless a longer retention period is required by law.

We retain personal data as follows:

Application data (both successful and unsuccessful applications): 3 years from submission
Correspondence and support communications: 3 years
Technical logs and fraud detection data: 3 months unless subject to investigation

When your personal data is no longer required, we will securely delete or anonymise it. Where deletion is not immediately possible (e.g. data held in backup systems), we will isolate the data from further processing until deletion becomes possible.

7. DATA SECURITY

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption in transit (TLS), access controls, and regular security reviews.

No method of transmission over the internet or electronic storage is 100% secure. While we use commercially reasonable means to protect your data, we cannot guarantee absolute security.

8. CHILDREN'S PRIVACY

The Services are not directed to individuals under the age of 18, and applications may not be submitted by persons under 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child, we will take prompt steps to delete that data. If you believe we may have collected data from a child, please contact us at pitch@rebels.fund.

9. YOUR PRIVACY RIGHTS

Depending on your location, you may have the following rights regarding your personal data:

Right of access. The right to obtain a copy of the personal data we hold about you.
Right to rectification. The right to have inaccurate or incomplete data corrected.
Right to erasure. The right to request deletion of your personal data in certain circumstances.
Right to restriction of processing. The right to ask us to pause processing of your data in certain circumstances.
Right to data portability. The right to receive your personal data in a structured, machine-readable format.
Right to object. The right to object to processing based on legitimate interests or for direct marketing purposes.
Right to withdraw consent. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, please contact us at pitch@rebels.fund. We will respond within 30 calendar days. You also have the right to lodge a complaint with your local data protection authority.

10. CALIFORNIA RESIDENTS' PRIVACY RIGHTS (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides you with specific rights regarding your personal information.

You have the following rights under California law:

Right to know. You may request disclosure of the categories and specific pieces of personal information we have collected about you, the purposes for which we use it, and the categories of third parties with whom we share it.
Right to delete. You may request deletion of personal information we have collected from you, subject to certain exceptions.
Right to correct. You may request correction of inaccurate personal information we maintain about you.
Right to opt out of sale or sharing. We do not sell personal information as defined under California law, nor do we share it for cross-context behavioural advertising.
Right to limit use of sensitive personal information. We do not use or disclose sensitive personal information beyond purposes permitted by the CPRA.
Right to non-discrimination. We will not discriminate against you for exercising any of your CCPA rights.

To submit a request, contact us at pitch@rebels.fund. We will respond within 45 days of receiving a verifiable consumer request. Requests may be submitted on behalf of a California consumer by an authorised agent with written authorisation.

11. INTERNATIONAL DATA TRANSFERS

We are based in Estonia, and the Services are hosted on the infrastructure of our service providers (including Webflow and Cloudflare), which may be located in the United States and other countries. If you access the Services from another jurisdiction, your data may be transferred to and processed in a country with different data protection standards than your own.

We transfer personal data outside the European Economic Area (EEA) to service providers in countries that may not provide equivalent data protection as determined by the European Commission. We ensure appropriate safeguards through:

Standard Contractual Clauses (SCCs) approved by the European Commission
Adequacy decisions for countries with appropriate protection levels
Explicit consent where required. Third parties that may receive your data outside the EEA include cloud service providers, communication and lead-management tools, and analytics platforms.

You may request information about specific safeguards by contacting pitch@rebels.fund.

12. UPDATES TO THIS POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The updated version will be indicated by the "Last updated" date at the top of this page. Where changes are material, we will notify you by email or by a prominent notice on the Site prior to the changes becoming effective. We encourage you to review this policy periodically.

13. CONTACT US

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Company: Boosta Start Up Factory OÜ

Address: Narva mnt 7-636, Kesklinna linnaosa, Tallinn, Harju maakond, 10117, Estonia

Email: pitch@rebels.fund