Legal
Privacy Policy
Last update: 9 November 2026 (v1.0)
This Privacy Policy ("Privacy Policy") applies to all processing activities carried out by Brain Advisory BV, a private limited liability company (besloten vennootschap / société à responsabilité limitée) under Belgian law, with registered office at Domaine Fuji 25, 1970 Wezembeek-Oppem (Belgium), registered with the Crossroads Bank for Enterprises under number 1039.425.967 ("Brain Advisory", "we", "us" or "our"), as data controller, in connection with Deep Brain Capital.
Please read this Privacy Policy together with the other documents governing your relationship with us (e.g. our Cookie Policy, any non-disclosure or data processing agreement). We may update this Privacy Policy from time to time; the latest version is always available on our Website.
1. About this Privacy Policy
Because of your relationship or contact with us — as a founder or representative of a (potential) portfolio company, a (potential) investor, a research partner, a scientific or industry advisor, a candidate, a business partner or another stakeholder — or because you visit or use our website deepbraincapital.com / europeanbraintech.fund (the "Website"), we may collect, store and otherwise process personal data relating to you or, if you act for a company, to its employees and representatives ("personal data").
This Privacy Policy explains (i) how we collect, use and store your personal data; (ii) the rights you can exercise; and (iii) the measures we take to protect it.
We process personal data in accordance with applicable privacy legislation, including (i) the General Data Protection Regulation (EU) 2016/679 ("GDPR"); (ii) the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data; (iii) the ePrivacy Directive 2002/58/EC and its Belgian implementation; and (iv) any other applicable national legislation (together, "Privacy Legislation").
2. Who is the data controller?
Brain Advisory is a Belgian advisory company that prepares the launch of, and will advise, Deep Brain Capital, a venture capital fund in formation that will invest in companies translating neuroscience into therapies, devices, digital health solutions and platforms for brain diseases.
For the processing activities described in this Privacy Policy, Brain Advisory acts as data controller: it determines the purposes and means of the processing and is responsible for it.
Once the Deep Brain Capital fund, its general partner and its alternative investment fund manager are established, some processing activities (in particular investor onboarding, know-your-customer checks and the management of portfolio investments) may be carried out by or jointly with those entities. We will inform the persons concerned of this, and update this Privacy Policy, at that time.
3. Our processing activities
Which personal data we process, and why, depends on your relationship with us. We distinguish the following situations:
- You visit our Website;
- You attend an event we host;
- You apply for a position or contribute to our work as an intern or contributor;
- You are a founder or representative of a potential investee company;
- You are a representative of a portfolio company;
- You are (a representative of) a potential investor;
- You are (a representative of) an investor;
- You are a research partner, scientific advisor or expert;
- You are, or your company is, a supplier or other business partner.
3.1 You visit our Website
| Activity | Personal data | Legal ground | Retention period |
|---|---|---|---|
| Answering your questions submitted via the contact form or by email, and starting a conversation (including reviewing a pitch deck you send us) | First and last name, email address, company, job title, nature of enquiry, information you choose to provide | Legitimate interest in responding to enquiries; steps taken at your request prior to entering into a contract | One (1) year after our last interaction, unless a relationship described below follows |
| Sending our newsletter and updates on our activities | First and last name, email address, company, job title, preferred language | Consent, if you have no active relationship with us; legitimate interest (direct marketing to existing contacts), if you do | Until you unsubscribe or object (section 9) |
| Cookies and similar technologies | See our Cookie Policy | See our Cookie Policy | See our Cookie Policy |
3.2 You attend an event we host
| Activity | Personal data | Legal ground | Retention period |
|---|---|---|---|
| Organising events and keeping a list of registrants and attendees | First and last name, email address, phone number, company, job title, dietary requirements | Legitimate interest in organising our events | Two (2) years after the event |
| Taking and publishing photos and videos | Images and recordings | Consent | Until you withdraw your consent; at most seven (7) years after the event |
| Following up with attendees | First and last name, email address, phone number, country, preferred language, company, job title, LinkedIn profile, information you provide | Legitimate interest in developing our professional network | Until you ask us to stop contacting you, and at most three (3) years after our last interaction |
3.3 You apply for a position, or contribute as an intern or contributor
| Activity | Personal data | Legal ground | Retention period |
|---|---|---|---|
| Assessing your application | First and last name, email address, phone number, CV, cover letter, case assessment, professional experience, references you provide | Steps taken at your request prior to entering into a contract; legitimate interest in recruiting suitable candidates | Six (6) months after you are informed that your application was not retained |
| Keeping your application in our talent pool for future positions | Same as above | Consent | One (1) year after your consent, or until you withdraw it |
| Managing internships, contribution agreements and non-disclosure agreements | Identification and contact data, agreement terms, work deliverables | Performance of a contract; legal obligation | Duration of the agreement plus the applicable limitation period (in principle ten (10) years) |
3.4 You are a founder or representative of a potential investee company
| Activity | Personal data | Legal ground | Retention period |
|---|---|---|---|
| Sourcing and identifying promising companies in brain-related therapeutics, neurotechnology, digital health and enabling platforms | First and last name, email address, phone number, company, job title, professional background and founding history, LinkedIn profile, publicly available information | Legitimate interest in identifying investment opportunities | Until you object; at most five (5) years after our last interaction |
| Communicating with you and evaluating the opportunity (screening, investment committee review, due diligence, expert consultation) | Same as above, plus information included in pitch decks, data rooms and management presentations, and the results of reference checks | Legitimate interest in assessing investment opportunities; steps taken at your request prior to entering into a contract | As provided in the non-disclosure agreement concluded with you; failing that, five (5) years after our last interaction |
3.5 You are a representative of a portfolio company
| Activity | Personal data | Legal ground | Retention period |
|---|---|---|---|
| Communicating with you, following up on the investment and providing support | First and last name, company, job title, email address, phone number, address, preferred language, LinkedIn profile, information you provide | Performance of the investment and shareholder agreements; legitimate interest in monitoring and supporting the investment | Duration of the investment and three (3) years after the liquidation of the relevant fund, unless a longer period is required by law |
| Complying with legal obligations, including anti-money laundering (AML) and know-your-customer (KYC) checks | Identification data, address, date of birth, nationality, copy of identity document, function, company documents, ultimate beneficial owner (UBO) information, politically exposed person and sanctions screening results | Legal obligation | Ten (10) years after the end of the business relationship, as required by the Belgian Act of 18 September 2017 on the prevention of money laundering |
3.6 You are (a representative of) a potential investor
| Activity | Personal data | Legal ground | Retention period |
|---|---|---|---|
| Identifying potential investors | First and last name, company, job title, email address, phone number, address, preferred language, LinkedIn profile, publicly available information | Legitimate interest in raising capital for the fund | Until you object; at most five (5) years after our last interaction |
| Communicating with you about Deep Brain Capital and sharing information materials | Same as above, plus information you provide on your investment interests | Legitimate interest; steps taken at your request prior to entering into a contract | Until you object; at most five (5) years after our last interaction |
Any information on the fund is shared in accordance with applicable financial regulation and does not constitute an offer of securities.
3.7 You are (a representative of) an investor
| Activity | Personal data | Legal ground | Retention period |
|---|---|---|---|
| Managing your investment and communicating with you (capital calls, distributions, reporting, investor meetings) | First and last name, company, job title, email address, phone number, address, preferred language, bank account details, commitment and investment data | Performance of the subscription and fund agreements; legal obligation | Duration of your investment and ten (10) years after the liquidation of the relevant fund |
| Complying with legal obligations, including AML/KYC checks, tax reporting (FATCA/CRS) and UBO registration | Identification data, address, date of birth, nationality, copy of identity document, tax residence and identification number, source of funds and wealth, corporate documents, data on directors, UBOs and representatives, politically exposed person and sanctions screening results | Legal obligation | Ten (10) years after the end of the business relationship |
3.8 You are a research partner, scientific advisor or expert
| Activity | Personal data | Legal ground | Retention period |
|---|---|---|---|
| Managing our partnerships with research institutes and our network of clinicians, scientists, operators and industry advisors | First and last name, institution, function, field of expertise, email address, phone number, LinkedIn profile, publications | Legitimate interest in maintaining our scientific network; performance of a contract, where applicable | Duration of the relationship and three (3) years thereafter |
| Consulting you on investment opportunities, and naming you as advisor in our materials | Same as above, plus opinions you share and, where agreed, your name, photo and biography | Performance of a contract; consent for publication of your name and photo | Duration of the relationship and three (3) years thereafter; publication until you withdraw your consent |
3.9 You are, or your company is, a supplier or other business partner
| Activity | Personal data | Legal ground | Retention period |
|---|---|---|---|
| Communicating with you and managing our contractual relationship | First and last name, company, job title, email address, phone number, preferred language, information you provide | Performance of a contract; legitimate interest | Duration of the relationship and ten (10) years thereafter (limitation period) |
| Billing and accounting | First and last name, company, address, VAT number, bank account details, invoices | Legal obligation | Ten (10) years from the end of the financial year concerned, as required by Belgian accounting law |
4. Legal grounds and retention
The legal ground and retention period for each processing activity are set out in section 3. Where we rely on legitimate interest, we first check that the processing is necessary and proportionate, take your reasonable expectations into account and ensure that our interests are not overridden by your rights and freedoms. If that balance is not met, we stop the processing or rely on another legal ground. Where we rely on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.
At the end of the applicable retention period, personal data is deleted or anonymised.
5. Health data and other special categories of data
Given our focus on brain diseases, companies may share clinical or scientific information with us. We do not seek to receive health data relating to identifiable individuals (such as patients or trial participants). We ask companies to share only anonymised or aggregated data. If we nevertheless receive such data, we will not use it, will restrict access to it and will delete it or return it to the sender.
We do not otherwise collect special categories of personal data (Article 9 GDPR) unless you provide them voluntarily and we have a valid legal ground to process them.
6. Use of software and AI-based tools
We use software tools, including AI-based tools, to organise our work and to help research and analyse companies, technologies and markets. These tools may process business contact data and information contained in documents shared with us, such as pitch decks. We select providers that offer appropriate contractual guarantees, and we configure these tools so that your data is not used to train the providers' general models.
Investment decisions and other decisions concerning you are always taken by people — in particular our partners and investment committee. We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
7. Disclosure of personal data to third parties
We only disclose your personal data to third parties where necessary for the purposes described in this Privacy Policy. Your personal data may be disclosed to:
- software and cloud service providers (e.g. email, document storage, CRM and collaboration tools, AI-based tools);
- the partners of Brain Advisory and their management companies, freelancers and other service providers;
- once established, the Deep Brain Capital fund, its general partner, its alternative investment fund manager and their service providers (administrator, depositary, auditors);
- professional advisors (lawyers, accountants, auditors) and, for due diligence or expert consultations, scientific and industry advisors bound by confidentiality;
- co-investors, where you are involved in an investment process and as agreed with you.
Where these third parties process personal data on our behalf, we have concluded data processing agreements with them in accordance with Article 28 GDPR.
We may also disclose your personal data to competent authorities (e.g. the FSMA, tax or judicial authorities) where we are legally required to do so, or where this is necessary to establish, exercise or defend our rights.
8. International transfers of personal data
Where a recipient is located outside the European Economic Area, we ensure that the transfer is covered by an appropriate safeguard:
- an adequacy decision of the European Commission (including the EU–U.S. Data Privacy Framework for certified U.S. recipients);
- standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914), together with a transfer impact assessment where required; or
- another safeguard provided for by the GDPR.
9. Your rights
Under the Privacy Legislation you have the following rights, which you can exercise by contacting us as set out in section 12 (you may use the form in Annex I, but this is not required):
- Access: to obtain confirmation of whether we process your personal data and a copy of it;
- Rectification: to have inaccurate or incomplete personal data corrected or completed;
- Erasure: to have your personal data erased, under the conditions set out in the GDPR;
- Restriction: to have the processing of your personal data restricted, under the conditions set out in the GDPR;
- Objection: to object to processing based on our legitimate interest, on grounds relating to your particular situation — and to object at any time, without giving reasons, to direct marketing;
- Portability: to receive personal data you provided to us in a structured, commonly used and machine-readable format, or to have it transmitted to another controller, where processing is based on consent or contract and carried out by automated means;
- Withdrawal of consent: to withdraw your consent at any time, where processing is based on consent.
You can unsubscribe from our newsletter and updates at any time via the link in each email or by contacting us.
We respond to requests within one month of receipt. This period may be extended by two further months where necessary, in which case we will inform you. We may ask you to verify your identity before acting on a request.
10. Security
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse or alteration, including access restrictions, multi-factor authentication on our main systems and confidentiality undertakings from our team, interns and advisors.
No method of transmission over the internet or of electronic storage is completely secure, so we cannot guarantee absolute security. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Belgian Data Protection Authority and, where required, you.
11. Updates
We may update this Privacy Policy by posting a new version on the Website, with the revision date shown at the top. Where changes are significant, we will inform you by appropriate means.
12. Contact
Requests to exercise your rights, and any questions or concerns about this Privacy Policy, can be sent to info@deepbraincapital.com or by post to Brain Advisory BV, Domaine Fuji 25, 1970 Wezembeek-Oppem, Belgium.
13. Complaints
If you have a concern about how we process your personal data, please contact us first and we will do our best to resolve it.
You also have the right to lodge a complaint with a supervisory authority, in particular the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be, www.dataprotectionauthority.be, or the authority of your place of residence or work.
14. Related documents
- Cookie Policy: deepbraincapital.com/cookie-policy
- Data Subject Rights Form: Annex I
Annex I — Data Subject Rights Form
Please send this form to info@deepbraincapital.com or by post to Brain Advisory BV, Domaine Fuji 25, 1970 Wezembeek-Oppem, Belgium.
1. Your details
- First and last name:
- Email address:
- Phone number (optional):
- Company and job title (if relevant):
- Your relationship with us (e.g. founder, investor, advisor, candidate, Website visitor):
2. The right(s) you wish to exercise (tick as applicable)
- Access
- Rectification
- Erasure
- Restriction of processing
- Objection
- Data portability
- Withdrawal of consent
- Unsubscribe from newsletters and updates
3. Details of your request
Please describe your request as precisely as possible (which data, which processing activity, any corrections to be made):
4. Date and signature
Date:
Signature: