Privacy Policy
Last updated 12 October 2026
This policy explains how Level2 Ventures handles personal data: the materials founders send us, information about founders and their teams that we receive from others, and data about visits to this website.
Who we are
Level2 Ventures B.V. is the controller of your personal data. It is registered with the Dutch Chamber of Commerce (KvK) under number 83764356. Registered office: De Boelelaan 7, 1083 HJ Amsterdam, Netherlands. Operating office: ul. Pilotów 2E, 31-462 Kraków, Poland. For any privacy question or request, write to hello@level2.vc. We have not appointed a data protection officer, as the GDPR does not require one for our activities.
At a glance
| What | Personal data | Lawful basis | Kept for |
|---|---|---|---|
| Pitches and correspondence | Name, contact details, company, pitch materials, correspondence | Legitimate interest (Art. 6(1)(f) GDPR); steps at your request before an agreement (Art. 6(1)(b)) | 3 years after our last contact if we do not invest; if we invest, while we hold the investment and then as long as the law requires |
| Information we receive from others | Name, role, professional background, business contact details | Legitimate interest (Art. 6(1)(f)) | As for pitches |
| Server logs | IP address, time, page, browser user-agent, referring page | Legitimate interest (Art. 6(1)(f)) | 14 days at our hosting provider |
| Website analytics, only if you accept | See “Website analytics” below | Your consent (Art. 6(1)(a)) | 26 months; deleted within 48 hours if you withdraw |
| Record of your consent | Date, version of this notice, page, Global Privacy Control signal | Our obligation to be able to show consent (Art. 6(1)(c) with Art. 7(1)) | 26 months |
Pitches and correspondence
We receive personal data mainly when you send us a pitch or write to us:
- contact details such as your name, email address and company;
- the contents of pitch decks and related materials, which may include business plans, financial figures and information about your team;
- the correspondence you exchange with us.
We use this to assess potential investments, to respond to you and to keep a record of the opportunities we review. Our lawful bases are our legitimate interest in finding, evaluating and managing investments (Article 6(1)(f) GDPR) and, where relevant, taking steps at your request before entering into an agreement (Article 6(1)(b)). Sending us data is voluntary; without contact details we cannot reply.
Information we receive from others
When we evaluate a company we also handle information about people who did not send it to us themselves: co-founders and team members named in a pitch deck, people introduced to us by co-investors, portfolio founders or advisors, and business information from public sources such as company websites, business registers, professional networks such as LinkedIn and commercial company databases. We limit this to name, role, professional background and business contact details, and use it for the same purpose and on the same lawful basis as pitches.
Website analytics
We measure how this website is used so we can improve it. There are two parts. Declining the analytics notice switches off the second part completely.
Server logs and page counts
Like any web server, ours records each request: the address of the page, the time, your IP address, your browser’s user-agent string and the referring page. Our hosting provider, home.pl, keeps these raw logs for 14 days. We use them to deliver the website, to detect errors and abuse, and to count page views. The counts hold nothing about you: only how many requests each page received per day, with what result, and whether they came from a known search-engine or other bot (recognised by its user-agent string). They contain no IP address, no identifier, no location, no referring page and no time of day. Nothing is stored on or read from your device for this. Our lawful basis is our legitimate interest in delivering the website securely and knowing which pages are used (Article 6(1)(f) GDPR); you can object to it (see “Your right to object”).
Detailed analytics, only if you accept
If you click “Accept” in the analytics notice, a script on our pages sends the following to our own analytics service, and nothing else:
- the page you view, the page that referred you (without its query string), any campaign tags in the link (
utm_source,utm_medium,utm_campaign) and whether you arrived by following a link, reloading or using the Back button; - how long the page was visible on your screen, which parts of it (sections, portfolio and team cards) were on screen and for how long, how far you scrolled and how long it took to get there;
- where on the page you click and on what (for example a button label, an image description or a section heading), including clicks on things that are not links and repeated rapid clicks, and the time since the page opened for each of these events;
- which email addresses, external links and buttons you click, which portfolio and team cards you open or rest the pointer on, and how much of the video on the home page you watch;
- when you copy text from our pages: our email address if the copied text contains it, otherwise the first 100 characters of the copied text; and when you open the right-click menu on one of our email addresses;
- page-speed measurements (loading time, responsiveness and layout stability);
- technical errors in our page scripts (the error message and the script line);
- your device type (mobile, tablet or desktop), your browser and operating system without version numbers, and your browser language (for example “pl” or “en”);
- your country, which our service looks up from your IP address using IP Geolocation by DB-IP. The IP address itself is not stored, neither in our analytics nor in our service’s logs.
It does not collect your name, email address or anything you type. Our lawful basis is your consent (Article 6(1)(a) GDPR). If you decline, none of this happens and nothing is sent from your browser. If your browser sends a Global Privacy Control signal, the notice says so and nothing is measured unless you click “Accept”.
What is stored in your browser
This website sets no cookies. It uses the browser storage entries below, which work like cookies and to which the same rules apply. The analytics notice lists them too, under “Details”. Only this website can read them; no third party has access to them.
| Name | Where | Purpose | Kept for |
|---|---|---|---|
l2v_consent | local storage | Necessary. Your choice (accept or decline), when you made it and the version of the notice, so we do not ask on every page. Stored whichever you choose; never sent to us. | 12 months, then we ask again |
l2v_vid | local storage | Analytics. A random identifier, so visits from the same browser can be counted as one visitor. Only after you accept. | 13 months, or until you withdraw |
l2v_sid | session storage | Analytics. A random identifier for one visit. Only after you accept. | until you close the tab |
Your choice
Your consent can be withdrawn at any time, as easily as it was given: use “Analytics settings” at the bottom of every page, or here: . Withdrawing stops the measurement immediately, deletes the identifiers from your browser, and within 48 hours deletes the analytics data collected under them. It does not make the measurement before your withdrawal unlawful. When you accept, we keep a record of that decision (the date, the version of this notice, the page and whether your browser sent a Global Privacy Control signal), with no identifier, so that we can show consent was given. If we change what we collect, we will ask you again.
Where analytics data is kept
Analytics data and page counts are stored in Google Cloud (BigQuery, Cloud Run) in the European Union, with Google acting as our processor. They are not used for advertising, not shared with third parties and not combined with other data. Analytics data is deleted automatically after 26 months; backup copies are removed within a further 14 days.
Who receives your data
Pitch materials are treated as confidential. We do not sell personal data and we do not share it for advertising. Personal data is received by:
- service providers that process it on our behalf under data processing agreements: home.pl S.A. (Poland), which hosts this website and its server logs; Microsoft (Microsoft 365), which hosts our email and documents; and Google Cloud, which stores and processes our website analytics in the EU;
- our professional advisors, such as lawyers, accountants and auditors, under confidentiality;
- potential co-investors, where it helps an evaluation, under confidentiality;
- public authorities, where the law requires it.
Where your data is processed
We store personal data in the European Union. Microsoft and Google belong to groups based in the United States, and in limited cases, such as technical support and security, their staff or sub-processors outside the EU can access data. These transfers rely on the EU–US Data Privacy Framework, under which Microsoft and Google LLC are certified (European Commission adequacy decision of 10 July 2023, Article 45 GDPR), with the European Commission’s standard contractual clauses as a fallback (Article 46(2)(c) GDPR). If a potential co-investor is outside the European Economic Area, we share pitch materials with them only under standard contractual clauses or with your agreement. You can ask us for a copy of these safeguards at hello@level2.vc.
How long we keep it
- Pitches, correspondence and information about founders and teams: 3 years after our last contact if we do not invest; if we invest, for as long as we hold the investment and afterwards as long as the law requires us to keep records.
- Raw server logs: 14 days at our hosting provider.
- Website analytics and the record of your consent: 26 months, then deleted automatically (backups within a further 14 days); analytics data within 48 hours if you withdraw your consent.
- Browser storage: as listed in the table above.
Your rights
Under the GDPR you can ask us for access to your personal data, and to correct, delete or restrict it, or to transfer data you gave us on the basis of consent or a contract. Where we rely on your consent, you can withdraw it at any time without affecting the lawfulness of processing before the withdrawal. Website analytics data contains no name or IP address and we usually cannot tell which records are yours (Article 11 GDPR); withdrawing your choice in “Analytics settings” deletes them for you. Email hello@level2.vc and we will respond within one month.
Your right to object
Where we process your data on the basis of our legitimate interests — pitches and correspondence, information we receive from others, and server logs — you have the right to object at any time, on grounds relating to your particular situation. We will then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims. To object, write to hello@level2.vc.
Automated decisions
We do not make decisions about you based solely on automated processing, including profiling.
Complaints
You have the right to complain to a supervisory authority, in particular the Dutch Autoriteit Persoonsgegevens, the Polish President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), or the authority where you live or work.
Changes
We may update this policy. The date at the top shows when it last changed. If we change what the website analytics collect, we will ask for your consent again.