Legal

Privacy Policy

Version 1.0 · Effective 21 April 2026 · Version française

Document pending finalisation. This policy is provided for information while the definitive drafting is aligned with the GDPR (EU), the Data Protection Act (Mauritius) and Law No. 2014-038 on personal data protection (Madagascar). The French version prevails in case of discrepancy.

1. Data controller

Gelios Investment & Partners Ltd, publisher of the KAPEX platform, acts as controller of the data collected.

Data protection contact: capital@ceo-summit.mg

2. Data collected

Account data: full name, email address, phone, country, organisation, job title;
Project-owner data: company information, funding sought, financial statements, supporting documents;
Investor data: priority sectors, tickets, mandates, geographic zones, verification documents;
Usage data: files viewed, files saved, interests expressed, status history;
Technical data: session cookies, display preferences.

3. Purposes

Managing your account and providing the Platform's services;
Qualifying files and organising introductions;
Sending notifications about your files and opportunities;
Improving the Platform and producing aggregated, non-identifying statistics;
Meeting our legal obligations (anti-money-laundering, tax compliance).

4. Legal basis

Processing rests on performance of the contract (these Terms) for core features, on your explicit consent for marketing communications and non-essential cookies, and on our legal obligations for retention of due diligence records.

5. Recipients

The Capital & Finance Cluster team of the CEO Summit (qualification team);
Network investors whose mandate matches your file — and only after your explicit consent;
Our technical processors (Supabase for storage, Resend for email, Vercel for hosting), all bound by confidentiality agreements;
Competent authorities where required by law.

6. Transfers outside the EU

Your data may be stored on servers located in the European Union (Supabase region eu-west-3, Paris). Any transfers to third countries rely on the European Commission's standard contractual clauses.

7. Retention

Active account data: for as long as the account exists;
Submitted files: 5 years after last activity, under retention obligations;
Activity logs: 18 months, then anonymous archiving;
Deleted accounts: anonymised within 30 days, identifying data fully removed.

8. Your rights

Access to your data;
Rectification of inaccurate data;
Erasure (subject to legal retention obligations);
Portability of your data;
Objection to processing for marketing purposes;
Withdrawal of consent at any time.

To exercise these rights, contact capital@ceo-summit.mg. Response within 30 days.

9. Cookies

We use only essential cookies (authentication, session, display preferences). No advertising or third-party tracking cookie is set without your explicit consent.

10. Security

All data is encrypted in transit (HTTPS/TLS) and at rest. Access is restricted by row-level security rules. Passwords are stored as salted hashes via Supabase Auth.

11. Changes

This policy may change. You will be notified by email and through the Platform of any substantial change.

12. Complaints

Mauritius: Data Protection Office — dataprotection.govmu.org
France/EU: CNIL — cnil.fr
Madagascar: Commission Malagasy de l'Informatique et des Libertés (CMIL).