Privacy policy
Effective 25 September 2026
1. Who we are
Darkstar is the data controller for the personal data described in this policy.
Write to privacy@darkstar.ee.
2. What this policy covers
This policy applies to personal data we process about:
- founders and teams of companies we consider, research or invest in;
- applicants to and participants in our events and programmes;
- visitors to darkstar.ee;
- anyone who contacts us.
It does not cover processing by the companies, military units or other organisations that take part in our events or programmes. Each of them is responsible for its own handling of your data.
3. What data we collect
Companies seeking investment
When you submit your company through the form on darkstar.ee, send us a deck by email, or are introduced to us, we collect what you give us: your name and email, your company and what it builds, its stage and what you are raising, and any deck or links you attach. If we go further, we collect what due diligence and, on investment, the law require: ownership, founder backgrounds, contracts, financials, and identity verification.
The form on darkstar.ee runs on our own infrastructure. Submissions and decks are encrypted before they are stored and do not pass through a third-party form provider. The form uses an automated check to tell people from bots; that check receives your IP address and browser signals, never your answers. We store a one-way hash of your IP address, your browser user agent and the bot-check score with the submission. We do not store the IP address itself.
Event and programme applicants and participants
When you apply to or register for an event or programme we run, we collect what the form asks: who you are, how to reach you (email and a messaging handle of your choice), your organisation and role, and, where the event selects companies, what your company builds and who is coming with you. Application forms run on our own infrastructure and what you submit is encrypted before it is stored.
Website visitors
darkstar.ee uses Google Analytics for basic traffic measurement: pages visited, referring site, browser and device type, approximate location. Google receives your IP address for this and may set cookies from its domain; we see aggregated statistics, not you. The site remembers whether you chose the light or the dark version in your browser’s local storage. Our web server logs each request with the requesting IP address for security and abuse prevention, and looks up the country of that address on our own server to block traffic from countries we do not serve.
Direct communications
If you email us, message us or speak to us at an event, we keep the content and your contact details.
4. Why we process your data and on what legal basis
| Purpose | Data used | Legal basis | Retention |
|---|---|---|---|
| Assess a company for investment | Everything you submit, plus what due diligence turns up | Legitimate interest: ours in assessing opportunities, yours in being assessed | 24 months after our decision, so we recognise you if you come back with a later round |
| Make and manage an investment | Founder identity, ownership, contracts, financial reporting | Contract; legal obligation (fund regulation, anti-money-laundering, accounting) | Life of the investment plus 7 years; anti-money-laundering records 5 years after the relationship ends |
| Select and run events and programmes | Application and registration data | Legitimate interest; contract performance once you are admitted | 2 years after the event or programme |
| Send updates and invitations | Name, email, what you attended or applied to | Legitimate interest for people we have worked with; consent otherwise. Every message has an unsubscribe link | Until you unsubscribe |
| Website analytics | IP address, browser data, cookies | Legitimate interest; consent for cookies where the law requires it | Up to 26 months (Google Analytics default) |
| Run and protect the website | IP address, request logs, bot-check score | Legitimate interest | Server logs up to 30 days; the hashed IP stays with the submission |
| Respond to enquiries | Contact details, message content | Legitimate interest | 12 months after last contact |
| Improve programmes and report impact | Aggregated, anonymised counts | Legitimate interest | Indefinitely (anonymised, cannot be traced back to you) |
Where the law sets a longer period, that period applies: 7 years for accounting records under Estonian law, 5 years after the end of a business relationship for anti-money-laundering records.
We do not make decisions about you by automated means. Every decision on an investment, an application or an invitation is made by a person. We do not sell your data and do not use it for advertising.
5. Who we share it with
Nobody. We do not pass your personal data to co-investors, partners, event hosts, portfolio companies or anyone else. What you send us stays with the Darkstar team.
The service providers in the next section store and move data on our behalf, on our instructions, and may not use it for anything of their own. The one exception to the rule above is a binding legal order, such as a court order or a request from our financial supervisor that we are obliged by law to answer.
6. Service providers
We use a small number of third-party providers to run our website and programmes. Each is bound by a data processing agreement, acts only on our instructions, and receives no more data than its function requires. We describe them here by category rather than by name:
| Category | What it is used for |
|---|---|
| Cloud hosting and infrastructure | Serving the website, storing encrypted data, sending you email |
| Workplace and document tooling | Reviewing applications and deals internally, team messaging, document storage |
| Bot protection | Telling people from automated abuse on our forms |
| Web analytics | Aggregated visit statistics |
We do not publish the names of our providers, or which data sits with which one. Naming the services behind our programmes narrows the search for anyone trying to reach the people who take part, and that is the one thing we will not make easy. This changes nothing about your rights. The full list, naming each provider, its role, the data it handles and where it processes it, is available on request: email privacy@darkstar.ee and we will send it to you. We provide it in full, and without needing to be asked, to supervisory authorities and to anyone else legally entitled to it, including the Estonian Data Protection Inspectorate.
7. International data transfers
What you send us is received and stored in the European Union. Submissions, applications and decks are encrypted and held on EU infrastructure, they do not pass through a third-party form service, and any email we send you about them is sent from the EU.
Some of the provider categories above operate from the United States, and each receives only what its function requires. Web analytics receives visit statistics that are not linked to a submission. The bot check receives your IP address and browser signals at the moment you submit, never your answers. Workplace and document tooling, which the team uses to read and assess applications, receives what the team is working on; access is restricted to that team.
Where a transfer outside the EEA happens, we rely on the EU-US Data Privacy Framework for certified US providers, on Standard Contractual Clauses approved by the European Commission otherwise, and on adequacy decisions where they apply. We will confirm which applies to a given provider on request.
8. Data security
Everything sent through our forms is encrypted with AES-256-GCM before it is written to storage, with the key held outside the storage system. Nobody browsing the storage can read a submission.
Beyond that, we apply technical and organisational measures to protect your data: access controls limiting data to the team members whose work needs it, encryption in transit (TLS) and at rest, and regular review of access permissions.
Our infrastructure is subject to application-level security controls including input validation, secure session management, and protection against common web application vulnerabilities. Network-level protections include firewalled environments, least-privilege access policies, and continuous monitoring of access patterns.
9. Your rights
Under the EU General Data Protection Regulation (GDPR) and Estonian data protection law you have the right to:
- Access: a copy of the personal data we hold about you.
- Rectification: correction of inaccurate data.
- Erasure: deletion of your data, subject to legal retention requirements.
- Restriction: a limit on how we process your data.
- Portability: your data in a structured, machine-readable format.
- Objection: to processing based on legitimate interest. We will stop unless we can show grounds that override yours.
- Withdrawal of consent: at any time, where processing is based on consent.
To exercise any of these rights, email privacy@darkstar.ee. We will respond within 30 days. Where we keep data to meet a legal duty, for example anti-money-laundering records, we cannot delete it before the statutory period ends, and we will tell you so.
If you believe we have not handled your data correctly, you can lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) at aki.ee, or with the supervisory authority in your country of residence.
10. Cookies and local storage
darkstar.ee uses Google Analytics for basic traffic measurement, which sets cookies from Google’s domain under Google’s privacy policy. No advertising or cross-site tracking cookies are placed. Where the law requires it, consent is asked before non-essential cookies are set. The site itself sets no cookies; it stores your light-or-dark choice in your browser’s local storage under a single key, and clearing site data removes it.
The forms use Google reCAPTCHA v3, which may set a cookie from Google’s domain and receives your IP address and interaction signals. We only see the resulting score. We also apply per-address rate limits and a hidden field that only automated clients tend to fill in.
11. Children
Our services are not directed at people under 18. We do not knowingly collect personal data from minors.
12. Changes to this policy
We may update this policy from time to time. Material changes will be posted on darkstar.ee, and the date at the top of this page will be updated.
13. Contact
Darkstar invests in military technology at pre-seed and seed and organises defence technology events and programmes. Email privacy@darkstar.ee. Web darkstar.ee.