Privacy policy

This English version is provided for convenience only. In the event of any discrepancy, the German version shall prevail.

Privacy information pursuant to Art. 13, 14 and 21 of the General Data Protection Regulation (GDPR) for the website ffm.capital, our pages on external platforms and other processing operations of Fund Finance Management GmbH.

I. General information

Controller

We take the protection of your personal data, and the legal obligations that serve this protection, seriously. Data protection law requires us to inform you transparently about which personal data we process, for what purpose, in what manner and to what extent. This privacy policy therefore explains which data we process when you use our website, contact us or visit our pages on external platforms.

The controller within the meaning of the GDPR and the German Federal Data Protection Act (BDSG) is:

Fund Finance Management GmbH
Brüsseler Straße 1–3
60327 Frankfurt am Main
Email: datenschutz@2ig.de
Represented by the managing directors: Dr. Gabriele Lange, Dr. Simone Stille, Georg Klusak

Hereinafter referred to as “we” or the “controller”.

Links on our website may take you to websites that are operated not by us but by third parties. Such links are either clearly marked or recognisable by a change of address in your browser. We are not responsible for compliance with data protection on these websites.

Data protection officer

You can contact our data protection officer at:

Sascha Kremer
c/o KREMER LEGAL
Bahnhofstraße 66
41236 Mönchengladbach
sascha.kremer@kremer.legal

Definitions

This privacy policy uses the terms of the GDPR. You can consult the definitions in Art. 4 GDPR, for example, at eur-lex.europa.eu.

Cookies are small text files that a website stores on or reads from your device, for example to recognise you and your settings when you visit again or to evaluate usage statistically. Similar technologies such as your browser’s web storage store information locally on your device: in “sessionStorage” until you close the browser tab, and in “localStorage” until you clear your browser’s storage.

Where we refer to categories of data, we mean in particular: master data (e.g. name, company, address), contact data (e.g. email address, telephone number), content data (e.g. text entries, documents), contract data (e.g. subject matter of the contract, term), usage data (e.g. pages visited, access times), connection data (e.g. IP address, device information, referrer) and location data (e.g. derived from the IP address).

Principles of data processing

We process personal data only to the extent permitted by law and protect it through appropriate technical and organisational measures, for example encryption and access restrictions. Data transmitted between your browser and our website is encrypted using TLS; you can recognise this by “https://” in the address bar. We disclose personal data only in the cases described here or where we are legally obliged to do so, for example to public authorities.

Retention period

We erase personal data as soon as the purpose of the processing no longer applies and there is no statutory retention obligation, unless further storage is necessary for the conclusion or performance of a contract. Information on the retention period of individual processing operations is given for each processing operation in section II.

Automated individual decision-making

We do not carry out automated individual decision-making, including profiling (Art. 22 GDPR).

Your rights

You have the right of access (Art. 15 GDPR), the right to rectification (Art. 16 GDPR), the right to erasure (Art. 17 GDPR), the right to restriction of processing (Art. 18 GDPR) and the right to data portability (Art. 20 GDPR). The right of access and the right to erasure are subject to the restrictions under Sections 34 and 35 BDSG.

We communicate any rectification, erasure or restriction of processing to each recipient to whom we have disclosed your data, unless this proves impossible or involves disproportionate effort (Art. 19 GDPR). On request, we will inform you about those recipients.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR in conjunction with § 19 BDSG). The supervisory authority competent for us is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI)
(Hessian Commissioner for Data Protection and Freedom of Information)
Gustav-Stresemann-Ring 1
65189 Wiesbaden
datenschutz.hessen.de

You are free to contact any other data protection supervisory authority. A list of the supervisory authorities is available at www.bfdi.bund.de.

Right to object under Art. 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data that we carry out on the basis of Art. 6(1)(f) GDPR. Where we process your data for direct marketing purposes, you may object to this at any time without giving reasons.

You may withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). The withdrawal does not affect the lawfulness of processing based on consent before its withdrawal. Following your withdrawal, we will erase the data processed on the basis of the consent, unless there is another legal basis for the processing.

Objections and withdrawals are not subject to any formal requirements and may be sent, for example, by post or by email to datenschutz@2ig.de.

Obligation to provide data

Unless otherwise stated for the individual processing operations, you are not obliged to provide us with personal data. In the cases of Art. 6(1)(b) GDPR, however, the data is required for the conclusion or performance of a contract; without it, this is not possible. Without the data that we process on the basis of Art. 6(1)(f) GDPR, you cannot use the relevant parts of our website, or we cannot handle your enquiry.

II. Our website

The use of our website and its functions generally requires the processing of personal data.

Provision of the website and server log files

Purpose: Provision, functionality and optimisation of the website; security of our IT systems, in particular the detection and prevention of attacks. When you access the website, the server automatically processes the information transmitted by your browser: IP address, date and time of access, page or file requested, amount of data transferred, status message, previously visited page (referrer), browser type and version, and operating system. We host fonts and images ourselves; no connections to third-party providers such as Google Fonts are established when you access the website.
Legal basis: Art. 6(1)(f) GDPR; our legitimate interest lies in the purposes stated.
Categories of data: Connection data, usage data
Recipients: IT service providers (hosting) as processors acting on our behalf under Art. 28 GDPR
Transfer to third countries: None
Retention period: We erase server log files as soon as they are no longer required for the purposes stated, unless they are needed for longer to investigate a specific security incident.
Consent-based cookies: No

Cookies and similar technologies

Purpose: On our website we do not use any cookies or similar technologies that require consent, nor any analytics, marketing or tracking services. Where any information is stored on or read from your device at all, this is strictly necessary for the operation of the website and the functions you have requested. We therefore do not use a cookie consent tool. Should we use services requiring consent in future, we will obtain your consent beforehand and update this privacy policy accordingly.
Legal basis: § 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG); Art. 6(1)(f) GDPR
Categories of data: Usage data, connection data
Recipients: IT service providers (hosting) as processors acting on our behalf
Transfer to third countries: None
Consent-based cookies: No

Contact form and contact by email or telephone

You can use our contact form to tell us about your enquiry. In doing so, we ask for the subject of your enquiry, your name, your company, your email address, your telephone number and your message. Name, email address and message are mandatory; all other information is voluntary. The following applies accordingly to enquiries made by email or telephone.

Purpose: Handling of and response to your enquiry, for example a financing enquiry or an enquiry as a lender or investor; record of the communication; protection of the form against misuse and security of our IT systems.
Legal basis: Art. 6(1)(f) GDPR; our legitimate interest lies in responding appropriately to your enquiry. Where your enquiry concerns the conclusion or performance of a contract, for example the brokering of financing, Art. 6(1)(b) GDPR also applies.
Categories of data: Master data (name, company), contact data (email address and, where applicable, telephone number), content data (selected subject, message), contract data where applicable, connection data (IP address, time of submission)
Recipients: IT service providers, for example for hosting and email services, as processors acting on our behalf under Art. 28 GDPR. Where a financing enquiry leads to a specific assessment, we pass on the necessary information, with your knowledge, to the lender or asset management company (Kapitalverwaltungsgesellschaft) concerned. Your data is not disclosed to any other third parties unless we are legally obliged to do so.
Transfer to third countries: None
Retention period: We erase your information as soon as your enquiry has been dealt with conclusively and no further communication on it is to be expected, and no later than six months after the last contact. Where your enquiry leads to a contract, or where the documents constitute commercial or business letters, we retain them for the statutory retention periods (§ 257 of the German Commercial Code (HGB), § 147 of the German Fiscal Code (AO); up to ten years).
Consent-based cookies: No

III. External pages and links

Links to third-party websites

Our website contains links to websites of other providers, for example to the website of the Institutional Investment Group (www.2ig.de). Personal data is transmitted to these providers only when you click on such a link. From that point on, the provider concerned is responsible for the processing, and its privacy information applies.

Purpose: We maintain a company page on the LinkedIn platform. When you visit this page, LinkedIn processes your personal data. We receive aggregated statistics derived from this data on the use of our page.
Legal basis: Art. 6(1)(f) GDPR; our legitimate interest lies in presenting our company and communicating with interested parties.
Categories of data: Master data, contact data, content data, usage data, connection data, location data where applicable
Recipients: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, as joint controller under Art. 26 GDPR. The essence of the arrangement is available at legal.linkedin.com/pages-joint-controller-addendum.
Transfer to third countries: In individual cases, the USA and other third countries, on the basis of the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR)
Consent-based cookies: No, not by us. LinkedIn itself provides information on the cookies it sets on its platform.
Your rights: LinkedIn has primary responsibility for giving effect to your rights (linkedin.com/legal/privacy-policy). You may also exercise your rights against us; we will then forward your request to LinkedIn.

IV. Further privacy information

Applications

Vacancies and applications are handled via the careers portal at 2ig.de. The privacy information provided there applies to the processing of your data in the application process.

V. Changes to this privacy policy

We will amend this privacy policy if our website, our processing operations or the legal requirements change. The version published on this page applies in each case.

Last updated: November 2026