Registry Privacy Policy

1. Who processes your data

The controller of your personal data is LIMITED LIABILITY COMPANY “FOUNDERS LEAGUE” (EDRPOU code 43411238, office 10, 4b Yaroslavska St., Kyiv 04071, Ukraine), trading as UMFO — Ukrainian Multi-Family Office. The registry is a UMFO project; UMFO's general privacy policy is at umfo.eu. This policy supplements it and covers the registry only.

All data requests: tg@umfo.eu. Postal address: office 10, 4b Yaroslavska St., Kyiv 04071, Ukraine. Person responsible for data protection: Tetiana Honcharenko, Director of LLC “Founders League”.

We follow the Law of Ukraine on the Protection of Personal Data and Regulation (EU) 2016/679 (GDPR) — for people in the EU, or wherever the GDPR otherwise applies to our processing.

2. Whose data, and what data

2.1. Visitors who register

• Email and phone; optionally your name, company and role.
• A record of your consent: the date, the version and the exact wording you were shown.
• Date of registration, last sign-in, number of sign-ins, and the language you chose for emails.
• What you do in the registry: requests made “via UMFO” about companies and their status, saved profiles (visible only to you), and “couldn't find what I needed” notes together with your search.

2.2. Company representatives

• The email address to which a sign-in link or an invitation is sent.
• The company details you submit for moderation, and the partners' decision on them (including any reason for declining).
• The contact for UMFO (section 8 of the questionnaire: name, role, email, phone) — never published; only the UMFO partners and the profile owner see it.
• Invitations: the address, when it was sent and opened; a “do not contact” flag if the company opted out of emails.

2.3. Data in company profiles

Profiles are compiled from public sources: company websites, public registers and industry directories. A profile contains the company's business contacts (a general email address, office phone, LinkedIn page, website) and research notes about its services. Names of individuals are kept only in UMFO's internal research notes and are not shown in the registry. Personal addresses such as gmail are discarded on import. What is shown is visible in the profile itself.

2.4. Technical data

• IP address, email or account ID in the rate-limit log (protection against brute force and bulk copying). Entries older than 24 hours are deleted automatically.
• Mail log: date, recipient, subject and whether the email was sent. Email bodies are not stored.
• Cookies — see Registry cookies. Analytics only with your consent.

3. Why, and on what legal basis

Purpose	Data	Legal basis
Access to the registry: registration, link sign-in, your account	2.1, 2.2	Performance of a contract — these Terms of Use (Art. 6(1)(b) GDPR); the consent you gave on registration (Art. 11 of the Ukrainian Law)
Emails about the registry: confirmations, decisions about a profile, “how did the introduction go”	2.1, 2.2	Performance of a contract; consent given on registration
Introducing a family to a company on a request “via UMFO”	2.1	Carrying out your request (Art. 6(1)(b) GDPR)
Publishing company profiles from public sources	2.3	The legitimate interest of UMFO and registry users in helping families find professionals (Art. 6(1)(f) GDPR). You can object — section 7
Inviting a company to maintain its profile (one email and at most one reminder after 14 days, only to the business address in the profile)	2.3, 2.2	Legitimate interest; every email offers a one-word opt-out, and the opt-out is kept
Moderating details a company submits and publishing its self-description	2.2	Performance of a contract with the company; legitimate interest in an accurate registry
Security: rate limits, protection against password guessing and bulk copying, flagging suspicious submissions	2.4	Legitimate interest (Art. 6(1)(f) GDPR)
De-identified visit statistics	analytics cookies	Your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time
Legal compliance and defending legal claims	the minimum necessary	Legal obligation (Art. 6(1)(c)); legitimate interest

We do not sell data, do not use it for advertising and do not take decisions about you by automated means alone. The registry does not ask for special categories of data (health, religion, etc.) — please do not enter them in free-text fields.

4. Who sees your data

• Other registry users see company profiles only. Nobody but the UMFO partners sees your data as a visitor — your requests, saved profiles or contact details.
• Companies do not receive your contact details through the registry. The UMFO partners make introductions by hand, and only once both sides agree.
• The UMFO partners see the data needed to run the registry: registrations, requests, company submissions and contacts for UMFO.
• Publicly, without signing in, only the number of profiles per area and the names of a few companies are visible. Full profiles require registration.

5. Processors and international transfers

We use services that process data on our behalf and do not use it for their own purposes:

Service	Purpose	Data
Hosting: adm.tools (ukraine.com.ua); the server is in a Hetzner Online GmbH data centre in Finland (EU)	Running the site and storing the database	All registry data
Sinch Mailjet SAS (France) — Mailjet; processing in the EU	Sending emails	Address, subject and body of the email
Google Ireland Limited — Google Workspace (the tg@umfo.eu mailbox)	Receiving notifications and your replies	Notifications about registrations, requests, submissions
Anthropic, PBC (USA) — Claude API	Automatic translation of profiles between Ukrainian and English	Profile texts from public sources and the descriptions companies submit for publication. No visitor data is sent
Google Ireland Limited — Google Analytics 4	De-identified statistics, only with your consent	Page address without search parameters, device and browser type, approximate region
Google Ireland Limited — Google Drive	The research spreadsheet and the export of company self-descriptions for the partners	Profile and self-description data, including the contact for UMFO

Some of these services are located outside Ukraine and outside the EU (including the USA). Transfers to the USA rely on the European Commission's standard contractual clauses (Decision 2021/914) incorporated in Anthropic's data processing addendum, and for Google on its data processing terms with standard contractual clauses and the EU-US Data Privacy Framework; hosting and Mailjet process data in the EU. Transfers comply with Art. 29 of the Ukrainian Law on the Protection of Personal Data. You can request a copy of the safeguards at tg@umfo.eu.

The registry is operated with the help of AI agents (Claude Code) supervised by the UMFO partners: they help update profiles, check submissions and prepare emails. The agents follow written rules and do not send emails or take decisions without a direct instruction from a person.

6. How long we keep data

Data	Period
Visitor account and its requests	While the account is active; deleted on request or after 24 months (730 days) without a sign-in
Sign-in links	Valid for 30 minutes, single use; the record of the link is deleted one day after it expires
Browser session	90 days or until you sign out
Unconfirmed company submissions	30 days
Company invitations	The link is valid for 30 days; the record of the invitation is kept while the company's profile exists, so that we never write twice
“Do not contact” flag	Indefinitely — so that we never write again
Company profiles	While the profile is published or until removed on request
Rate-limit log (IP addresses)	24 hours
Mail log	12 months
Database backups	30 days

7. Your rights

You have the right to know what data of yours we process, to receive a copy (including in a machine-readable format), to have inaccurate data corrected, to request erasure or restriction, to object to processing based on legitimate interest (including the publication of a profile or of your name in it, and invitation emails), and to withdraw consent — without affecting the lawfulness of processing before withdrawal.

How: write to tg@umfo.eu from the address linked to your account or profile. We reply within 30 days. To stop invitation emails, simply reply with one word. Erasure on request removes the account, requests, saved profiles, submissions, invitations and mail-log entries; in backups the data disappears when they expire.

You may also complain to the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua) or to the data protection authority of the EU country where you live or work.

8. Security

Sign-in uses no passwords, only a one-time link sent to your email. Sessions are signed, and signing out cancels every copy of the session. Pages are served over HTTPS only, with rate limits and protection of forms against request forgery. Code on the server cannot be modified by the web server; keys and passwords are stored outside the public folder.

9. Changes

We will announce material changes on this page and by email to registered users. Earlier versions are available on request.