Privacy Policy

This Privacy Policy explains how personal data is processed in connection with the website available at https://projectcee.com and with the professional activities carried out under the Project CEE brand: private M&A advisory, deal origination and market entry support in Central and Eastern Europe.

It is addressed primarily to investors, business owners, professional advisers and other business contacts who interact with Project CEE. It describes what personal data may be processed, why, on what legal basis, for how long, who may receive it and what rights are available under Regulation (EU) 2016/679 (the GDPR).

Project CEE is a business brand and platform operated by BYRSKI HOLDING sp. z o.o. Project CEE is not itself a separate legal entity.

The controller of personal data within the meaning of Article 4(7) GDPR is BYRSKI HOLDING SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, a Polish limited liability company with its registered office at ul. Elektoralna 13/121, 00-137 Warszawa, Poland, registered on 17 February 2025 under KRS 0001156273, NIP 5253035669, REGON 540929278.

All privacy enquiries and requests concerning data protection rights may be sent to contact@projectcee.com.

The controller has not appointed a Data Protection Officer. Privacy matters are handled directly by the controller at the contact address above.

This Policy applies to personal data processed in connection with:

• use of the Project CEE website, including its English and Polish language versions
• enquiries submitted through the Investor Acquisition Criteria form, the Business Owner Confidential Enquiry form and the General Enquiry form
• documents voluntarily uploaded through the investor form
• business correspondence conducted by email, telephone or other direct channels
• private-market research, deal origination and transaction-related activities carried out under the Project CEE brand

This Policy does not apply to third-party websites or services that may be linked from this website. Cookies and similar technologies are described in a separate Cookie Policy.

The categories of personal data processed depend on the nature of the interaction. Not all categories apply to every person. Depending on the circumstances, the following data may be processed:

• full name
• business email address
• telephone number
• company, fund or organisation represented
• professional position or role
• investor type
• investment preferences
• acquisition criteria
• geographic preferences
• industry or sector preferences
• revenue criteria
• EBITDA criteria
• enterprise value or transaction size criteria
• ownership preferences
• strategic criteria
• transaction objectives
• information contained in the content of enquiry messages
• information concerning a business submitted by its owner or representative
• information contained in uploaded acquisition mandates or other documents
• preferred contact method
• correspondence history
• technical information reasonably necessary for the security and correct operation of the website
• date and time of submission
• language version or locale used
• publicly available professional or business information, where relevant to legitimate Project CEE origination activities

No special categories of personal data within the meaning of Article 9 GDPR are intentionally requested, and no data relating to criminal convictions or offences is requested. Please do not include such information in enquiry messages or uploaded documents unless it is genuinely necessary, and keep any personal data included in documents limited to what the matter requires.

Personal data may be obtained from the following sources:

A. Directly from the data subject

Through the Investor Acquisition Criteria form, the Business Owner Confidential Enquiry form, the General Enquiry form, email, telephone or other direct business communication.

B. From the organisation represented

Where an individual is identified to us by the company, fund or institution on whose behalf they act, for example as a contact person for a mandate or a transaction.

C. From publicly available sources

Where relevant to legitimate business-to-business and M&A origination activities, including official corporate registers, company websites, professional directories, publicly available business publications, publicly available professional profiles and other lawful public business sources.

D. From professional advisers and counterparties

From legal, tax, financial or other advisers, investors, business owners or transaction counterparties, where appropriate and lawful in the context of a specific matter.

Public sources are used selectively and in a targeted manner in the context of a defined acquisition or market mapping objective. Indiscriminate collection or automated large-scale scraping of personal information is not carried out.

Consent is not used as a universal legal basis. Each purpose is assigned the legal basis that genuinely applies to it.

Article 6(1)(b) GDPR — contract and pre-contractual steps

Processing necessary to take steps at the request of the data subject before entering into a contract, or to perform a contract, including responding to enquiries concerning potential cooperation, agreeing the terms of engagement and performing an agreed engagement.

Article 6(1)(f) GDPR — legitimate interests

Processing necessary for the purposes of legitimate interests pursued by the controller or a third party. The relevant legitimate interests are:

• handling business-to-business enquiries, including where the enquiry is submitted on behalf of an organisation
• establishing and developing legitimate business relationships
• evaluating potential acquisition and investment opportunities
• communicating with investors, business owners and their representatives
• conducting private-market research and deal origination
• identifying potentially relevant businesses and appropriate professional contacts
• establishing confidential dialogue concerning potential transactions
• maintaining records of correspondence and of the matters handled
• establishing, exercising or defending legal claims and protecting legal rights
• preventing abuse, misuse of the forms and fraud
• ensuring the security, integrity and correct operation of the website and supporting infrastructure

Article 6(1)(c) GDPR — legal obligations

Processing necessary for compliance with legal obligations to which the controller is subject, including accounting, tax, corporate and other mandatory regulatory requirements under Polish and EU law, and responding to lawful requests from competent authorities.

Article 6(1)(a) GDPR — consent

Consent is relied on only where it is genuinely required, for example for optional marketing communications or for non-essential cookies or analytics technologies, should any be introduced in the future. No newsletter or direct marketing subscription is currently offered on this website, and no analytics or advertising technologies are currently deployed. Where processing is based on consent, consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

The website provides three enquiry routes: the Investor Acquisition Criteria form, the Business Owner Confidential Enquiry form and the General Enquiry form. Submissions are transmitted over an encrypted connection, stored in a private database that is not publicly readable, and an internal notification is sent to the controller's business address so that the enquiry can be reviewed and answered.

Fields marked as required are those reasonably necessary to identify the sender and understand the enquiry. All other fields are optional and may be left blank.

The acknowledgement checkbox in each form confirms that the Privacy Policy has been read. It is not a consent to unrestricted processing of personal data; processing of enquiries is based on Article 6(1)(b) and Article 6(1)(f) GDPR as described above.

Information submitted through the Investor Acquisition Criteria form may be used to:

• understand the investor's acquisition mandate
• assess potential fit with Project CEE's geographic and sector focus
• identify potentially relevant privately held businesses
• conduct market mapping
• assess potential acquisition targets
• establish dialogue regarding acquisition opportunities
• communicate with the investor and their representatives
• coordinate appropriate next steps

Legal bases: Article 6(1)(b) GDPR where the submission constitutes a step taken at the request of the investor prior to entering into a contract, and Article 6(1)(f) GDPR where the data relates to a representative of an institutional investor, the legitimate interest being the handling of business enquiries and the development of investor relationships.

Submission of acquisition criteria does not guarantee that Project CEE will identify an acquisition opportunity, present a target or complete a transaction, and does not by itself create any engagement or mandate.

Information submitted by a business owner or their representative may be used to:

• understand the owner's objectives
• assess potential ownership or transaction options
• evaluate potential investor fit at a general level
• communicate confidentially with the owner
• determine whether further discussions are appropriate
• coordinate a potential process where this is subsequently agreed

Submitting the form does not put the company up for sale, does not start a formal sale process, does not distribute information about the business to investors, does not create a mandate and does not authorise disclosure of confidential information to third parties. Any further disclosure or transaction activity depends on the circumstances and on arrangements agreed separately with the owner.

Legal bases: Article 6(1)(b) and Article 6(1)(f) GDPR, the legitimate interest being the handling of confidential business enquiries and the assessment of a potential future engagement.

Information submitted through the General Enquiry form may be used to:

• respond to the enquiry
• assess the service or form of cooperation requested
• maintain a record of the correspondence
• establish or develop a business relationship
• handle partnership, professional, adviser or media enquiries

Legal bases: Article 6(1)(b) and Article 6(1)(f) GDPR, the legitimate interest being responding to and managing business correspondence.

The Investor Acquisition Criteria form allows an acquisition mandate or similar document to be uploaded voluntarily. Uploaded documents may contain personal data as well as business information.

• documents are used solely to evaluate and handle the relevant enquiry or mandate
• documents should contain only information reasonably necessary for that purpose
• users are asked to avoid including unnecessary personal data, and in particular special categories of personal data
• uploaded documents are stored in private storage that is not publicly accessible and is not exposed through public links
• internal notifications sent to the controller do not publish unrestricted public document URLs

Legal bases: Article 6(1)(b) and Article 6(1)(f) GDPR, as for the enquiry to which the document relates.

Where a conversation continues by email, telephone or in person, the correspondence and the business information exchanged are processed in order to conduct the discussion, prepare and perform an engagement, and maintain a record of what was agreed.

Legal bases: Article 6(1)(b) GDPR where the communication concerns a contract or steps taken prior to a contract, Article 6(1)(f) GDPR for maintaining business relationships and records, and Article 6(1)(c) GDPR where retention of documentation is required by law.

No newsletter or general marketing mailing is currently operated. If such communications were introduced, they would be based on separate, freely given consent or, where permitted, on a legitimate interest with a clearly available right to object.

Project CEE's core activity is private-market origination: identifying privately held businesses that appear potentially aligned with a defined acquisition strategy, and identifying the appropriate professional contacts within or advising those businesses.

For this purpose, business and professional information may be researched using lawful and publicly available sources. Typical purposes are:

• market mapping
• target identification
• ownership and shareholding research
• identifying appropriate professional contacts
• assessing strategic relevance to a defined mandate
• establishing an initial confidential business-to-business dialogue concerning potential acquisition or investment interest

Only information reasonably relevant to the professional or business activity of the individual concerned is processed. Information relating to private life is not sought. The fact that personal data is publicly available does not mean it may be used for any purpose; each use is assessed against the purpose limitation and data minimisation principles and against the balancing test required by Article 6(1)(f) GDPR.

Legal basis: Article 6(1)(f) GDPR. The legitimate interests are conducting private-market research and deal origination, identifying potentially relevant businesses and professional contacts, and establishing a confidential business dialogue concerning a potential transaction.

Where personal data is not obtained directly from the data subject, the information obligations under Article 14 GDPR apply. Project CEE provides that information within a reasonable period and, at the latest, at the time of the first communication with the individual, subject to the exceptions permitted by Article 14(5) GDPR.

Categories of data

Professional identification and contact data such as name, professional role, business email address, business telephone number, employer or organisation, and publicly available information about the business and its ownership.

Source of data

Official corporate registers, company websites, professional directories, publicly available business publications, publicly available professional profiles, other lawful public business sources, or professional advisers, investors, business owners and counterparties in the context of a specific matter.

Purposes

Market mapping, target and contact identification, assessment of strategic relevance, and initiation of a confidential business-to-business dialogue concerning a potential acquisition or investment.

Legal basis and legitimate interest

Article 6(1)(f) GDPR. The legitimate interest is the conduct of lawful private-market origination and business development in a business-to-business context.

Recipients

The categories of recipients described in section 15, principally IT, hosting, database and email service providers acting as processors, and professional advisers where relevant.

Retention

As described in section 17. Research data concerning a contact who declines further contact is deleted or reduced to the minimum record needed to avoid renewed approaches.

Rights

The rights described in sections 20 to 23, including the right to object at any time on grounds relating to the particular situation of the data subject.

Personal data is not sold and is not shared indiscriminately. Data may be made available, only where necessary and appropriate in a given matter, to the following categories of recipients:

• IT infrastructure and hosting providers
• website and application infrastructure providers
• secure database and file storage providers
• email delivery providers used for internal notifications and business correspondence
• professional advisers, including legal, tax, accounting and financial advisers
• technical service providers supporting the operation, maintenance and security of the website
• prospective transaction counterparties, but only where appropriate to an agreed process and subject to applicable confidentiality and data protection requirements
• public authorities, where disclosure is required by law or necessary to establish, exercise or defend legal claims

Not every enquiry is shared with every category. Disclosure to advisers takes place only where the matter makes it relevant and necessary, and always subject to professional confidentiality and data protection obligations. Service providers who process personal data on behalf of the controller act as processors under written agreements meeting the requirements of Article 28 GDPR.

Technology supplied through Lovable

The website, its hosting, its enquiry database, its private file storage and its transactional email delivery are operated using technology and infrastructure supplied through Lovable. Where personal data submitted to Project CEE is processed by that infrastructure, the provider and its subprocessors act as processors or service providers on behalf of the controller and not as joint controllers of Project CEE enquiry data.

Subprocessors are engaged under applicable contractual safeguards. Because a subprocessor list can change over time, it is not reproduced in this Policy; current information about the categories of providers involved can be requested at contact@projectcee.com.

Fonts

The website loads typefaces from Google Fonts. When a page is displayed, the browser connects to Google servers to retrieve the font files, and this connection involves the transmission of the IP address and standard technical request data. No cookies are set by this website for that purpose.

Some technology and service providers, or their subprocessors, may process personal data outside the European Economic Area, for example where infrastructure, support functions or content delivery networks are operated globally.

Where personal data is transferred outside the EEA, appropriate safeguards are relied on where required under Chapter V GDPR. These may include:

• an adequacy decision of the European Commission
• Standard Contractual Clauses adopted by the European Commission, together with supplementary measures where appropriate
• other transfer mechanisms permitted under Chapter V GDPR

It is not asserted that all data remains exclusively in Poland or exclusively within the European Union. Further information about the safeguards applied to a specific transfer can be requested at contact@projectcee.com.

Personal data is retained only for as long as necessary for the purposes for which it was collected. The following operational framework applies:

Retention may be shortened where the data is no longer required, and may be extended where required by law or where necessary in connection with a dispute, a legal claim or a regulatory obligation.

Appropriate technical and organisational measures are applied to protect personal data against unauthorised access, alteration, disclosure, loss or destruction, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing.

• the website and all form submissions use encrypted connections
• enquiry records are stored in a private database that is not publicly readable and is protected by access controls
• uploaded documents are stored in private storage subject to access controls and are not exposed publicly
• access to enquiry data is limited to those who need it to handle the matter
• credentials and infrastructure secrets are held server-side and are not exposed in the browser

No method of transmission or storage can be guaranteed to be entirely secure, and no absolute guarantee of security is given. Details of the security architecture are not published, in order not to weaken the protections themselves.

Enquiry data submitted through this website is not used for decisions based solely on automated processing, including profiling, which produce legal effects concerning the data subject or similarly significantly affect them within the meaning of Article 22 GDPR. Assessment of enquiries, investors and potential targets is carried out by people.

Subject to the conditions set out in the GDPR, individuals have:

• the right of access to their personal data and to obtain a copy of it (Article 15)
• the right to rectification of inaccurate or incomplete data (Article 16)
• the right to erasure (Article 17)
• the right to restriction of processing (Article 18)
• the right to data portability, where processing is based on consent or a contract and is carried out by automated means (Article 20)
• the right to object to processing based on legitimate interests (Article 21)
• the right to withdraw consent, where processing is based on consent (Article 7(3))
• the right to lodge a complaint with a supervisory authority (Article 77)

Requests may be submitted to contact@projectcee.com. A response is normally provided within one month of receipt; where a request is complex or where several requests have been received, that period may be extended in accordance with Article 12(3) GDPR, and the individual will be informed. Additional information may be requested where it is genuinely necessary to confirm the identity of the person making the request.

Where personal data is processed on the basis of Article 6(1)(f) GDPR — including origination research, identification of professional contacts and initial business outreach — an individual has the right to object at any time, on grounds relating to their particular situation.

Following an objection, the processing will cease unless compelling legitimate grounds are demonstrated which override the interests, rights and freedoms of the data subject, or unless the processing is necessary for the establishment, exercise or defence of legal claims.

If personal data were ever processed for direct marketing purposes, an objection to such processing may be made at any time and the data will then no longer be processed for that purpose. An objection may be sent to contact@projectcee.com.

Where processing is based on consent under Article 6(1)(a) GDPR, that consent may be withdrawn at any time, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.

Withdrawal of consent does not affect processing carried out on other legal bases, such as the performance of a contract, compliance with a legal obligation or legitimate interests.

An individual who considers that the processing of their personal data infringes the GDPR has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or the place of the alleged infringement.

In Poland the competent supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), whose website is available at https://uodo.gov.pl.

Providing personal data through the website is voluntary. However, the data marked as required in a form is necessary to identify the sender and to respond to the enquiry; without it, the enquiry cannot be handled.

Optional fields, including financial criteria, transaction parameters and uploaded documents, may be left blank. Providing them may allow a more precise assessment, but is not a condition of submitting an enquiry.

Where personal data must be provided in order to comply with a legal obligation or to conclude and perform a contract, this will be indicated in the relevant context.

Project CEE is a professional business-to-business and private-market platform. The website, its content and its enquiry forms are intended for adults acting in a professional or business capacity, and are not directed at children. No services are knowingly offered to children and no personal data is knowingly collected from them.

The website may contain links to external websites, including sources cited in editorial content. Those websites are operated by third parties and are governed by their own privacy policies and terms. The controller is not responsible for the content of those websites or for how they process personal data.

This Privacy Policy may be updated as the services, the technologies used or the applicable legal requirements evolve — for example if analytics technologies or new communication channels are introduced.

The effective date shown at the top of this page indicates the version currently in force. Where changes are material, the updated Policy will be published on this page before the change takes effect wherever reasonably practicable.

All privacy enquiries and requests concerning data protection rights should be addressed to contact@projectcee.com.

BYRSKI HOLDING SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, ul. Elektoralna 13/121, 00-137 Warszawa, Poland. KRS 0001156273, NIP 5253035669, REGON 540929278.