Privacy Policy

1. Controller

Who is responsible, and where to write.

The controller for data processing on this website within the meaning of Art. 4(7) GDPR is spectup, represented by Niclas Schlopsna, Kirchbachweg 22, 81479 Munich, Germany, hi@spectup.com.

We have not appointed a data protection officer, as we are not required to under Art. 37 GDPR or § 38 BDSG. Please send any privacy enquiry to the address above.

2. What we process, and on what legal basis

The honest list. What actually gets collected, why we are allowed to, and how long it stays.

2.1 Server log files

When you load a page, your browser necessarily transmits your IP address, the date and time of the request, the page requested, the referring URL, your browser type and version, and your operating system. Our hosting provider records this in log files to deliver the site, maintain stability and security, and investigate abuse.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the site. Retention: log files are deleted after 30 days at the latest, unless a specific security incident requires us to keep a record for longer.

2.2 Contact form and email

If you use the contact form we process what you enter there, so that we can answer you: why you are writing, and then your name, work email address, LinkedIn profile, company or fund, your role, and anything you put in the message field. If your enquiry concerns a mandate the form also asks for the kind of mandate, its size, its stage, the revenue or fund position behind it, and your acknowledgement of how we are paid. Your name, email address and LinkedIn profile are required; the rest is optional or is a choice between given answers. The form also carries one hidden field that only an automated submission fills in, which tells us a submission is not from a person and collects nothing about you. The same applies to anything you send us by email or tell us by telephone.

There is no scheduling window on this site. Every “Request Call” control leads to the contact form above, and a call is arranged from there by email.

Legal basis: Art. 6(1)(b) GDPR where your enquiry concerns a possible mandate or an existing engagement, otherwise Art. 6(1)(f) GDPR, our legitimate interest in responding to enquiries. Retention: we delete enquiry correspondence once the matter is closed and no statutory retention period applies. Correspondence that forms part of commercial books and records is retained for the statutory period under § 257 HGB and § 147 AO, currently up to 10 years.

The form is delivered by FormSubmit (Formsubmit.co). The data in the form is transmitted to that service, which forwards it to our mailbox. If the service is unavailable the form instead opens a pre-filled draft in your own email programme, in which case nothing is sent to any third party. The last question on the form asks whether we may write to you; if you answer yes, your email address is additionally sent along the route described in 2.4. Answering no sends it nowhere but to us.

2.3 Measurement

We measure how this site is used with Google Analytics 4 and Google Tag Manager. Neither is loaded, and no request reaches Google, unless you allow measurement in the cookie notice. Once you do, they record which pages are read, from where and for how long, and they set their own cookies to do it. Google signals and ad personalisation are switched off. Shortening of the IP address is the product’s own default and cannot be turned off. We run no advertising or profiling tags of any kind.

Legal basis: Art. 6(1)(a) GDPR, your consent, which you may withdraw at any time at the end of section 3 with effect for the future. Recipient: Google Ireland Ltd., with processing also in the United States, see section 4.

2.4 Newsletter

The signup fields in the footer, and the last question on the contact form, are our own. No frame from Substack or anyone else is loaded on any page, so nothing reaches another service until you submit. When you do, your email address is sent to an endpoint on this site’s own domain, which passes it to Substack. It is added there to each of the publications spectup writes: the Raise or Die Letter, the Deal Makers (& Fakers) podcast list, and Niclas Schlopsna’s own Substack. The mailing itself, the record of your subscription and the unsubscribe mechanism are all handled by Substack, which records whether emails are opened and whether links are clicked. If that endpoint is unavailable, the footer form falls back to opening Substack’s own signup page in a new tab, and on the contact form your answer simply reaches us as a line on the enquiry.

Legal basis: Art. 6(1)(a) GDPR, your consent, which you may withdraw at any time using the unsubscribe link in any issue or by writing to us. Processor: Substack Inc., United States.

2.5 Embedded media

Video on this site plays from YouTube (Google Ireland Ltd.). Every YouTube frame is held back before it can load: the frame is taken out of the page and a plate you can press is put in its place, and no request leaves your browser until you press it or allow embedded media in the cookie notice. Pressing one plate loads that one video and does not change your stored answer. Once a frame does load, Google receives your IP address and can set cookies under its own privacy policy. Podcast links to Spotify (Spotify AB) are plain links: nothing is embedded and nothing is loaded until you follow one.

Legal basis: Art. 6(1)(a) GDPR, your consent, given either by pressing play on a single video or by allowing embedded media in the cookie notice.

2.6 Fonts, badges and links off this site

Typefaces are served from our own domain, so loading a page sends nothing to Google or any other font host. The review badge is a plain link to Clutch and loads nothing until you click it. The “Summarise this page with” controls in the footer are ordinary links too: they open ChatGPT, Claude or Perplexity with this page’s address and a question already typed into the box, and they carry nothing about you.

2.7 Mandate data

In the course of an engagement we process the information you provide about your company or fund, its financials, its shareholders and its transaction history, together with the contact details of the people involved. We disclose it to counterparties only in the form and to the extent you have approved, and normally only under a signed non-disclosure agreement.

Legal basis: Art. 6(1)(b) GDPR for the performance of our engagement, and Art. 6(1)(c) GDPR where we are subject to statutory obligations, including anti-money-laundering identification under the GwG. Retention: for the duration of the engagement and thereafter for the statutory retention periods described in 2.2.

2.8 The calculators

The four calculators work entirely inside your browser. The figures you type are not sent anywhere, are not stored anywhere, and do not reach us: closing or reloading the page clears them, and we never learn that you opened one unless you have allowed measurement, which counts the page and not what you typed into it. Until recently these were embedded from another provider, which did receive a request from your browser whenever one was opened. They no longer are.

3. Cookies

Short section. Nothing optional loads until you say so, and you can read your own answer back, and change it, at the end of this section.

Until you answer the cookie notice, this website sets no cookies at all and contains no tracking pixels. Your answer itself is not a cookie either; it is described in the next paragraph. If you allow measurement, Google Analytics 4 and Google Tag Manager are loaded and set their own cookies; section 2.3 says what they record and what is switched off. If you refuse, neither is loaded and no request reaches Google. We run no advertising or profiling tags either way. Cookies may also be set inside a YouTube frame once you load one, under Google’s own policy; that is the only frame on this site. Legal basis: Art. 6(1)(a) GDPR, your consent, which you may withdraw at any time below with effect for the future.

Two things can be kept on your device by this site and nothing else is. Your answer to the cookie notice, with the date and time you gave it, is held in your browser’s local storage under spectup.consent.v1. If you close the notice without answering, a note under spectup.consent.dismissed is kept for the rest of that one visit, so that the notice does not ask again on every page you open; it records no choice, allows nothing, and goes when you close the browser. Neither is a cookie and neither is ever transmitted to us. Until you allow embedded media, no request reaches YouTube or any other embed provider: the frame is replaced by a plate and nothing is loaded behind it. Closing the notice without choosing is not consent and leaves everything off; clearing your browser data has the same effect and the notice asks again.

4. Transfers outside the EEA

Some of our tools are American. Here is the legal footing for that.

Some of the providers named above are established in the United States or process data there, specifically Substack, FormSubmit and Google. Where a transfer to a third country takes place it is made on the basis of the European Commission’s adequacy decision for the EU–US Data Privacy Framework where the provider is certified under it, or otherwise on the basis of the Standard Contractual Clauses under Art. 46(2)(c) GDPR, in each case with supplementary measures where required. You may request a copy of the safeguards in place from the address in section 1.

5. Recipients and processors

Who else sees any of it, and under what agreement.

We pass personal data to third parties only where it is necessary, where you have consented, or where we are legally obliged to. Processors act only on our instructions under an agreement satisfying Art. 28 GDPR. The categories of recipient are our hosting provider, the form service named above, the newsletter platform, the measurement provider if you have allowed measurement, our tax adviser and, where required, public authorities and courts.

6. Your rights

Seven things you can demand of us. One email is enough, and we reply within a month.

You have the right to obtain confirmation as to whether we process your personal data and to receive a copy of it (Art. 15), to have inaccurate data corrected (Art. 16), to have data erased (Art. 17), to obtain restriction of processing (Art. 18), to receive your data in a portable format (Art. 20), and to object to processing based on legitimate interests (Art. 21). Where processing rests on your consent you may withdraw it at any time with effect for the future (Art. 7(3)); withdrawal does not affect the lawfulness of processing already carried out.

To exercise any of these rights, write to hi@spectup.com. We will respond within one month.

7. Right to complain

If we get it wrong, this is who you tell.

You may lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence or place of work. The authority competent for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 27, 91522 Ansbach, Germany.

8. Obligation to provide data

Nothing here is compulsory, but we cannot answer an empty form.

You are not obliged to give us any personal data. Fields marked as required in the contact form are, however, necessary for us to reply, and we cannot carry out an engagement without the information described in section 2.7.

9. Automated decision-making

No algorithm decides anything about you here. A partner reads your enquiry.

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

10. Children

This is a site about capital markets. It is not for kids.

Our services are directed at businesses and institutional investors. They are not intended for children, and we do not knowingly collect personal data from anyone under 16.

11. Security

What we actually do to keep a mandate confidential.

This site is served over TLS. We apply appropriate technical and organisational measures under Art. 32 GDPR, including encryption in transit, access control on a need-to-know basis, and confidentiality undertakings from everyone who works on a mandate.

12. Changes

If this page changes, the date at the top changes with it.

We will update this policy when our processing or the law changes. The version in force is the one published here, dated at the top of the page.