Privacy

Privacy notice

This notice explains how Secondex handles information submitted through its website, including the Institutional Perspectives Questionnaire (IPQ).

Who is responsible

The controller is Secondex OÜ, Estonian registry code 17480257, registered at Juhkentali tn 8, 10132 Tallinn, Estonia. For privacy requests, contact info@secondex.tech.

What information may be collected

Website forms may receive your name, business contact details, organisation, role and the message or answers you choose to provide. The IPQ requires your full name, position or job title, and corporate/professional email address, along with your role category. Questions 2–5 and the additional role-specific questions are optional. Common personal and disposable email domains are screened out in the browser. The separate follow-up request is optional and unticked by default. Newsletter subscription is a separate action and is not inferred from an IPQ response.

Do not provide confidential transaction information, personal borrower information, non-public bids or prices, or documents in a public form. Netlify Forms receives and stores the IPQ fields you submit. A submission record also includes the source IP address and the time Netlify received the submission. These metadata can relate to you and are included in the raw submission covered by the 180-day limit below. Netlify may also process other technical information associated with a website request under its service terms. Netlify states that its services may process data outside the country where it was collected, including in the United States. Netlify publishes a list of subprocessors and transfer information; its current list includes US-based cloud infrastructure and spam-filtering providers. The exact storage location for an individual submission and any backup-copy deletion timing are not specified here.

How information is used

IPQ responses and the required professional contact details are used for internal institutional private-credit liquidity research and to understand the professional context of responses. Research outputs are aggregated and anonymised; names, job titles and email addresses are not included in those outputs. If you tick the separate follow-up request, Secondex may contact you specifically about your answers. That request is not permission for marketing or a newsletter subscription. An IPQ response does not itself create a mandate, transaction instruction, verified fact, institution relationship or commercial opportunity.

The IPQ is stored in Netlify Forms only. It does not call the SECONDEX API and is not copied to canonical Inbound or Discovery records. No IPQ response is automatically sent to an AI provider.

Legal basis

For IPQ answers and the required professional contact details, Secondex relies on its legitimate interest under Article 6(1)(f) GDPR in understanding institutional private-credit liquidity from a professional institutional perspective. Contact details are used to provide professional context and quality control for research responses; the domain check is not identity or employment verification. The processing is limited by optional research answers, internal-only aggregated/anonymised outputs, no marketing, no automatic commercial records, no external AI processing, and a 180-day maximum raw-response period. The updated necessity and balancing assessment is documented in the accompanying IPQ legitimate-interests assessment.

If you tick the separate follow-up request, the lawful basis for using the contact details to contact you about your answers is your consent under Article 6(1)(a) GDPR. You can withdraw that permission at any time by contacting info@secondex.tech. Withdrawal does not affect processing before withdrawal. No other marketing consent is requested or inferred.

Service providers and transfers

Netlify, Inc. provides the website hosting and Netlify Forms service and processes IPQ submissions for Secondex. Netlify’s self-serve subscription agreement and Data Processing Agreement are published online; the DPA forms part of that agreement where applicable. Netlify states that data may be processed outside the collection country, including in the United States, and describes transfer mechanisms including Standard Contractual Clauses and the EU-US Data Privacy Framework where applicable. Netlify publishes its current subprocessor list. The Secondex Netlify team is on the Free plan, has one team member, and has no form-submission webhook configured. Netlify Forms does not copy IPQ submissions into the SECONDEX API, Inbound or Discovery. Netlify Forms applies its built-in spam filtering, and the IPQ form includes a Netlify honeypot field. These are spam controls, not identity or employment verification. The website also links to Calendly; if you make a separate booking, Calendly processes information under its own terms. If you request IPQ follow-up, Secondex may use the contact details you provide to reply.

Retention

The raw IPQ submission record—including answers, any contact details you choose to provide, the source IP address and receipt time shown in Netlify Forms—is kept for no more than 180 days, subject to an overriding legal obligation. The Founder is responsible for reviewing and manually deleting each submission before it reaches that limit; Netlify automatic expiry is not configured or claimed. Netlify provides a dashboard operation to permanently delete an individual form submission. This describes deletion from the submissions interface; it does not make a claim about the timing of deletion from provider backups or other systems.

Your choices and rights

You may leave IPQ questions 2–5 and the additional role-specific questions empty. Full name, job title, corporate/professional email and role category are required to submit. Depending on applicable law, you may have rights to access, correct, delete, restrict or object to processing, receive a copy, withdraw consent where consent is used, or complain to a supervisory authority. Some rights have limits and exceptions. Contact info@secondex.tech to make a privacy request.

Security

Questionnaire responses are intended for restricted human review. The Netlify project is private and the current Netlify team has one member. Access to submissions is through that account. Do not send confidential material through public website forms. No absolute security guarantee is made.

Privacy notice version 1.4 · 3 November 2026. The 180-day limit and Founder-controlled deletion apply to raw IPQ submissions and are subject to applicable mandatory retention obligations.