This Privacy Notice explains how Lilly Capital AG (“we”, “us”) collects and processes personal data, for which purposes, with whom we share it and which rights you have. It covers in particular the use of our website, communication with us and the submission of investment proposals through our website.
This Privacy Notice is based on the Swiss Federal Act on Data Protection (FADP). Where the EU General Data Protection Regulation (GDPR) applies, for example because you submit a proposal from the European Union, this Privacy Notice also serves as information under the GDPR.
The controller responsible for the processing described in this Privacy Notice is:
Lilly Capital AG
Giessenstrasse 5b
8835 Feusisberg
Switzerland
datenschutz@lilly-capital.ch
This Privacy Notice applies to all persons whose personal data we process, regardless of how they contact us. In particular, this includes:
• visitors to our website;
• founders, team members and other contact persons of companies that submit an investment proposal to us or that we approach;
• contact persons at portfolio companies, co-investors, partners and service providers;
• persons who contact us by e-mail, telephone, form or social media;
• recipients of information they have requested from us;
• participants in our events;
• job applicants.
If you provide us with personal data about other persons, for example members of your founding team, please make sure that these persons are informed about this Privacy Notice.
Name, e-mail address, telephone number, postal address, role or function, company and links to professional profiles (e.g. LinkedIn).
The content of e-mails, messages, letters, calls and video conferences with us, together with details on the type, time and channel of the communication.
When you submit an investment proposal through our website or otherwise, we process the information you provide, in particular:
• details of the company or project, such as name, industry, location, website, stage, valuation and the amount to be raised;
• your contribution to the Sustainable Development Goals;
• information on the founders and team, such as names, roles, contact details and professional background;
• how you learned about us or who referred you;
• your pitch deck and any other documents you upload, including the personal data they contain;
• our internal notes and assessments of your proposal.
When you use our website, we process technical data such as your IP address, information about your device and browser, the time of access and log files. When you submit a form, we also record the date, time, page and IP address of the submission. Further details are provided in our Cookie Notice.
If you register for one of our events, we process your registration details.
We mainly receive personal data directly from you, for example when you submit an investment proposal, write to us or register for an event. Providing personal data is voluntary. Without certain information, however, we cannot assess your proposal or respond to your request.
In connection with investment proposals, we may also obtain information from publicly available sources, such as company websites, professional networks, media and commercial registers, as well as from persons who refer you to us or from co-investors.
To answer inquiries, to contact you and to maintain our business relationships.
To receive, review and assess investment proposals, to decide whether to pursue a proposal, to conduct due diligence, to prepare and carry out an investment and to keep a record of the proposals we have received. As part of this assessment, we use AI-supported tools for an initial screening (see section 7).
To send you information you have requested and to organise events.
To ensure the security of our website and IT systems, to prevent spam, fraud and misuse, and for evidentiary purposes.
To comply with legal and regulatory obligations and for our internal administration, accounting and risk management.
We receive a large number of investment proposals. To review them efficiently, we use an AI language model (Claude, provided by Anthropic) for an initial screening. The model receives the information from the submission form and, if provided, the pitch deck, and returns a short summary and a preliminary assessment of how well the proposal matches our investment criteria.
• The screening only supports our team. Every decision on whether to pursue a proposal is made by a person at Lilly Capital. There is no automated individual decision within the meaning of Art. 21 FADP or Art. 22 GDPR.
• We use the provider’s business service. Under its commercial terms, the content we submit is not used to train its models.
• Please do not submit information that is subject to a non-disclosure agreement or that you do not want to be processed in this way. If you have concerns, contact us before submitting, and we will review your proposal without AI support.
Under the FADP, we process personal data in accordance with the principles of data protection law. Where the GDPR applies, we rely on the following legal bases:
• steps prior to entering into a contract, or the performance of a contract (Art. 6(1)(b) GDPR), in particular when we assess an investment proposal you have submitted;
• our legitimate interests (Art. 6(1)(f) GDPR), in particular in assessing investment opportunities efficiently, in communicating with you, and in the security of our systems;
• your consent (Art. 6(1)(a) GDPR), where we ask for it. You may withdraw consent at any time with effect for the future;
• compliance with legal obligations (Art. 6(1)(c) GDPR).
We use service providers who process personal data on our behalf and in accordance with our instructions. The most important are:
• Microsoft (Microsoft 365, Power Automate): e-mail, document storage and processing of form submissions; Switzerland and EEA, individual services may involve the USA;
• Website hosting provider: website hosting; Switzerland;
• Google (reCAPTCHA): spam protection on our forms; USA;
• Anthropic (Claude): AI-supported initial screening of investment proposals; USA.
In addition, we may disclose personal data to:
• co-investors and syndicate partners, if we consider pursuing an investment together and only to the extent necessary; we will inform you before we share your pitch deck;
• advisers such as lawyers, auditors and tax advisers, who are bound by professional secrecy;
• authorities and courts, where we are legally obliged or entitled to do so.
We do not sell personal data.
We process personal data mainly in Switzerland and the European Economic Area (EEA). Some of the service providers listed in section 9 process personal data in the United States of America.
For these transfers we rely on the following safeguards:
• for recipients certified under the Swiss-U.S. and EU-U.S. Data Privacy Framework, the adequacy decisions of the Swiss Federal Council and the European Commission;
• otherwise, the standard contractual clauses recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC) and adopted by the European Commission.
Transfers to Anthropic are based on the standard contractual clauses included in its data processing addendum. You can request a copy of the relevant safeguards using the contact details in section 2.
We do not request sensitive personal data, such as information on health, religious or political views, or criminal proceedings. Please do not include such data in your submission or pitch deck. If you do so voluntarily, we will only process it to the extent necessary for the assessment.
We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss and misuse. These include access controls and multi-factor authentication, encryption during transmission, role-based permissions, logging, backups and instructions to our staff. We also require our service providers to take appropriate security measures. No system is completely secure, and some residual risk always remains.
We keep personal data for as long as it is necessary for the purposes described in this Privacy Notice, for as long as we have a legitimate interest in keeping it (for example to establish, exercise or defend legal claims, or to recognise repeat submissions), and for as long as Swiss law requires. For example, business records and correspondence relevant to business are retained for ten years in accordance with the Swiss Code of Obligations.
Once these reasons no longer apply, we delete or anonymise the data.
Subject to the applicable legal requirements, you have the right to:
• request information about the personal data we process about you;
• have incorrect or incomplete data corrected;
• request the deletion of your data;
• object to processing based on our legitimate interests, including the AI-supported screening described in section 7;
• request that processing be restricted (GDPR);
• receive certain data in a structured, commonly used format (data portability);
• withdraw your consent at any time with effect for the future.
To exercise your rights, contact us at datenschutz@lilly-capital.ch. We may ask you to verify your identity.
You also have the right to lodge a complaint with a supervisory authority: in Switzerland, the Federal Data Protection and Information Commissioner (edoeb.admin.ch); in the EU, the authority in your country of residence.
Information on cookies and analytics tools on our website is provided in our Cookie Notice.
Our forms are protected against spam and abuse by Google reCAPTCHA v3, a service of Google Ireland Limited and Google LLC. reCAPTCHA analyses information such as your IP address, browser data and behaviour on the page to distinguish humans from automated programs. This data may be transferred to Google in the USA. We use reCAPTCHA based on our legitimate interest in protecting our website. Google’s Privacy Policy and Terms of Service apply.
We may update this Privacy Notice, in particular when our data processing changes or new legal requirements apply. The version published on our website applies.
Version 2.0, 19 October 2026