Privacy Statement Two Rivers Capital
Version: November 2026
1. Who we are
Two Rivers Capital B.V. ("Two Rivers", "we") is responsible for the processing of personal data through the website www.tworivers.capital. We have our registered office in Amsterdam, with offices at Willemsparkweg 31, 1071 GP Amsterdam, and are registered with the Chamber of Commerce under number 97459151.
This statement explains which data we process through the website, why, on what legal basis, with whom we share it, how long we keep it and what rights you have. We process data of investors in our funds in our investor administration; we inform investors about this separately.
2. Requesting the brochure
What data
- name and email address;
- phone number, if you enter it;
- the amount you are considering, if you select it;
- the language of the page (Dutch or English);
- the page on which you filled in the form and, if you arrived through an advertisement or link, the campaign data in that link (source, medium and campaign);
- date and time of the request and whether you ticked the box for email updates.
What we do with it
- Your request is stored in our website and emailed to Two Rivers.
- We add your name, email address and language to Mailchimp. Through Mailchimp you receive the brochure email with a link to the brochure. If that fails, our website sends that email.
- We contact you about your request: by email or, if you enter your phone number, by phone.
- We use the amount to tailor our follow-up to your situation.
- We use the page and campaign data to measure which channels, such as an advertisement, lead to requests.
- Without the box for email updates, we send you no emails through Mailchimp after the brochure email.
Legal basis. The processing is necessary to take steps at your request before a possible agreement is entered into (Article 6(1)(b) GDPR). For the follow-up and for measuring where requests come from, we rely on our legitimate interest (Article 6(1)(f) GDPR): informing interested parties about our funds and knowing which channels work. You may object to this.
Retention period. 24 months after the last contact, also in Mailchimp. If you become an investor, we include your data in our investor administration and the statutory retention periods that apply to it.
The form is protected against spam with a hidden field and a time check.
3. Reading the brochure through DocSend
The brochure is hosted on DocSend (Dropbox, Inc., United States), our processor.
- Data: when you open the brochure, DocSend asks for your email address. DocSend then records which pages you view and for how long, whether you download the brochure, and technical data such as your IP address, approximate location, device and browser.
- Purpose: this shows us which parts of the brochure interest you, so we can tailor our contact with you.
- Legal basis: our legitimate interest (Article 6(1)(f) GDPR). You may object to this.
- Cookies: on the DocSend website, DocSend's own privacy and cookie policy also applies.
- Retention period: 24 months after the last contact.
4. Email updates about Two Rivers and the Clusterfunds
Below the form there is a separate box: "Keep me informed by email about Two Rivers and the Clusterfunds." The box is not ticked in advance. Only if you tick it do we send you email updates: first a short series of emails about Clusterfonds II, then our periodic update about Two Rivers, for example about the progress of the funds, events and publications.
- Data: name, email address, language, amount (if entered) and the record of your consent (date, time and page).
- Legal basis: your consent (Article 6(1)(a) GDPR and Article 11.7 of the Dutch Telecommunications Act).
- Unsubscribe: at any time via the unsubscribe link at the bottom of every email, or by emailing us. Withdrawing consent does not affect processing before that moment.
- Sending: through Mailchimp (Intuit Mailchimp, United States), our processor. Mailchimp records whether you open an email and which links you click. This shows us what interests our readers.
- Retention period: as long as you are subscribed. After you unsubscribe, we keep only your email address, the unsubscription and the record of consent, so that we do not email you again and can show that we had your consent.
5. Email course on private equity
On our website you can sign up for an email course on private equity. You then receive one part each week.
- Data: first name, email address, the page on which you signed up and the date and time of signing up.
- Legal basis: your consent (Article 6(1)(a) GDPR and Article 11.7 of the Dutch Telecommunications Act). We use your sign-up only for the course.
- Sending and unsubscribing: through Mailchimp, as in section 4. You can unsubscribe with the link at the bottom of every email.
- Retention period: as in section 4.
6. Booking an introductory call through Calendly
On the page "Book an introductory call" you can schedule a call with Denzell Melles yourself. We use Calendly (Calendly LLC, United States), our processor, for this.
- Data: name, email address and the time you choose. Calendly sends you a confirmation and reminders. If you choose an online call, it takes place through Microsoft Teams.
- Legal basis: your request (Article 6(1)(b) GDPR).
- Cookies: the calendar loads in the page after you accept the cookies needed for it. You can also open the calendar in a new window on the Calendly website, where Calendly's privacy policy also applies.
- Retention period: 24 months after the last contact.
7. Contact by email, phone or contact form
If you email or call us, we use your data to answer your question. Fund managers can send us a message through the contact form on the page for fund managers. We then process your name, email address, organisation and message; the message is stored in our website and sent to Two Rivers by email. Our email runs through Microsoft 365. Legal basis: your request if it concerns a possible investment, otherwise our legitimate interest in answering questions. Retention period: 24 months after the last contact, unless you become an investor.
8. Visiting the website: hosting, Cloudflare and security
- Hosting and management: the website and form submissions are stored by our hosting provider on servers in the Netherlands. The hosting provider and our website administrator are our processors.
- Log files: each visit involves technical data, such as IP address, date and time, the requested page and browser type. This is necessary to display and secure the website (legitimate interest). Log files are kept no longer than needed for security and for resolving technical problems.
- Cloudflare (Cloudflare, Inc., United States) delivers the website through a network of servers and protects it against abuse and attacks. For this, Cloudflare processes your IP address and technical data of your request and may place a functional security cookie. Legal basis: our legitimate interest in a fast and secure website. Cloudflare is our processor.
9. Cookies, statistics and map
Cookie banner (Complianz). On your first visit we ask for your choice per category: functional, preferences, statistics and marketing. Functional cookies are always active; for the other categories we ask for consent. Complianz is software on our own website and stores your choice in a cookie on your device. You can change your choice at any time via "Cookie settings" at the bottom of every page. All cookies are listed in our cookie policy.
Google Analytics 4. We use Google Analytics 4 (Google Ireland Limited) to measure how the website is used, for example which pages are visited and how many requests a campaign generates.
- Google Analytics loads only after you consent to statistics. Without that consent, no data is sent to Google.
- According to Google, Google Analytics 4 does not store IP addresses. For visitors from the EU, Google uses the IP address only to determine an approximate location and then deletes it.
- We do not share Analytics data with Google for advertising purposes; Google Signals and data sharing are switched off.
- Legal basis: your consent (Article 6(1)(a) GDPR and Article 11.7a of the Dutch Telecommunications Act). Retention period: 14 months.
Google Maps. The contact page contains a Google Maps map (Google Ireland Limited). The map loads only after you have given consent. When it loads, Google receives your IP address, among other data, and may place cookies; Google uses this data under its own privacy policy. Legal basis: your consent.
No advertising cookies. We do not place advertising or retargeting cookies. If we start doing so, it will only be with your consent and we will update this statement beforehand.
10. With whom we share data
We do not sell your data. We share data only with:
- our processors: the hosting provider, our website administrator, Cloudflare, Mailchimp, DocSend, Calendly, Microsoft and Google (Analytics). We enter into a data processing agreement with each processor;
- Google, if you load the Google Maps map;
- authorities to which we are required by law to provide data.
11. Transfers outside the European Economic Area
Mailchimp, DocSend, Calendly and Cloudflare are based in the United States; Google and Microsoft may transfer data to their parent company in the United States. These transfers take place on the basis of the EU-US Data Privacy Framework or on the basis of the standard contractual clauses of the European Commission.
12. Retention periods
- Brochure request, DocSend, Calendly and contact by email, phone or contact form: 24 months after the last contact.
- Investors: for the duration of the relationship and thereafter in line with statutory retention periods.
- Email updates and email course: until you unsubscribe; thereafter only email address, unsubscription and record of consent.
- Google Analytics: 14 months.
- Log files: no longer than needed for security and for resolving technical problems.
- Cookies: see the cookie policy.
13. Security
We protect your data with appropriate technical and organisational measures, including an encrypted connection (https), protection through Cloudflare and access to submissions only for staff who need it for their work.
14. Your rights
You have the right to:
- access your data;
- have incorrect data corrected;
- have your data deleted;
- have the processing restricted;
- receive your data in a common format or have it transferred to another party;
- object to processing based on legitimate interest; you can always object to emails with information about our funds;
- withdraw your consent.
Send your request to info@tworivers.capital. We respond within one month. To prevent misuse, we may ask you to confirm your identity.
15. Complaints
If you are not satisfied with how we handle your data, please let us know. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens,www.autoriteitpersoonsgegevens.nl).
16. Changes
We update this statement when the website or the law changes. The version at the top shows when the statement was last changed.
17. Contact
Two Rivers Capital B.V.
Willemsparkweg 31, 1071 GP Amsterdam, the Netherlands
info@tworivers.capital, +31 (0)20 261 19 76
Chamber of Commerce 97459151