Privacy Notice

1. Data Controller

Nolimit Capital OÜ operates and maintains this public website and determines the purposes and means of the personal-data processing described in this Privacy Notice. It therefore acts as the data controller in respect of such processing.

Estcap Asset Management OÜ is referred to on the website solely in its capacity as the Fund Manager. It is not the operator of this public website and is not the controller of the processing described in this Privacy Notice.

2. Scope of This Notice

This Privacy Notice covers personal data processed in connection with:

• visiting valuera.nolimit.capital;
• technical delivery, operation and security of the public website; and
• factual, administrative or legal-structure correspondence sent to valuera@nolimit.capital.

It does not cover the separate MyNoLimit investor portal at my.nolimit.capital or the authentication service at auth.nolimit.capital. Those services are governed by separate legal and privacy information based on their own processing activities.

3. Data Processed When You Visit the Website

The website does not use analytics, advertising trackers, marketing pixels, public forms or newsletter tools.

When the website is accessed, technical data may be processed by the website infrastructure and security providers, including where applicable:

• IP address;
• date and time of the request;
• requested URL/resource;
• HTTP response status;
• browser and device/request metadata such as user-agent information;
• referrer information where transmitted by the browser;
• network, proxy and security-event information necessary to deliver and protect the website.

At the Valuera website origin, normal nginx access logging is disabled and Traefik access logging is disabled. Nolimit Capital OÜ therefore does not maintain a general visitor access history in the website’s origin server logs. Limited diagnostic information may still be processed where necessary for technical errors or security incidents.

4. Purposes and Legal Basis

Technical website data is processed where necessary to:

• deliver the website;
• maintain availability and technical stability;
• protect the website and infrastructure against abuse, attacks and unauthorised access;
• diagnose technical faults; and
• investigate security incidents where necessary.

The primary legal basis is Article 6(1)(f) GDPR – the legitimate interests of Nolimit Capital OÜ in operating, securing and maintaining the public website and related infrastructure.

Where processing is necessary to comply with a legal obligation, Article 6(1)(c) GDPR may also apply.

5. Email Contact

If you contact valuera@nolimit.capital, Nolimit Capital OÜ may process:

• your name;
• your email address;
• the content of your message; and
• any other information you choose to include.

The public contact address is intended only for factual, administrative and legal-structure enquiries. Investment, subscription and onboarding enquiries are not accepted through this website or contact address.

Correspondence is processed on the basis of Nolimit Capital OÜ’s legitimate interest in responding to appropriate factual, administrative and legal enquiries under Article 6(1)(f) GDPR and, where applicable, to comply with legal obligations under Article 6(1)(c) GDPR.

Please do not send unnecessary sensitive personal data through this public contact address.

Providing personal data by email is voluntary. You are not legally or contractually required to contact Nolimit Capital OÜ through this address. If you do not provide sufficient contact information, Nolimit Capital OÜ may be unable to respond to your enquiry.

6. Service Providers / Recipients

The current public website infrastructure uses the following service providers/functions:

These providers may process personal data on behalf of or in connection with Nolimit Capital OÜ to the extent necessary to provide their services.

7. International Data Transfers

The Valuera VPS itself is located in Frankfurt, Germany. Hostinger International Ltd. is established in Cyprus. Where Hostinger transfers Customer Data outside the EEA to a country without an adequacy decision, its Data Processing Addendum provides for the applicable EU Standard Contractual Clauses, including Module Two for controller-to-processor transfers.

Cloudflare, Inc. is established in the United States and operates a global network. Cloudflare’s Data Processing Addendum identifies Nolimit Capital OÜ as controller and Cloudflare as processor for the relevant service data. For restricted transfers of EU personal data to Cloudflare or its sub-processors, the EU Standard Contractual Clauses apply; Module Two applies where Nolimit Capital OÜ acts as controller.

Zoho Corporation B.V. is established in the Netherlands and provides the EU data-center environment used for the Zoho Mail EU service. Zoho states that EU service data is stored within the EU. In limited support scenarios, service data may be accessed from India; Zoho states that such access is governed by SCC-based intra-group arrangements and supplementary transfer safeguards.

Where personal data is otherwise transferred outside the EEA, the applicable transfer mechanism and safeguards must comply with the GDPR.

8. Cookies and Similar Technologies

The public website does not use analytics or marketing cookies and does not use advertising trackers.

Cloudflare Web Analytics / Real User Measurements (RUM) is disabled for the configured Cloudflare Web Analytics site, and the active Valuera website contains no analytics JavaScript. Cloudflare security functionality may still use strictly necessary technical cookies or similar mechanisms where required to provide security or challenge functionality.

No consent-based analytics or marketing cookies are used in the current Public V1.

The reviewed Cloudflare configuration contains no custom security rules or rate-limiting rules, Bot Fight Mode is disabled, and Cloudflare Web Analytics / RUM is disabled. No non-essential analytics or marketing functionality has been identified for the current Public V1.

9. Retention

Normal Valuera access logging is disabled at nginx, and Traefik access logging is also disabled. Limited nginx warning/error output may be captured by the Valuera container’s Docker logging only where diagnostic information is generated.

The Valuera container uses Docker json-file logging for diagnostic stdout/stderr with explicit size-based limits of max-size 1 MB and max-file 2. These limits bound diagnostic storage but do not constitute a fixed time-based retention period; low-volume diagnostic records may remain until rotation or container replacement.

Diagnostic retention at the Valuera origin is determined by the size-based rotation limits described above and by the container lifecycle. Known internal/project backups do not copy Docker container-log directories, and the Valuera service has no persistent volumes.

The Hostinger VPS is backed up weekly as a full VPS backup. Hostinger retains two weekly VPS backups at a time, with each new weekly backup replacing the oldest. Because these backups capture the VPS state as a whole, limited diagnostic files present on the VPS at backup time can also be included in the provider backup.

Email correspondence is retained only for as long as reasonably necessary for the purpose of the correspondence and any applicable legal, compliance or record-keeping requirements.

10. Automated Decision-Making

The public website does not use personal data for automated investment decisions, profiling or automated investor eligibility decisions.

11. Your Rights

Subject to the conditions and limitations of the GDPR, you may have the right to:

• obtain access to your personal data;
• request correction of inaccurate data;
• request erasure;
• request restriction of processing;
• object to processing based on legitimate interests;
• lodge a complaint with the competent supervisory authority.

In Estonia, the data-protection supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

Requests relating to this public website may be sent to valuera@nolimit.capital.

12. Changes to This Notice

This Privacy Notice may be updated where the website infrastructure, processing activities or legal requirements change. The current version should be published with its effective date.