Privacy policy

01 / Who is responsible

RunwayFBU Fund Management AS is the data controller.

RunwayFBU Fund Management AS is the data controller for personal data collected through runway.vc and processed in the course of managing the funds it operates. Everything in this policy is written under Norwegian law and the EU General Data Protection Regulation.

For any question about this policy, or to exercise any of the rights in section 08, write to us at that address.

02 / The RunwayFBU group

We operate as one group across the Tech Hub and the fund.

RunwayVC sits inside the wider RunwayFBU group, alongside RunwayFBU AS, the company behind the Tech Hub and the AI and Robotics Lab. The two companies share people, systems and back-office functions, and run their operations together.

Personal data therefore moves in both directions. Data that RunwayFBU Fund Management AS receives, including anything you submit through this website, may also be processed and used by RunwayFBU AS. Data that RunwayFBU AS holds, including Tech Hub and Lab contacts, may likewise be processed and used by RunwayFBU Fund Management AS. We use it across the group for our combined operations: running the Tech Hub and the Lab, and sourcing, assessing and supporting venture investments.

Personal data may also be handled by the fund vehicles the manager operates and by other companies within the RunwayFBU group, where running the group requires it. They are registered at the same address and bound by the same internal agreements. We will name them on request.

The two companies take different roles depending on the purpose. Where RunwayFBU AS handles data purely on our instructions, for example shared IT and back-office administration, it acts as our data processor under a data processing agreement. Where each company uses the data for its own operations, each is a controller in its own right for that use. Sharing between the two rests on the legitimate interests of the group under Art. 6.1.f, and is limited to what running those operations requires.

03 / What we collect and why

Purpose, legal basis, data and retention.

The table below sets out what we process, why, on what legal basis under Article 6 of the GDPR, and how long we keep it after our last interaction with you.

Art. 6.1.a consent. Art. 6.1.b performance of a contract or steps taken at your request before entering one. Art. 6.1.c compliance with a legal obligation. Art. 6.1.f our legitimate interests in running an investment business, where those interests are not overridden by your rights.

04 / Where the data comes from

Almost all of it comes from you.

Most of the personal data we hold is data you have given us yourself: a pitch submitted through this site, an email, a meeting, a newsletter signup, or an investor onboarding process.

We also collect a limited amount from other sources where it is necessary to do our work:

• Public registers such as the Norwegian Register of Business Enterprises, for company and board information.
• Public sources such as company websites, LinkedIn and press coverage, when we research a company or a founder.
• Public organisations that request or provide data in order to deliver services we are required to deliver.
• Introductions from co-investors, advisors or portfolio founders who share your contact details with us.
• RunwayFBU AS, where you are already known to the Tech Hub or the AI and Robotics Lab, as set out in section 02.

We use no more data than is strictly necessary to carry out our work.

05 / Who we share it with

Suppliers who need it, and nobody else.

We do not sell personal data and we do not share it for advertising. We share it with suppliers who need it to carry out their duties towards you or towards us, and with public organisations that request lawful access. In every case the data is covered by a data processing agreement.

• RunwayFBU AS, for shared staff, systems and combined group operations, as set out in section 02.
• Pipedrive, our CRM, where pitches and deal-flow contacts are recorded.
• Railway, our hosting and infrastructure provider, which runs this website and stores pitch submissions in an EU region.
• Plausible Analytics, EU-hosted and cookieless, for aggregate website statistics.
• Microsoft 365, for email, file storage and productivity.
• Our accountants, auditors and legal advisors, where their work requires it.
• Co-investors and advisors involved in a specific transaction, under confidentiality.

Where a supplier transfers data outside the EEA and this is necessary to deliver the service, the transfer is secured with the European Commission Standard Contractual Clauses. A current list of our processors is available on request.

06 / Cookies and analytics

No cookies, cookieless analytics.

runway.vc sets no cookies at all. No advertising cookies, no cross-site tracking, no third-party profiling and no functional cookies either.

We measure how the site is used with Plausible Analytics, a privacy-focused, EU-hosted service. Plausible sets no cookies, stores no IP addresses, and builds no profile of you across sites or visits. It records aggregate counts only: page views, referring site, country, and device type. Requests are proxied through runway.vc rather than sent to a third-party domain. The legal basis is our legitimate interest in understanding how the site performs, and because no personal data is stored, no consent banner is required.

Our servers keep standard request logs, including IP addresses, to operate the site and defend it against abuse. Those logs are covered by the website row in the table above.

07 / Security and retention

Access is limited, storage is time-boxed.

Personal data is held on access-controlled systems, restricted to the people across the group who need it for their role. Pitch submissions are written to a dedicated storage volume in an EU region of our hosting infrastructure before they reach any downstream system, so a failure further down the chain never loses your submission. We have secured your personal data through data processing agreements with every supplier that touches it.

The retention periods in the table run from our last interaction with you. Our standard period is ten years, which reflects how long a venture relationship stays live: a founder we meet early may raise from us years later, and portfolio and investor records have to survive the full life of a fund.

Where the law sets a different period, the law wins. Two categories run on a shorter five-year clock rather than our ten-year default:

• Identity and anti-money-laundering checks. Norwegian anti-money-laundering law requires customer due diligence records to be deleted five years after a customer relationship ends. Identity documentation is removed on that clock even where the surrounding investor records are kept longer.
• Accounting. The Norwegian Bookkeeping Act sets five years for primary accounting records. We keep them for that period and no longer.

If you ask us to delete your data and a legal duty stands in the way, we will tell you which one it is and when it lapses.

08 / Your rights

You decide what happens to your data.

Data privacy law gives you the rights below. Where we collected your data with your consent, you may withdraw that consent at any time. Email hello@runway.vc to make any of these requests. We will respond within one month.

09 / Complaints

Datatilsynet is your escalation route.

If you are not satisfied with how we handle your personal data, tell us first and we will try to put it right. You also have the right to complain to the Norwegian Data Protection Authority, Datatilsynet.

10 / Changes to this policy

We update this page when our processing changes.

We review this policy at least annually and whenever we change how we process personal data. The date at the top of the page shows when it was last updated. Material changes affecting people we already hold data on will be communicated directly.