Privacy policy

Last updated: 15 October 2026 · Version 1.0

Tortuga S.A. ("Tortuga", "we", "us") is responsible for the personal data processed through this website, tortuga.estate. The site provides information about Tortuga to professional and qualified investors. It is not an offer or solicitation. We collect personal data in three cases: when you send it to us through the contact form or a product whitelist, when you accept analytics cookies, and to the limited extent needed to run and protect the site. Visit statistics are counted without cookies. The site and our records are hosted in the European Union. Where a provider handles data outside the EU, the transfer is covered by the safeguards described in section 6. We do not sell personal data. To exercise your rights or ask a question, write to contact@tortuga.estate.

1. Who is responsible for your data

2. What this policy covers

This policy covers the website tortuga.estate. It does not cover Tortuga Bay (bay.tortuga.estate), our access portal, or other websites we link to.

3. What we collect and why

Overview

3.1 Running and protecting the site

When you submit a form, our server uses your IP address and user agent (the technical description your browser sends) to limit how many submissions can come from one source. This protects the site from abuse. This information is held in server memory only and is not written to disk.

Our server also keeps technical logs for security and troubleshooting. They may include IP addresses. They never include the contents of forms. We keep them for up to 30 days.

Lawful basis: our legitimate interest in keeping the site secure and available (Article 6(1)(f) GDPR).

3.2 Contact form and emails to us

The contact form in the footer asks for your email address (required) and, optionally, your name, organisation, role and a message. With your submission we also record which form you used, that you ticked the consent box, the version of this policy you were shown, your IP address, your user agent and the page you sent it from.

Your submission is stored in our content management system (CMS) on our server in the EU. We use it only to answer your enquiry. If you write to contact@tortuga.estate directly, we process your email address and your message for the same purpose.

Lawful basis: for the form, your consent, given by ticking the box (Article 6(1)(a) GDPR). For emails you send us directly, our legitimate interest in answering them (Article 6(1)(f)). You can withdraw your consent or object at any time; we then delete your enquiry.

3.3 Product whitelist

"Join the whitelist" lets professional and qualified investors register interest in Native or T-Evergreen. Your entry is non-binding, and no offer is made through the whitelist.

What you give us

What we record with it

• The product you registered for.
• The time you ticked the declaration and the consent box, and the version of this policy you were shown.
• Only if you accepted analytics cookies: how you reached the site (campaign parameters, that is UTM source, medium and campaign, the referring site and the first page of your visit) and your PostHog ID (section 3.4).

Why. To gauge professional interest in the product and to contact you about it.

We keep one entry per email address and product. If you submit again for the same product, we update your existing entry.

Where it is kept. Your entry is stored in our CMS on our server in the EU, which is our system of record. Our server sends a copy to Airtable (Formagrid Inc., United States), which we use as our processor to follow up with you. See section 6 on this transfer.

Link to analytics. If you accepted analytics cookies, PostHog links your visits to your whitelist entry using the entry's internal ID. We do not send your name or email address to PostHog.

If you leave out required fields. We cannot record your entry without them.

Lawful basis. Your consent, given by ticking the consent box (Article 6(1)(a) GDPR). You can withdraw it at any time by writing to contact@tortuga.estate. We then delete your entry and every copy of it.

3.4 Analytics with cookies (PostHog), only if you accept

If you click "Accept" on our cookie banner, we use PostHog, EU Cloud (data hosted in Frankfurt), to understand how the site is used. If you click "Reject", or make no choice, PostHog does not run.

With your consent, PostHog records:

• the pages you view and your path through the site;
• these actions: deck opened, info pack opened, film played, "Request access" clicked, contact email address copied, a Learn track or lesson started or completed, a whitelist form opened or submitted (the product only, never the form contents);
• device and browser information;
• session recordings. In recordings every form input is masked, and the whitelist form is excluded entirely.

PostHog does not store your IP address.

If you join a whitelist after accepting, PostHog links your visits to your whitelist entry by its internal ID. Your name and email address are not sent to PostHog.

You can change your choice at any time through "Cookie settings" in the footer. Withdrawing consent stops PostHog and clears its storage from your browser. It does not affect processing that took place before. To have data already collected deleted, write to us (section 9).

Lawful basis: your consent (Article 6(1)(a) GDPR). Storing and reading cookies on your device also requires your consent under the Luxembourg rules on privacy in electronic communications.

3.5 Embedded film (YouTube)

Our film is embedded with YouTube's privacy-enhanced mode (youtube-nocookie.com). Nothing loads from YouTube until you press play. When you press play, your browser connects to Google, which receives your IP address and may store information on your device. Google is an independent controller for the playback, and its own privacy policy applies: https://policies.google.com/privacy.

3.6 Staff accounts

For people who edit or administer the site, the CMS stores their email address, name and role, and uses a session cookie while they are logged in. These accounts are for Tortuga staff only.

Lawful basis: our legitimate interest in controlling access to our systems (Article 6(1)(f) GDPR).

3.7 Visit statistics without cookies (Umami)

We count visits with Umami, an open-source statistics tool that runs on our own server in the EU (Frankfurt). No other company receives this data.

Umami sets no cookies and stores nothing on your device. It uses your IP address and browser details momentarily to determine your country and to tell visits apart. It does not store your IP address.

Umami records:

• pages visited, the referring site and campaign parameters (UTM);
• country and device type;
• these actions: deck opened, info pack opened, film played, "Request access" clicked, contact email address copied, a Learn track or lesson started or completed, a whitelist form opened or submitted (the product only, never the form contents), and your cookie choice.

Lawful basis: our legitimate interest in understanding how the site is used, by a method that does not track you across sites (Article 6(1)(f) GDPR). You can object at any time (section 9).

4. Cookies and browser storage

We use no advertising cookies, no third-party trackers and no Google Analytics. Fonts are served from our own server, so your browser makes no requests to Google Fonts. When you press play on the film, YouTube may store information on your device under Google's policy (section 3.5).

You can change your analytics choice at any time through "Cookie settings" in the footer. You can also delete cookies and site storage in your browser settings.

5. Who receives your data

We use these providers as processors. They act only on our instructions, under data processing agreements.

Within Tortuga, only team members who need the data for the purposes above can access it.

We may also disclose personal data where the law requires it, for example to a court or a public authority.

We do not sell personal data. We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects for you or similarly significant effects.

6. Transfers outside the European Union

Airtable. Whitelist entries are copied to Airtable, whose servers are in the United States. This transfer is covered by the Standard Contractual Clauses approved by the European Commission, which form part of our data processing agreement with Airtable.

Providers that host our data in the EU. AWS and PostHog store our data in Frankfurt. Both belong to groups headquartered in the United States. If either of them processes our data outside the EU, for example for support or through a sub-processor, the transfer is covered by the European Commission's Standard Contractual Clauses in our data processing agreement with that provider.

Google Workspace. Google may process mailbox data outside the EU. These transfers rely on Google's certification under the EU-US Data Privacy Framework and on the Standard Contractual Clauses in Google's Cloud Data Processing Addendum.

You can ask for a copy of these safeguards at contact@tortuga.estate.

7. Links to other services

The site links to services run by other companies, such as YouTube (section 3.5). Their own privacy policies apply when you use them.

"Request access" takes you to Tortuga Bay (bay.tortuga.estate), our access portal. This policy does not cover the portal.

8. How long we keep your data

When a period ends, we delete the data or make it anonymous.

9. Your rights

Under the GDPR (Articles 15 to 22) you can:

• Access: ask whether we hold data about you and get a copy.
• Rectification: have inaccurate data corrected or incomplete data completed.
• Erasure: have your data deleted, for example when we no longer need it or you withdraw consent.
• Restriction: ask us to keep your data but stop using it, for example while we check a correction you asked for.
• Portability: receive the data you gave us in a structured, machine-readable format, or have it sent to another organisation.
• Objection: object at any time to processing based on our legitimate interest, such as visit statistics.
• Withdraw consent at any time. This does not affect processing that took place before you withdrew it.

How. Write to contact@tortuga.estate. We may ask you to confirm your identity before we act. We answer within one month. For complex or numerous requests we may extend this by up to two further months; if we do, we will tell you within the first month and say why. Exercising your rights is free of charge.

Complaints. You can complain to the Commission nationale pour la protection des données (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg, cnpd.public.lu. You can also complain to the data protection authority in the EU country where you live or work. We would appreciate the chance to deal with your concern first.

10. Children

The site is not intended for minors. We do not knowingly collect personal data from minors. If you believe a minor has sent us personal data, write to contact@tortuga.estate and we will delete it.

11. Security

We protect personal data with technical and organisational measures appropriate to the risk, including:

• encrypted connections (HTTPS, with HSTS);
• hosting in the EU;
• access to the CMS limited to authorised staff;
• rate limiting of form submissions;
• no form contents in URLs or server logs.

12. Changes to this policy

When we change this policy, we publish the new version on this page with its date. Earlier versions are listed below.