Legal
Privacy policy
This policy explains what personal data Artery handles, why, and what you can ask us to do with it. It covers both this website and the Artery application.
1. Who we are
Artery is a software company based in Luxembourg. We provide Artery, a coordination and record-keeping platform used by fund operators and their service providers. Artery is not a regulated entity and provides no fund, legal, tax or advisory services. For any question about this policy, write to support@tibmont.com.
2. Our role: controller and processor
For this website and for our own business contacts we act as data controller. For personal data that customer firms put into the Artery application we act as data processor, on the documented instructions of that customer, under a data-processing agreement issued with the beta agreement.
3. What we collect
- Contact data — name, work email, firm and role, when you request access, ask for a demo or email us.
- Account data — the identity and organisation membership needed to sign you in and attribute your actions.
- Action data — which user acting for which organisation performed which step, and when. This is the audit trail the product exists to produce.
- Content you upload — documents and attestations submitted against a fund workflow step.
- Technical data — limited server logs (IP address, timestamp, requested route) kept for security and reliability.
We do not collect special-category personal data, and we do not build advertising or behavioural profiles.
4. Why we use it
- To operate the coordination service and produce its audit record.
- To authenticate users and scope access to the right organisation and fund.
- To respond to access requests, demo enquiries and support questions.
- To keep the service secure and to investigate abuse or incidents.
Our legal bases are performance of a contract, our legitimate interest in operating and securing the service, and — for website enquiries — your consent when you submit a form.
5. Where data is held
Customer data is hosted within the European Union. There is no default transfer of customer data outside the EU. Data is encrypted in transit and at rest. The full hosting and sub-processor list is provided on request as part of diligence.
6. Sharing
We share personal data only with the sub-processors that run the platform (hosting, database, transactional email) and where we are legally required to. We do not sell personal data, and we do not share it for advertising.
Inside the application, access follows the engagement: an organisation reaches only the funds and requests it has been engaged on, in the role it accepted. Counterparties on the same fund are isolated from one another unless the workflow explicitly involves both.
7. Retention
Application records are retained for the life of the engagement, and afterwards as set out in the customer contract — including an export of the fund records before deletion. Website enquiries are kept for up to 24 months. Server logs are kept for a short operational period.
8. Your rights
Under the GDPR you can ask for access, rectification, erasure, restriction, portability, and you can object to processing based on legitimate interests. Where we act as processor we will pass your request to the customer firm that controls the data and support them in answering it. Requests are balanced against the record-keeping obligations of the firms using the platform.
Write to support@tibmont.com. You also have the right to complain to the Luxembourg supervisory authority, the CNPD.
9. Cookies
This website uses essential cookies and local storage only — to remember your theme choice and your cookie preference, and to keep you signed in to the application. We set no advertising or cross-site tracking cookies by default.
10. Changes
We will update this page when our processing changes, and we will change the “last updated” date above. Material changes affecting customers are notified in writing.