Privacy Notice for Napkin Ventures
(Status: February 2026)
This Privacy Notice explains how we process your personal data specifically for the Napkin Ventures campaign. This notice supplements our general Privacy Policy. 

1. Who is responsible for processing your data?
The data controller for personal data processed in connection with this prize draw are we:

PNL Fintech B.V.
Jachthavenweg 109H,
1081KM Amsterdam
Netherlands

You can contact our Data Protection Officer: privacy@finom.co 

The Contest is hosted via Instagram. For the use of Instagram Business Tools in this campaign, PNL Fintech B.V. and Meta Platforms Ireland Limited act as joint controllers in accordance with Article 26 GDPR.
  • Scope of Joint Processing: This joint controllership covers the collection of your personal data via Instagram Business Tools and its transmission to Meta Ireland.
  • Meta’s Independent Processing: Any subsequent processing of data by Meta Ireland after this transmission is conducted by Meta as an independent controller. You can find information on how Meta processes personal data, including their legal basis and how to exercise your rights against them, in Meta’s Privacy Policy.
  • Allocation of Responsibilities: We have entered into a Controller Addendum to determine our respective responsibilities. Meta Ireland is responsible for enabling data subjects' rights under Articles 15-20 of the GDPR with regard to the personal data stored by Meta Ireland after the joint processing.
  • Your Rights: You can exercise your rights under Articles 15-21 GDPR directly against Meta Ireland. If you exercise these rights against us regarding the joint processing, we will forward your request to Meta Ireland with undue delay.
Please note that Instagram is not a sponsor, endorser, or administrator of this promotion, and the contest is in no way sponsored, endorsed, administered by, or associated with Instagram.


2. What kind of personal data do we process?
To participate in the Napkin Ventures campaign, we process only personal data that is necessary for administering the contest and prize draw, specifically to confirm eligibility, evaluate submissions, and notify winners. Without these details, participation is not possible.
Required data includes:  
  • Instagram identification details (e.g. Instagram username/handle, profile ID)  
  • Submission content (e.g. photo of the napkin idea, business idea text included in the message or Story)  
  • Confirmation message indicating consent with the Terms & Conditions and Privacy Notice
  • Contest administration data (e.g. entry number assigned in our internal records)  
If you are selected as a winner or finalist, we will request additional information required to fulfil the prize, such as your email address and phone number, as well as any information necessary to support prize payment and (where applicable) the business registration and account opening process in accordance with the Terms & Conditions. Further contact details are required solely to facilitate winner notification, prize fulfilment, and (where applicable) business registration support.
Failure to provide these details within the required timeframe may result in forfeiture of the prize.

3. Why and on which legal basis do we process your data?
We process your personal data for the purpose of administering and conducting the Napkin Ventures Contest, including verifying eligibility, documenting valid entries, selecting winners (either through a jury-based evaluation or random selection), notifying winners, and awarding prizes.
The legal basis for this processing is Article 6(1)(b) GDPR (performance of a contract), as participation in the contest is governed by the Terms and Conditions. In addition, we may process your personal data on the basis of Article 6(1)(f) GDPR (legitimate interests). 
You have the right to object to the processing of your personal data for the purposes of the contest at any time in accordance with Article 21 GDPR. If you object, you will no longer participate in the contest. To exercise this right, or any other data protection rights, please contact our Data Protection Officer at the address provided in Section 1. 
If you win and separately consent to the publication of your name and/or image as a winner, the legal basis for such publication is Article 6(1)(a) GDPR (consent).

4. Who receives your data?
Within our organization, access to your personal data is limited to those teams that require it to administer the contest. 
We may engage external service providers (e.g., for sending emails, securely hosting and storing data, or managing databases). These partners act under our instructions and are contractually bound to comply with applicable data protection laws and appropriate security measures.
We do not transfer your personal data to countries outside the EU or the European Economic Area (EEA). If, in exceptional cases, such a transfer should become necessary, we will ensure that appropriate safeguards are in place in accordance with legal requirements.

5. How long do we store your data?
We retain your personal data only as long as it is needed to administer and fulfil the Napkin Ventures Contest and to comply with any applicable legal requirements.
Where commercial, tax, or accounting laws require it, we may need to store certain data for up to ten years (for example, if you receive a monetary prize).

6. What are your data protection rights?
You have several rights regarding your personal data. You can exercise these rights by contacting us at privacy@finom.co. Your rights include:
Right to Access: You have the right to request information about the personal data we process, including the purpose of processing, the categories of data, and the recipients of the data.
Right to Rectification: If any of your personal data is inaccurate or incomplete, you have the right to request its correction or completion.
Right to Erasure (Right to be Forgotten): You have the right to request the deletion of your personal data when processing is no longer necessary for the purposes for which it was collected.
Right to Restriction of Processing: You can request the restriction of processing in certain situations (for example, if you contest the accuracy of your data).
Right to Data Portability: You can request a copy of your personal data in a structured, commonly used, and machine-readable format and have it transferred to another data controller.
Right to Object to Processing: You have the right to object to processing based on legitimate interests, and we must stop processing unless we have compelling legitimate grounds.
Right Not to be Subject to Automated Decision-Making: You have the right not to be subjected to automated decisions, including profiling, that have legal effects on you.
Right to Lodge a Complaint with a Supervisory Authority: If you believe that the processing of your personal data violates applicable data protection laws, you have the right to lodge a complaint with a supervisory authority. You may contact the data protection authority in the Member State of your habitual residence, your place of work, or the place of the alleged infringement.