Privacy policy

KeyTwelve is operated by Crosby Thirty-Three, which is also the controller for the personal data described on this page.

Crosby Thirty-Three GmbH
Adalbertstraße 74
10997 Berlin
Germany

Managing director (Geschäftsführer): Hans Christoph Luther
Commercial register: Amtsgericht Charlottenburg, HRB 288227 B
VAT identification number (USt-IdNr.): DE464310658
Contact: contact@crosby33.com

The access request form. If you submit a request on /request-access, we receive what you enter: your name, your firm, your work email address, your role, your underwriting volume, what a deal package usually contains for you, and anything you write in the free-text field. We use it to read the request, decide whether KeyTwelve is a fit, and reply. The legal basis is Article 6(1)(b) GDPR — steps taken at your request before any agreement.

Spam protection. The form is protected by Cloudflare Turnstile, which receives your IP address and signals about your browser in order to distinguish a person from an automated submission. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is keeping the form usable.

See Cloudflare’s Turnstile Privacy Addendum for details.

Server logs. Our hosting provider records the usual request data — IP address, time, the page requested, and the browser's user-agent string — to serve the site and defend it against attack. The legal basis is Article 6(1)(f) GDPR.

There is no analytics on this site, no advertising, no tracking across sites, no profiling, and no automated decision-making. Nothing you enter in the form is sent to an AI model.

We set no cookies for analytics or advertising, and there is no consent banner because there is nothing to consent to. Cloudflare Turnstile sets a token that is strictly necessary to run the check you asked for when you submitted the form; under §25(2) TDDDG that requires no consent.

Cloudflare hosts the site and runs the code behind the form, stores submitted requests in a Cloudflare D1 database, and provides Turnstile.

Resend sends the notification email that tells us a request has arrived. The stored request is the record; the email is only the notice.

That is the complete list. Your data is not sold, not shared for advertising, and not passed to anyone else. Both providers act as processors under written data processing agreements. Where they process data in the United States, the transfer is covered by the European Commission's standard contractual clauses under Article 46(2)(c) GDPR.

We keep an access request while we are considering it and for up to 24 months afterwards, so that we can pick the conversation back up. We delete it sooner if you ask. Server logs are kept for the short period our hosting provider retains them.

You can ask us for a copy of the data we hold about you, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, ask for it in a portable form, and object to processing that rests on our legitimate interest. Write to contact@crosby33.com and a person will answer.

You can also complain to a data protection supervisory authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information.

Nothing on this site requires you to identify yourself. The form is the exception, and it is voluntary — but without it we have no way to read a request or reply to one.

We update this page when what we do changes. The date below is when it last changed.

Last updated: 9 September 2026