Cyndx Data and Privacy Policy

Last revised August 12, 2024

Cyndx Networks LLC (“Cyndx” or “we”) knows that you care how your personal information is used, processed, and shared. We are committed to complying with all laws and regulations governing the processing of personal data, including the General Data Protection Regulation (EU) 2016/679 (the “GDPR”). This Data and Privacy Policy explains what personal data we collect and process, how we use this data, why and to whom we may disclose this data, what your rights are with respect to this data, and how we secure information that we process.

Personal data that we collect is controlled by Cyndx Networks LLC, 525 Okeechobee Blvd., Suite 840, West Palm Beach, FL 33401. We act as processor with respect to data that we control.

Some of our clients use our platform to process personal data that they control. With respect to such personal data, those clients act as controllers, and we act as processor.

We engage a sub-processor to provide web hosting and platform services on our behalf. We purchase our sub-processor’s standard offering; consequently, the sub-processor controls the country in which data is stored. Our sub-processor currently stores all data that we control and process in the United States of America.

By entering into a subscription agreement with us, accessing our platform (including the Finder, Raiser, and Owner tools), browsing our website, or signing up for email alerts from us, you agree to this Data and Privacy Policy.

If you are a California resident, you are also subject to certain rights described in our Additional Privacy Policy Provisions for Residents of California below, and you may exercise your rights by visiting our Do Not Sell My Personal Information form for California residents.

What personal data do we collect and process from you and others in connection with the Cyndx platform?

In connection with the Cyndx platform, the categories of personal data that we collect and process from you and others include:

• names,

• email and physical addresses,

• business telephone numbers,

• information about business affiliations, and

• information about holdings in certain securities.

We obtain such personal data in several ways:

• we collect personal data when a business registers for our software-as-a-service (“SaaS”) platform and provides information regarding its authorized users;

• we collect personal data when you enter information regarding your business’s team into our Raiser capital-raise tool;

• we collect personal data when you enter information regarding natural persons’ holdings in securities into our Owner capitalization table tool;

• we collect business-related personal data from publicly available sources and third-party vendors, some of which is made available in our Raiser capital-raise tool and our Finder research tool; and

• you may choose to provide us with certain personal data when you contact us, visit our website, or register to hear about our products or services.

In using our Raiser and Owner platforms, you may choose to limit the amount of personal data that you enter into our platform or to avoid providing us with personal data at all.

What usage data do we collect?

We collect technical and usage information about visitors to our website and users of our SaaS platform, including internet protocol (“IP”) addresses, internet service providers, browser types, date and time stamps, device types, and operating systems. To collect this information, we use common internet technologies, such as cookies and web beacons.

We use the technical and usage information that we collect:

• to administer our services more efficiently,

• to analyze trends,

• to administer our SaaS tools and website, and

• to gather information about our user base.

We may use log-ins, cookies, and IP addresses to link this usage and technical information with your personal data if you are a Cyndx client (or an authorized user of such a client) or have previously provided your personal data to us as a prospective user of our services and have affirmatively consented to this Data and Privacy Policy.

If you are a current, prospective or former user of Cyndx products, we may obtain similar technical information in connection with our email marketing campaigns. To evaluate the effectiveness of our email marketing, we may, for instance, see whether you opened an email message from us, if your email device supports such capabilities.

We do not collect or process personal data falling into the special categories set forth in Articles 9 and 10 of the GDPR.

We do not offer services to children, and we do not knowingly collect children’s personal data. If you believe that we have collected or processed a child’s personal data, please contact us at [email protected].

How do we use personal data?

We offer SaaS tools to companies seeking to raise capital and manage their capitalization tables and to institutional investors seeking strategic opportunities. Certain features of those tools require that we store, process, and make available to our clients—who access our platform subject to confidentiality restrictions—business-related personal data. Our clients may access such personal data to find representatives of either prospective investors or companies in which they are interested in investing. They may also store and access personal data to manage their capitalization tables. Our clients may be able to export limited amounts of personal data from the Cyndx platform for their business purposes, subject to confidentiality restrictions.

In addition to using personal data to facilitate the core functions of the Cyndx platform, we use personal data to manage and authorize access to the Cyndx platform. We also use the personal data of our clients’ authorized users to provide support to our clients.

We collect only as much personal data as is needed to further these purposes. We do not engage in, or permit, processing of personal data unconnected with these purposes.

We consistently work to improve the Cyndx platform, adding new features, new data, and new ways for our clients to use it. If we begin collecting different categories of personal data or materially change the ways in which we use your data, we will amend this Data and Privacy Policy and will notify you if you have subscribed to any of our email marketing campaigns, contacted us as a prospective user of our services, or registered as an authorized user of our services.

For how long do we retain personal data?

We retain personal data only for as long as necessary for the purposes for which it was collected, including where such data is collected for the purpose of maintaining up-to-date business-related contact information accessible by users of our SaaS tools. We may also retain personal data to comply with applicable legal or regulatory requirements, to maintain security, to prevent fraud and abuse on the Cyndx platform, or to enforce our contractual rights. To the extent that we need to retain a person’s personal data to fulfill those purposes, but identification of the person is no longer necessary, we will endeavor to pseudonymize such person’s personal data in our systems.

What is the legal basis for our processing of personal data?

We process personal data only if there is a legal ground to do so. Without prejudice to other valid legal grounds for processing data under the GDPR and other laws and regulations, we may process your data if:

• you have given affirmative consent to the processing of your personal data for specific purposes;

• the processing is necessary either for the performance of a contract to which you are party or to take steps at your request before entering into a contract;

• the processing is necessary for compliance with a legal or regulatory obligation;

• the processing is necessary to protect our vital interests; or

• the processing is necessary for the pursuit of our legitimate interests or those of our clients, except where such interests are overridden by the interests or the fundamental rights and freedoms of the persons whose data is so processed.

Why, and to whom, might we disclose personal data?

In the ordinary course of our business, we may disclose certain personal data to our clients where such data is material to their efforts to complete business transactions. Further, we may disclose personal data to our subsidiaries, affiliates, agents, contractors, service providers, and other third parties that we engage to support our business. Such disclosures are limited by confidentiality restrictions contained in separate agreements in place between us and our clients.

Outside of the ordinary course of our business, we may transfer personal data in the following situations:

• If Cyndx, a Cyndx business unit, or all or substantially all the assets of Cyndx are acquired, the personal data that we control may be transferred to the acquirer. In the event of such an acquisition, personal data transferred to the acquirer likely will continue to be subject to this Data and Privacy Policy.

• We may disclose personal data that we control when we believe that the disclosure of such information is necessary for compliance with applicable laws and regulations, enforcement of our agreements, or protection of the rights or property of Cyndx and our clients. This activity will not include selling personal data that we control for commercial purposes in a way that is contrary to the commitments set forth in this Data and Privacy Policy.

We do not disclose personal data for direct marketing purposes.

In the future, we may transfer personal data under our control to other countries. If we do so, we will ensure that we transfer such data subject to appropriate safeguards.

What are your rights with respect to your personal data?

You may have the following rights with respect to your personal data that we store:

• Right of Access: You may have a right to access and obtain a copy of your personal data as processed by Cyndx.

• Right to Rectification: If you believe that we possess your personal data and that your personal data are incorrect or incomplete, you may request the correction or completion of your personal data.

• Right to Erasure: You may request the deletion of your personal data from our systems.

• Right to Restrict Processing: You may request restriction of the processing of your personal data on our systems.

• Right to Object: You may object to the processing of personal data where we have not obtained your consent but have undertaken such processing where we believe that pursuit of our legitimate interests is not overridden by your fundamental rights and freedoms with respect to the personal data that we are processing.

• Right to Withdraw Consent: If we previously obtained your consent to process your personal data, you may withdraw your consent for us to process your data in the future.

We will honor your requests, objections, and withdrawals as required under applicable law and data protection rules, which qualify the rights listed above with certain exceptions. We may refuse to honor your requests, objections, and withdrawals if such exceptions apply.

To exercise your rights, or to inquire about your personal data, please complete and submit the data privacy request form. Cyndx will not respond to requests sent to [email protected]. We will investigate your concern and respond to your inquiry promptly. If you contact us, we may request additional information necessary to confirm your identity.

If you are dissatisfied with our response, you may complain to the data protection authority in the jurisdiction where you reside.

How do we secure your data?

Within our business, we have implemented internal controls to protect personal data from misuse, unlawful disclosure or access, and any other unlawful form of processing, and we take reasonable steps to secure your personal data from external misuse or unauthorized disclosure while such data is under our control.

We endeavor to protect your information during its transmission by using Secure Sockets Layer (SSL) software. Nevertheless, the transmission of information via the internet is never entirely secure, even when information is encrypted during transmission. Consequently, we do not warrant the security of information that you send to us during its transmission.

Amendments to This Data and Privacy Policy

We may amend this Data and Privacy Policy. Please contact us by email at [email protected] to be notified of changes.

How to Contact Us

If you have questions about this Data and Privacy Policy, please do not hesitate to contact us by email at [email protected] or by mail at:

Cyndx Networks LLC

Attention: General Counsel

525 Okeechobee Blvd., Suite #840

West Palm Beach, FL 33401

Last revised March 1, 2022

With respect to personal information stored by Cyndx Networks LLC (“Cyndx” or “we”), residents of the U.S. state of California have certain rights in addition to the rights set forth in the Cyndx Data and Privacy Policy above.

This Privacy Policy for Residents of California is designed to be accessible to users with disabilities using screen-reader technology. If you would prefer to print this policy, please download this PDF.

Categories of Personal Information Collected by Cyndx

We collect information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California consumer or household (“personal information”). We have collected one or more data types in the following categories of personal information from or about California consumers within the twelve (12) months preceding the effective date of this Privacy Policy for Residents of California:

In particular, we collect the following types of personal information:

Business Contact Information

Cyndx receives from its users and from third-party business information providers certain business contact information, some of which relates to persons who reside in California. That business contact information includes the following personal information:

• names;

• business affiliations and titles;

• professional qualifications

• business-related biographical information;

• telephone numbers;

• email addresses;

• social media profile links;

• genders; and

• dates of birth.

Electronic Network Activity Information

In the past 12 months, categories of electronic network activity information collected by Cyndx’s public-facing website and logged-in platform have been the following:

• username, email address, and password (for users of Cyndx’s logged-in platform only);

• IP address;

• country, region and city (based on IP address);

• web browser type; and

• referring website.

Cyndx does not disclose this data to any other parties and uses this technical information only (i) to provide, and enhance the provision of, Cyndx’s software-as-a-service products and (ii) to administer Cyndx’s public-facing website. This information is collected through common web technologies, including, without limitation, browser cookies.

Personal Information of Minors

Cyndx does not have actual knowledge that it possesses or sell any personal information of minors.

Categories of Sources of Personal Information

Cyndx obtains personal information in the categories described above:

• Directly from Cyndx customers, which are businesses that purchase our services;

• From consumers’ activity on Cyndx’s public-facing website;

• From third-party business information providers; and

• From information that is publicly disclosed via the internet.

Business Purpose for Collecting Personal Information

Cyndx uses the personal information that we collect for the following purposes:

• Business information: We collect business contact information, which includes certain personal information as described above, to make it possible for users of the Cyndx platform to contact businesses listed in the platform. We also collect information about individuals’ holdings in certain securities.

• Electronic network activity information:

  • We collect electronic network activity information to provide, and to enhance the provision of, Cyndx’s software-as-a-service tools.

  • We also collect electronic network activity information to administer our public-facing website.

  • We may collect electronic network activity information to detect security incidents and to protect against malicious, illegal or fraudulent activity.

  • We may collect certain electronic network activity information to maintain or service accounts or to provide customer service.

Categories of Third Parties with Whom Cyndx Shares Personal Data

We may share your personal information:

• With respect to business contact information only, with users of Cyndx software-as-a-service products, who may use such contact information to reach businesses listed on our platform;

• With our affiliates and third-party service providers that perform services on our behalf, subject to confidentiality restrictions;

• With law enforcement or governmental authorities if we believe that someone may have engaged in malicious, illegal or fraudulent activity on our website or in our software-as-a-service products; and

• With respect to electronic network activity information only, with third-party analytics providers, to analyze use of the Cyndx website.

We do not share your personal information with any third parties for their marketing purposes.

In connection with Cyndx’s operation of software-as-a-service products that provide business contact information to paying users of these products, Cyndx has sold the following categories of personal information in the twelve (12) months preceding the effective date of this Privacy Policy for California Residents:

• A. Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.

• B. Any categories of personal data described in Cal. Civ. Code § 1798.80(e), such as name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.

• C. Professional or employment-related information.

In connection with Cyndx’s operation of software-as-a-service products that provide business contact information to paying users of these products, Cyndx has disclosed the following categories of personal information in the twelve (12) months preceding the effective date of this Privacy Policy for California Residents:

• A. Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.

• B. Any categories of personal data described in Cal. Civ. Code § 1798.80(e), such as name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.

• C. Professional or employment-related information.

Your Rights as a California Resident

As a resident of the state of California, you have certain rights with respect to your personal information under California law.

Right to Know

As a California resident, you may request that Cyndx disclose to you the following:

• the categories of personal information that Cyndx has collected about you;

• with respect to the 12 months preceding your request, the categories of personal information that Cyndx may have transferred about you and the categories of third parties to whom such personal information was transferred, by category or categories of personal information for each third party to which the personal information was transferred; and

• with respect to the 12 months preceding your request, the categories of third parties to which Cyndx disclosed your personal information for business purposes.

If Cyndx receives a request from you for the information listed above, Cyndx may request additional information from you to verify your identity. Because the business contact information in Cyndx’s possession commonly includes only LinkedIn links and business email addresses, this verification process will normally include a request that you reply to a message sent by Cyndx to your LinkedIn account or business email address.

Once Cyndx has verified your identity, Cyndx will provide the information listed above to you free of charge.

Nevertheless, Cyndx will under no circumstances provide you with specific pieces of personal information if the disclosure of such personal information creates a substantial, articulable, and unreasonable risk to the security of such personal information, your account with Cyndx, or the security of Cyndx’s platform and systems.

Moreover, Cyndx will not disclose specific pieces of personal information to you if the disclosure of such information would conflict with other applicable federal or state law. If Cyndx declines to disclose any personal information to you on the basis of this exception, Cyndx will explain the basis for the denial.

Right to Deletion

As a California resident, you may request that Cyndx delete personal information that Cyndx has collected from you, other than information that Cyndx must retain to do any of the following:

• to provide services to you;

• to detect security incidents and protect against malicious, deceptive, fraudulent or illegal activity;

• to identify and repair errors that limit existing functionality;

• to exercise Cyndx’s right to free speech or ensure your, or another consumer’s, right to exercise his or her right to free speech, or any other right provided for by law;

• to comply with the California Electronic Communications Privacy Act;

• to enable Cyndx’s solely internal use of your personal information in ways contemplated by your relationship with Cyndx under a services agreement or other arrangement between you and Cyndx;

• to comply with Cyndx’s legal obligations; or

• to use your personal information in other exclusively internal ways that are compatible with the context in which you first provided such personal information.

If Cyndx receives a request for deletion of your personal information, Cyndx may request additional information from you to verify your identity. Because the business contact information in Cyndx’s possession commonly includes only LinkedIn links and business email addresses, this verification process will normally include a request that you reply to a message sent by Cyndx to your LinkedIn account or business email address.

Once Cyndx has verified your identity, Cyndx will delete your personal information its databases.

Right to Opt-Out; Right to Opt-In

As a California resident, you have the right, at any time, to request that Cyndx remove your personal information from the database of business contact information that Cyndx makes available to users of Cyndx’s logged-in platform. If Cyndx has a good-faith, reasonable, and documented belief that your request to opt-out of the sale of your personal information is fraudulent, Cyndx will deny your request and provide you with a written explanation of why Cyndx believes your request is fraudulent.

After you request to opt-out of Cyndx’s maintenance of your business contact information in its platform, you may request to opt-in to the inclusion of your business contact information in Cyndx’s platform at any time.

With respect to the right of minors or, if applicable, their parents or guardians to opt-in to the sale of their personal information, Cyndx does not possess personal information regarding any persons who are younger than 18 years old.

Right to Non-Discrimination

If you make a request to access your personal information, delete your personal information or opt out of sale of your personal information to third parties, Cyndx will not discriminate against you by preventing you from accessing Cyndx’s logged-in platform, charging you a higher price for use of Cyndx’s services, providing a different quality of services to you, or suggesting that you may receive a different price for goods or services or that you may receive a different level of quality of goods or services from Cyndx.

However, if you request that Cyndx delete your personal information, your business contact information will not be available to users of Cyndx’s logged-in platform, which will limit the ability of those users to contact you and may prevent those users from communicating with your business.

Right to Appoint an Authorized Agent to Exercise Rights

An authorized agent may submit requests to opt-out or delete with respect to your personal information if you have given such authorized agent written permission to do so. If an authorized agent submits a request to opt-out or delete on your behalf, Cyndx will request proof that the agent has been authorized by you to act on your behalf.

How California Residents Can Exercise Their Rights

If you wish to exercise any of the rights described above, please visit our Do Not Sell My Personal Information request form for California residents or call (877) 237-4418. If you choose to use our Do Not Sell My Personal Information request form for California residents, you will not be required to create an account to exercise your rights.

Timeframe for Responses

Cyndx will usually respond to your request within 45 days. If Cyndx is not able to respond to your request within 45 days, Cyndx will provide you with notice and an explanation of the reason that Cyndx will take more than 45 days to respond to your request.

Contact for More Information

If you have any questions about Cyndx’s privacy policies and practices, please send an email to [email protected].