Privacy Policy

1.1 Pursuant to Art. 13 and 14 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data ("GDPR"), the Camarup platform operated by cafeglobe s.r.o., with registered seat at Ferienčíkova 2437/16, 811 08 Bratislava - mestská časť Staré Mesto, Slovak Republic, ID No.: 52963683, registered with Commercial Register of Municipal Court Bratislava III, Section: Sro, File No.: 145772/B ("Company," "we," "us," or "our"), hereby specifies the company's privacy policy in selected areas of personal data processing.

1.2 We operate an online matchmaking platform that connects users seeking to sell or raise capital for businesses, projects or assets ("Sellers") with users interested in acquiring or providing capital for such businesses, projects or assets ("Buyers") (together "Users"). Our services include user registration and account management, profile creation, matchmaking and communication tools, and optional tools such as AI-supported valuation, pitchdeck support and other ancillary or advisory-type services.

1.3 We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, store and protect your information in compliance with the GDPR and other applicable data protection laws.

1.4 By using our website and services, creating a user account or otherwise interacting with us, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please do not use our services.

We limit our data collection to what is necessary for operating and improving our matchmaking platform and related services.

2.2 We may collect and process in particular the following categories of personal data:

Identification and contact data

• Name and surname
• Business role and company name
• Email address
• Telephone number (if provided)
• Country of residence / registered office

Account and profile data

• Username / login credentials (stored in hashed form)
• Profile information you choose to provide (e.g. whether you are a Buyer or Seller, type of transaction sought, industry focus, indicative deal size or stage, brief description of your business or activities)
• Communication and language preferences

Transaction-related and platform usage data

• Information on your interactions on the platform (e.g. which profiles you view, expressions of interest, connection requests, messages exchanged via the platform)
• Information necessary to manage matchmaking and introductions between Buyers and Sellers

Advisory and ancillary services data (only if relevant)

• Information you provide for valuation, pitchdeck preparation or similar tools (e.g. high-level financial data, business summaries) where these contain personal data (for example data of founders or key managers).

Technical and log data

• IP address, device information, browser type, access times, and pages visited, collected via server logs and strictly necessary cookies or similar technologies, including those used for security and performance purposes.

We do not intentionally collect special categories of personal data (e.g. data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, health data). We ask you not to include such data in your profile, messages, pitchdecks or other materials uploaded to the platform.

We do not currently process any payments on the platform and therefore do not collect or store payment card details or routine billing data. If we introduce paid services in the future, we may need limited billing details (e.g. billing address, tax ID on invoices) solely to issue invoices and comply with accounting and tax obligations; in such case this Privacy Policy will be updated as appropriate.

3.1 We process your personal data on the following legal bases under Article 6 GDPR:

Performance of a contract (Article 6(1)(b) GDPR)

• Creating and maintaining your user account and profile.
• Providing access to and operation of the platform and its features, including matchmaking and communication tools and certain AI-supported tools.
• Handling your requests related to the use of our services.

Compliance with legal obligations (Article 6(1)(c) GDPR)

• Compliance with obligations under applicable accounting, tax, anti-money-laundering and sanctions regulations, where relevant.
• Responding to lawful requests from public authorities and courts.

Legitimate interests (Article 6(1)(f) GDPR)

• Operating, securing and improving our platform, including monitoring for misuse, fraud or security incidents.
• Keeping records of interactions necessary to protect our rights, to handle complaints and to enforce or defend legal claims.
• Communicating with Users regarding service-related updates, security notifications and important changes to terms or policies.

Consent (Article 6(1)(a) GDPR)

• Sending marketing or promotional communications (e.g. newsletters, invitations, updates) by email or similar channels.
• Using certain optional cookies or similar technologies for analytics or marketing (where required by law). You may withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

You remain responsible for ensuring that personal data you upload to the platform have been collected and shared lawfully.

4.1 We use your personal data for the following purposes:

Account registration and management

• Creating and maintaining your user account and profile.
• Enabling you to log in securely and manage your settings.

Platform operation and matchmaking

• Displaying basic profile information to other Users, in line with your role (Buyer or Seller) and platform settings.
• Allowing Buyers to express interest in Sellers' profiles and vice versa.
• Enabling communication between Users through platform messaging or similar tools.

Provision of tools and services

• Providing access to platform tools, including AI-supported valuation, pitchdeck helpers and other ancillary functionalities.
• Providing, where agreed, advisory-type services either by us or by a cooperating advisory entity under a separate agreement.

Customer support and service-related communication

• Responding to your inquiries, feedback and support requests.
• Sending important service notifications (e.g. changes in terms, security alerts, disruptions).

Security, fraud prevention and legal compliance

• Monitoring for suspicious behaviour and potential misuse of the platform.
• Protecting our rights and the rights of other Users.
• Complying with legal and regulatory obligations and responding to lawful requests by authorities.

Marketing and communication (only with consent where required)

• Sending newsletters, promotional emails or event invitations.
• Informing you about new features or services that may be relevant to you. You can opt out of marketing communications at any time by using the unsubscribe link in emails or by contacting us.

4.2 We do not use your personal data to make automated decisions with legal or similarly significant effects on you, within the meaning of Article 22 GDPR. AI-supported tools used on the platform (e.g. indicative valuations, automated pitchdeck suggestions) are informational only and do not replace your own assessment or independent advice.

We retain your personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

5.2 In general, we apply the following retention periods:

User account data and core platform logs

• Stored for the duration of your account's existence and your use of our services.
• After closure or long-term inactivity of your account, we typically retain a limited subset of account and interaction data for up to 5 years to protect our legitimate interests (e.g. proof of transactions or communications) and to comply with legal obligations and limitation periods.

Communication and support data

• Stored for the duration necessary to resolve your request plus a reasonable additional period to prove correct handling and to defend possible claims.

Marketing data

• Stored until you withdraw your consent or object to processing for marketing purposes, after which we will cease processing for such purposes and delete or anonymise the data unless it must be retained for other lawful reasons.

After expiry of the relevant retention periods, we will either delete your data or irreversibly anonymise it so that it can no longer be associated with you.

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

6.2 These measures include, in particular:

• Encryption of data in transit and, where appropriate, at rest.
• Access controls and authentication mechanisms, including role-based access restrictions.
• Regular security updates and monitoring of our systems and infrastructure.

Despite these measures, no system can be guaranteed to be completely secure. If you suspect any unauthorised access to your account or data, please contact us without delay.

We do not sell or rent your personal data.

7.2 We may share your personal data with the following categories of recipients, to the extent necessary and subject to appropriate safeguards:

Other Users of the platform

Certain profile information (e.g. your name, role, company name, basic transaction preferences) is shared with other Users to enable matchmaking and communication. You control most of the content you provide in your profile.

Service providers (processors)

• IT and hosting providers.
• Email and communication service providers.
• Customer support and CRM tools.

These entities process personal data on our behalf based on data processing agreements and may only process such data in accordance with our instructions and applicable law.

Advisory and cooperating entities

Where you explicitly engage advisory-type services provided by or together with another advisory entity, we may share the personal data necessary for the provision of such services with that entity under appropriate contractual and data protection arrangements.

Legal and public authorities

If required by law, court order or a request from competent authorities (e.g. supervisory, tax or law-enforcement authorities).

Corporate transactions

In the event of a merger, acquisition, sale of assets or similar corporate transaction, your data may be transferred to the relevant successor entity, subject to appropriate safeguards and, where required, prior notification.

Where third parties act as our processors, we require them to implement appropriate security measures and to process personal data only as instructed by us and for the purposes described in this Privacy Policy.

8.1 As a data subject under GDPR, you have the following rights (subject to applicable conditions and limitations):

• Right of access (Article 15 GDPR) - You can request confirmation as to whether we process your personal data and obtain a copy of such data.
• Right to rectification (Article 16 GDPR) - You can request correction of inaccurate or incomplete personal data.
• Right to erasure ("right to be forgotten", Article 17 GDPR) - You can request deletion of your personal data, subject to legal exceptions (e.g. where data must be retained by law or for the establishment, exercise or defence of legal claims).
• Right to restriction of processing (Article 18 GDPR) - You can request that we restrict processing of your personal data in certain circumstances.
• Right to data portability (Article 20 GDPR) - You can request that we provide your personal data in a structured, commonly used and machine-readable format and/or transmit it to another controller, where technically feasible.
• Right to object (Article 21 GDPR) - You can object to processing based on our legitimate interests, including profiling, and to processing for direct marketing at any time.
• Right to withdraw consent (Article 7(3) GDPR) - Where processing is based on your consent, you can withdraw it at any time, without affecting the lawfulness of processing before withdrawal.
• Right to lodge a complaint (Article 77 GDPR) - You may file a complaint with your local data protection authority.

8.2 To exercise your rights, please contact us using the contact details in section 13. We may need to verify your identity before fulfilling your request.

9.1 We primarily store and process personal data on servers located within the European Economic Area ("EEA").

9.2 If we transfer personal data outside the EEA, we will ensure that an adequate level of protection is provided, for example by using countries recognised as providing an adequate level of data protection by the European Commission or by implementing appropriate safeguards such as Standard Contractual Clauses or other mechanisms recognised by law.

10.1 Company uses Cloudflare as a cookies tool to improve user experience and analyze website performance. To learn more about Cloudflare, click here.

10.2 The Cloudflare cookie tool does not store any personally identifiable information. It is a technical tool designed solely for security and access management purposes.

10.3 Cloudflare may use strictly necessary cookies to manage traffic and ensure security. These cookies do not collect personal data for marketing or tracking purposes.

10.4 By using our website, you consent to the use of these essential cookies. You can manage cookie preferences through your browser settings. For more details, click here to see Cloudflare's privacy policy.

11.1 Our services are intended for users 18 years and older. We do not knowingly collect data from children.

11.2 If you believe a minor has provided personal data, contact us for immediate removal.

12.1 We may update this Privacy Policy from time to time, for example to reflect changes in our services, legal requirements or data processing practices.

12.2 Any updated version will be posted on our website with an updated "Last updated" date. Where changes are material, we may also notify you by email or via the platform interface. Your continued use of our services after such updates constitutes acceptance of the revised policy.

13.1 For any privacy-related inquiries or to exercise your rights, please contact us:

• Camarup
• cafeglobe s.r.o.
• Ferienčíkova 16
• Ferienčíkova 2437/16, 811 08 Bratislava - mestská časť Staré Mesto, Slovak Republic
• Email: info@camarup.com

13.2 If you have concerns about our data processing practices, you also have the right to file a complaint with your local Data Protection Authority (DPA). The supervisory authority on the territory of the Slovak Republic is the Personal Data Protection Office of the Slovak Republic (Úrad na ochranu osobných údajov SR), Hraničná 12 Bratislava; www.dataprotection.gov.sk, e-mail: statny.dozor@pdp.gov.sk, tel.: +421232313214.