Privacy Notice

We (“Ledgy”, “we”, “our” or “us”) understand how sensitive equity information is for any business. That’s why your privacy and your data’s security is crucial to us. We comply with the applicable data protection laws, including in particular the Swiss Federal Act on Data Protection (FADP), the General Data Protection Regulation (GDPR), the UK GDPR and the UK Data Protection Act 2018

This Privacy Notice explains how we collect, use and otherwise process personal data in the context of our services (app.ledgy.com or the “Services”) and the Ledgy website (ledgy.com or the “Website”). For information regarding the cookies we use, please refer to our Cookie Policy.

It also explains the different roles we may have under data protection law when processing your personal data.

If you have been given access to our Services by a company or other organisation, that organisation will generally determine why your personal data is processed through the Services. In those circumstances, the organisation is the controller, and we process your personal data on its behalf as its process, in accordance with its written instructions.

Where we process personal data solely on behalf of the organisation that has given you access, you should refer to that organisation’s Privacy Notice for information about its processing of your personal data.

However, in certain circumstances, we may also process personal data that has been provided to us, or generated through our provision of the Services to our customers for purposes that we determine ourselves. Where we do so, we act as controller in respect of that separate processing and this Privacy Notice applies to that processing.

We also act as controller when we process personal data for our own general business purposes, including when you visit our Website, manage your account on Ledgy, contact us, engage with us as a customer, prospective customer, supplier or business contact, or otherwise interact with us outside our role of processor.

The same personal data may therefore be processed by us in different capacities. The sections below explain these roles in more detail and describe the circumstances in which this Privacy Notice applies.

1. Personal data we process

When you access our Website or use our Services, we may collect and process the following types of Personal Data:

We may process the same Personal Data in different roles. We act as processor when we use it on our customer’s instructions, and as controller when we use it for our own purposes.

We refer to Personal Data from, or generated through, our customers’ use of the Services that we use for our own purposes as “Service-Related Personal Data”.

2. Legal grounds for processing

When we process Personal Data on behalf of our customers

Where we act as a processor, we process Personal Data on our customer’s instructions to provide, operate, maintain and support the Services. This may include:

• Hosting and storing Personal Data within the Services
• Providing customer technical support
• Accessing Personal Data where necessary to investigate and resolve support requests
• Monitoring, diagnosing and resolving errors, bugs and other technical issues
• Maintaining the security, availability and performance of the Services
• Carrying out other processing necessary to provide the services in accordance with our customer’s written instructions.

For this processing, our customer is responsible for determining the applicable legal ground. We do not rely on a separate legal ground of our own when we process Personal Data solely as a processor.

Where we process Personal Data as a controller

Where we determine the purpose and means for which Personal Data is processed, we act as a controller. Depending on the processing involved, we rely on the following legal grounds.

Contract

We may process Personal Data where this is necessary to enter into or perform a contract with you, or to take steps at your request before entering into a contract with you. This may include:

• Registering you as a customer where you are entering into a contract with us
• Providing and administering Services you have contracted with us to receive
• Processing payments, billing and collection

Where our contract is with your organisation rather than with you personally, we will not rely on contract as the legal grounds. We may instead rely on our legitimate interests where appropriate.

Consent

We may rely on your freely given consent where appropriate. This may include communicating information about our Services, including marketing material, where consent is required or is the appropriate basis for that communication under data protection and electronic marketing laws. We also rely on your consent to collect biometric information as part of account recovery identity checks where this is needed.

Legitimate interests

We may process Personal Data where necessary for our legitimate interests, provided those interests are not overridden by your rights and interests.

Our legitimate interests include:

• Administering and managing our relationship with you, including accounting, auditing and other activities connected with our business relationship
• Managing our relationship with your organisation where our contractual relationship is with that organisation rather than with you personally
• Analysis, benchmarking, improving and personalising our Services and communications
• Providing, maintaining and improving our Website and Services
• Monitoring compliance with our policies and procedures
• Protecting the security, integrity and availability of our Website, Services and systems
• Preventing and detecting fraud, misuse and security threats
• Marketing
• Using Service-Related Personal Data to understand how our Services are used and to improve existing Services and develop new products and Services

Where we use Service-Related Personal Data for analysis, benchmarking, service and product improvement, we act as a controller. We consider whether the processing is necessary for our legitimate interests and balance those interests against your rights and interests.

Where appropriate, we take steps to minimise the personal data for those purposes. This may include removing or replacing information that directly identifies individuals and, wherever reasonably practicable, anonymising the data so that individuals can no longer be identified. Where data has been effectively anonymised so that individuals can no longer be identified, it is no longer treated as personal data.

Legal obligation

We may process Personal Data where this is necessary to comply with a legal or regulatory obligation that applies to us. This may include obligations relating to accounting, taxation, anti-money laundering, sanctions compliance and other regulatory requirements.

Where fraud or crime prevention is undertaken for our own business purposes rather than because of a specific legal obligation, we rely on our legitimate interests as described above.

To maintain records and conduct compliance checks, e.g. anti-money laundering, fraud, and crime prevention.

3. How we collect personal data

As controller

We may collect Personal Data:

Directly from you when you:

• Use our Website or Services
• Contact us, including through customer support
• Complete a form or make an enquiry
• Communicate with us including by telephone or other electronic means
• Otherwise interact with us

From our customers and Service Users, where Service-Related Personal Data is used by us for our own purposes.

Indirectly from public sources including:

• Company and commercial registers
• Sanctions lists
• News sources
• Third-party identity verification tools
• Other publicly available online sources

When you need to provide Personal Data

Where we ask you to provide Personal Data that is required by law or necessary for us to enter into or perform a contract with you, we will tell you when providing that information is mandatory and explain the consequences if you do not provide it.

As processor

We may receive Personal Data:

• From our customers, when they provide Personal Data that they control so that we can provide the Services, or other professional services on their behalf
• Directly from Service Users when they enter, upload or otherwise provide Personal Data through the Services.

In these circumstances, we process the Personal Data on our customer’s behalf and in accordance with their written instructions.

4. Personal data security

We have implemented technical and organizational measures in an effort to safeguard the Personal Data in our custody and control.

While we endeavor to always protect our systems, sites, operations, and information against unauthorized access, use, modification, and disclosure, due to the inherent nature of the Internet as an open global communications vehicle and other risk factors, we cannot guarantee that any information, during transfer or storage, will be absolutely safe from interception.

5. Storage, disclosure to third parties and cross-border transfers

All Personal Data is stored in highly secure data centres in Switzerland and the EU.

Cap Table Data processed as processor

We do not share Cap Table Data with anyone except as explicitly instructed by our company.

Cap Table Data, including equity data, documents and shareholder data is stored in Switzerland and the data center provider has no access to it.

Personal Data processed as controller

This includes General Personal Data and Service-Related Personal Data that we process for our own purposes.

In the context of our business activities, and in line with the purposes set out in this Privacy Notice and applicable data protection laws, we may disclose this Personal Data to third parties.

Certain integrated services may also enable you to provide Personal Data directly to third-party providers (“Recipients”). These may include services such as:

• Chatbots
• E-signature solutions
• Online forms
• Usage Monitoring
• Crash reporting
• Newsletter subscriptions
• Payment and billing providers
• Third-party identity verification tools
• Customer relationship management and business systems providers
• Professional advisers, auditors and insurers
• Regulators, courts, law enforcement or other authorities where disclosure is required or permitted by law

Where information you enter may be transferred to a Recipient, we will let you know so that you can decide what information to provide to that Recipient.

Cross-border transfers

Personal Data may be transferred to countries where our Recipients are located.

Where we transfer Personal Data to a country that is not recognised as providing an adequate level of data protection, we will put additional safeguards in place in accordance with applicable data protection law. For example, The European Commission’s Standard Contractual Clauses.

You may contact us using the details below if you would like further information about the safeguards we use for international transfers or to obtain a copy of the relevant safeguards.

6. Your data protection rights

Where we act as controller

When we process your personal data as a controller, you may have the following rights:

• Right to be informed – to receive clear information about how we collect and use your Personal Data.
• Right of access – to request confirmation that we process your Personal Data and to receive a copy of that Personal data, together with certain information about how it is used.
• Right to rectification – to ask us to correct Personal Data that you believe is inaccurate or to complete information that is incomplete.
• Right to erasure – to ask us to delete your Personal Data in certain circumstances, including where it is no longer needed for the purpose for which it was collected or where it has been unlawfully processed.
• Right to restrict processing – to ask us to limit the way we use your Personal Data in certain circumstances, for example while we consider a request to correct your Personal Data or an objection to our processing.
• Right to data portability – where applicable, to receive Personal Data you have provided to us in a structured, commonly used and machine-readable format and to ask us to transfer it to another controller. This right generally applies where processing is based on consent or contract and is carried out by automated means.
• Right to object – where we rely on legitimate interests, to object to our processing of your Personal Data on the grounds relating to your particular situation. We will stop processing unless we have compelling legitimate grounds to continue or the processing is required for the establishment, exercise or defence of legal claims. You may object to processing for direct marketing purposes at any time.
• Rights relating to automated decision-making – where applicable, to have safeguards in place where a decision that has legal or similarly significant effects on you is made solely by automated means.

These rights are not absolute. Whether a particular right applies will depend on the Personal Data concerned, the purpose for which we process it and the legal grounds on which we rely.

We may ask you to provide information to verify your identify before responding to your request, where it is necessary to protect your Personal Data and prevent unauthorised disclosure.

In addition to the above rights, you have the right to complain to the relevant data protection supervisory authority, where you believe that our processing of your Personal Data does not comply with applicable data protection law.

Withdrawing consent

Where we rely on your consent, you may withdraw it at any time. Once consent is withdrawn, we will stop processing your Personal Data for that purpose, unless another legal ground applies.

Withdrawal of consent does not affect the lawfulness of processing carried out before you withdrew your consent.

You can unsubscribe from marketing emails at any time by using the unsubscribe link in the email or by contacting us.

Access to Cap Table Data

You may request a copy of your Cap Table Data at any time, including in the event of our bankruptcy. However, access in the event of bankruptcy may be subject to legal limitations and cannot be guaranteed. A fee may apply where permitted by law.

Response times

We will respond to requests relating to your data protection rights without undue delay and within the period required by applicable data protection law.

Under the GDPR, this will usually be within one month of receiving your request. This period may be extended where permitted by law, for example, where a request is particularly complex, or where you have made a number of requests.

Where we act as processor

Where we process your personal data on behalf of one of our company customers, that customer is the controller and is responsible for handling requests relating to your data protection rights.

You should contact the organisation that gave you access to the Services if you wish to exercise your rights in relation to that processing. If you contact us about Personal Data where we process as a processor, we will refer your request to the relevant customer as appropriate.

7. Data Retention

We keep Personal Data for as long as necessary for the purposes for which it was collected and processed, including to meet any legal, regulatory, accounting, reporting or contractual requirements.

Where we act as controller

Where we process Personal Data as a controller, we retain it for as long as is necessary, which is generally for six (6) years after we stop processing that Personal Data.

Where we act as processor

Where we process Personal Data on behalf of a customer, we retain and delete that Personal Data in accordance with the customer’s written instructions and the terms of our agreement with that customer, subject to any legal requirements that apply to us.

At the end of the relevant period, we will delete or anonymise Personal data, unless we are required or permitted by law to retain it for longer.

8. Modifications and additions to this notice

We may update this Privacy Notice from time to time to reflect changes in how we process your Personal Data, changes to our Services or changes in applicable legal requirements.

The effective date of this Privacy Notice is shown below, and we encourage you to review it periodically to stay informed about our privacy practices.

Where we intend to use Personal Data for a new purpose, we will update this Privacy Notice and provide any additional information required by applicable data protection laws before starting that processing.

We will inform you of material changes where appropriate.

Contact information

If you have any questions about this Privacy Notice, please contact us at:

Email – privacy@ledgy.com

Effective Date: 29 October 2026