Privacy Policy

Raveum Inc., a Delaware corporation and its affiliates (“we”, “us” or “our” or “Raveum”), doing business online as www.raveum.com (the “Site” or “Platform”), understands that your privacy is important to you. This privacy policy (the “Policy”) has been compiled to better serve those who are concerned with how their ‘personal information’ is being used online. Personal information, as used in United States privacy law and information security and as further defined below, is information that can be used on its own or with other information to identify, contact, or locate a single person, or to identify an individual in context. Please read our privacy policy carefully to get a clear understanding of how we collect, use, protect or otherwise handle your Personal information. When you visit or interact with the Site, apply to join our Platform, or utilize any of our services (together, our “Services”), you consent to the terms described in the most recent version of this Privacy Policy. You should also read our Terms of Service to understand the general rules about your use of this Site, and any additional terms regarding our Privacy Policies that may apply when you access particular services or materials on certain areas of this Site. “You,” “your,” visitor,” or “user” means the person accessing this Site.

This Site uses cookies to operate the Site, to remember your preferences, and to understand how the Site is used. By continuing to use our Site, you accept the terms of this Privacy Policy (including how we use cookies) and our Terms of Service. You can manage your cookie preferences at any time through the cookie preference centre on our Site, but please note that if you disable cookies you may not be able to use all the features of our Site.

This Privacy Policy (together with our Terms of Service and any other policies referenced) identifies how we will collect and process any personally identifiable information, such as your name, email, address, financial account information, net worth, etc., that we collect from you, or that you provide to us.

If you are a California resident, our privacy practices comply with the California Online Privacy Protection Act of 2003 (“CalOPPA”) and the California Consumer Privacy Act of 2020 (“CCPA”).

If you are a resident of the European Economic Area (“EEA”), Switzerland or the United Kingdom, this Privacy Policy also outlines additional policies applicable to our collection and processing of your personal information, which can be found here.

If you are located in India, this Privacy Policy also describes how Raveum Inc. and Raveum LLP, our Indian subsidiary, process your personal data under the Digital Personal Data Protection Act, 2023 and the rules made under it. Those additional provisions are set out in Section 12.

We will review and update this Policy as required to keep current with rules and regulations, new technologies and security standards. We will post those changes on the website or update the “last updated” date of the Privacy Policy. If the changes are material, you will be notified via a notice on our website. We encourage you to check our Site frequently to review the current Privacy Policy in effect and any changes that may have been made to it.

By providing your Personal information to us in any format (e.g., via email, telephone, fax, letter, digitally, or in person) and/or continuing to use any of our services or visiting our Site you accept and consent to the practices described in this Privacy Policy and Information Notice.

CONTENTS

INTRODUCTION

WHAT PERSONAL INFORMATION DO WE COLLECT?

HOW DO WE USE PERSONAL INFORMATION?

DO WE SHARE YOUR PERSONAL INFORMATION WITH ANY THIRD PARTIES?

OUR STORAGE OF YOUR PERSONAL INFORMATION

ACCESS TO OTHER WEBSITES

PROTECTING CHILDREN’S PRIVACY

ADDITIONAL POLICIES IN COMPLIANCE WITH THE CCPA

ADDITIONAL POLICIES IN COMPLIANCE WITH CALOPPA

ADDITIONAL POLICIES IN COMPLIANCE WITH EEA PRIVACY LAWS

ADDITIONAL POLICIES FOR RESIDENTS OF OTHER U.S. STATES

ADDITIONAL POLICIES FOR INDIA (DIGITAL PERSONAL DATA PROTECTION ACT, 2023)

INTERNATIONAL USERS

CONDITIONS OF USE AND CHANGES TO OUR PRIVACY POLICY

FAIR INFORMATION PRACTICES

CAN SPAM ACT-

CONTACTING US

INTRODUCTION

This Privacy Policy describes how the Company collects, uses, and shares information about visitors to our Site at raveum.com, visitors who contact us to purchase services or materials or request information, and other users of our services. The Site and our services and materials regarding investment opportunities offered and provided through our Site are the “Services.” This Policy describes how we obtain and use personal data (which can be used to identify a specific individual) and anonymous data (which cannot).

Region specific provisions. Certain provisions of this Policy, which are clearly labelled, apply only to users who are citizens or residents of particular regions (e.g., the EU or California). Otherwise, the Policy applies to all users of our Services, regardless of location.

Children. We do not allow use of our Services by any individual younger than the age 18 or the age of majority, whichever is older. If you become aware that a child (based on the jurisdiction where the child lives, which in the United States means someone under the age of 13) has provided us with personal data without parental consent, contact us at the location identified below in the Contact Us section.

WHAT PERSONAL INFORMATION DO WE COLLECT? We collect information...

We collect personal information that you enter on our Site or otherwise volunteer to us when you contact us to, among other things, , request information,. register for an account, complete investor onboarding and identity verification, or subscribe for an investment offered through our

Platform. You can choose not to provide certain information, but then you might not be able to take advantage of many of our features.

For purposes of this Policy, “Personal Information” means information (whether stored electronically or in paper-based filing systems) relating to a living individual who can be identified from that data (or from that data and other information in our possession). Personal Information comprises the categories of Personal Information defined by the CCPA, which includes:

Identifiers

Name, address, email, phone, SSN, driver's license

Other Data

Financial information, Financial information, including bank account details, payment card details, tax identification numbers, source of funds and net worth information

Protected Classes

Race, gender, sexual orientation, religion

Commercial Information

Records of personal property, purchasing or consuming histories or tendencies

Biometric Information

Fingerprints, retina scans, face prints, and facial images or liveness scans used to verify your identity

Internet Activity

Browsing history, search history, IP address, website interactions

Geolocation Data

GPS coordinates, location history

Sensory Data

Audio, electronic, visual, thermal, olfactory

Professional Data

CV, resume, employment history

Education Data

Educational background, grades, scores

Inferences

Drawn from the above categories, such as preferences, characteristics, attitudes, predispositions, abilities, aptitudes, intelligence, psychological traits

The examples given in this table are not meant to provide an exhaustive list, but are examples of the kinds of data included in each category. We do not collect Personal Information in every one of these categories, and we identify below which categories we collect.

Personal Information under the CCPA also includes any other category of personal information not included within the CCPA’s definition that are defined in California Civil Code § 1798.80(e). We refer to this category as “Other Data,” and it includes information such as financial information (bank account number, credit card number, debit card number), medical information, health insurance information, and insurance policy number.

Personal Information also includes “Sensitive Personal Information” as defined by the CCPA. For our Services this may include your government identification numbers (such as Social Security number, PAN, Aadhaar-linked identifiers, passport or driver’s license number), account log-in credentials, financial account numbers and, where you provide them, facial images used for identity verification. We collect and use Sensitive Personal Information only for the purposes permitted by the CCPA, including verifying your identity, performing our contract with you, preventing fraud, and complying with legal and regulatory obligations. We do not use or disclose Sensitive Personal Information to infer characteristics about you.

We collect only that Personal Information that is relevant for the purposes for which the data is requested. We do not use your Personal Information in any way that is incompatible with the purposes for which it was collected or for which you have consented.

2.1. INFORMATION YOU GIVE US

We collect only that Personal Information that is relevant for the purposes for which the data is requested. We do not use your Personal Information in any way that is incompatible with the purposes for which it was collected or for which you have consented.

Identifiers: name, address, email, and phone; for current or prospective affiliates, suppliers, agents, and subcontractors, personal information such as social security number, federal tax ID number, or other relevant information, as applicable

Other Data: (California Civil Code § 1798.80): bank account, payment card and other financial account information; tax identification numbers; income, net worth and source of funds information; and accreditation or eligibility evidence you submit in connection with an investment

Professional Data: professional data and education information such as resumé or C.V., salary history, education history, citizenship information, as applicable

Education Information: data regarding education training and related certifications and degrees

Inferences: personal information about your investment goals and aspirations derived from our Services, or inferences derived from that information

Personal Likeness and Biometric information: we may collect a photograph of your government-issued identity document and a facial image or liveness scan for the sole purpose of verifying your identity as part of our know-your-customer checks. We do not use this information for any other purpose, and we do not collect fingerprints, retina scans or Sensory Data.

When you subscribe to make an investment using our Services, we may also collect additional bank information and related information to, among other things, enable issuers of securities, including without limitation affiliated issuers (“Issuer(s)”), and you to originate fund transfers to the Issuer and the Issuer to make subsequent investment disbursements to you.

Compliance Information: to meet our legal obligations we also collect information required for know-your-customer, anti-money laundering, sanctions and tax reporting purposes. This includes proof of identity and address, tax residency and tax identification numbers, source of funds and source of wealth information, beneficial ownership details where you invest through an entity, and the results of sanctions, politically exposed person and adverse media screening.

2.2 INFORMATION WE COLLECT AUTOMATICALLY

Internet Activity: When you visit our Site, our domain hosting provider automatically collects and stores the following information:

The Internet protocol (IP) address used to connect your computer to the Internet, referring website address, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform;

Information about your visit, including the full Uniform Resource Locators (URL), clickstream to, through and from our Site (including date and time), pages on our Site you viewed; page response times, download errors, duration of page visits, page interaction information (such as scrolling, clicks, and mouse-overs), methods used to browse away from the page; and

Our Site uses cookies and pixel tags to collect this information.

2.3 COOKIES

Our Site uses cookies and related technologies, such as web beacons, to collect information on our Site. A cookie is a text file that is placed on your hard disk by a web page server. Cookies cannot be used to run programs or deliver viruses to your computer. Cookies are uniquely assigned to you and can only be read by a web server in the domain that issued the cookie to you. One of the primary purposes of cookies is to provide a convenience feature to save you time. The purpose of a cookie is to tell the Web server that you have returned to a specific page. For example, if you register with us, a cookie helps us to recall your specific information on subsequent visits. This simplifies the process of recording your Personal Information, such as billing addresses, shipping addresses, and so on. When you return to our Site, the information you previously provided can be retrieved, so you can easily use the features that you customized. A web beacon is a small graphic image that allows the party that set the web beacon to monitor and collect certain information about the viewer of the web page, web-based document or e-mail message, such as the type of browser requesting the web beacon, the IP address of the computer that the web beacon is sent to and the time the web beacon was viewed. Web beacons can be very small and invisible to the user, but, in general, any electronic image viewed as part of a web page or e-mail, including HTML based content, can act as a web beacon. We may use web beacons to count visitors to the web pages on the Site or to monitor how our users navigate the Site, and we may include web beacons in e-mail messages to count how many messages sent were actually opened, acted upon or forwarded.

Third party vendors also may use cookies on our Site. For instance, we may contract with third parties who will use cookies on our Site to track and analyze anonymous usage and volume statistical information from our visitors and members. Such information is shared externally only on an anonymous, aggregated basis. These third parties use persistent cookies to help us to improve the visitor experience, to manage our Site content, and to track visitor behavior. We may also contract with a third party to send email to our registered clients, coaches, users, visitors, or members.

To help measure and improve the effectiveness of our email communications, our email service provider may set cookies. All data collected by a service provider on our behalf is used solely by us and on our behalf, and is shared externally only on an anonymous, aggregated basis. We do not permit third parties to post advertisements on our Site, we do not allow third party advertising cookies or web beacons to be set through our Site, and we do not use cookies or similar technologies to build advertising profiles or to deliver advertising to you on other websites or platforms.

You may accept or decline cookies. Most Web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. If you choose to decline cookies, you may not be able to fully experience the interactive features of our Site.

You can also manage your cookie preferences at any time through the cookie banner and preference centre on our Site. Where required by law, we set non-essential cookies only after you consent to them.

3. HOW DO WE USE PERSONAL INFORMATION?

3.1. INFORMATION YOU GIVE US

We will use this information:

to provide you with the Services that you request from us

to carry out our obligations arising from any contracts entered into between you and us

to contact you in the future to provide you with information about new materials and services we offer or plan to offer

to notify you about changes to our Services

to comply with applicable laws and regulations

to assess your suitability for participation in investment opportunities offered through our Platform, and to determine additional materials, services, or events to recommend and market to you

for training purposes, quality assurance, and to record details about the materials and services you order from us and investments you may make through our Platform

to verify your identity and to carry out anti-money laundering, sanctions, politically exposed person and other background screening required by applicable law.

to perform data analyses (including anonymization and aggregation of Personal Information)

to qualify you as an “accredited” prospective investor, as that term is defined in Regulation D, Rule 501(a) promulgated by the Securities and Exchange Commission under the Securities Act of 1933

to comply with our obligations under the U.S. Bank Secrecy Act and OFAC sanctions programs and, in relation to our Indian operations, the Prevention of Money Laundering Act, 2002, the Foreign Exchange Management Act, 1999 and the rules and regulations made under them

to administer your investment, including processing subscriptions and remittances, making distributions, preparing tax reporting such as Schedule K-1 and Form 1042-S, and sending investor reports and other investor communications

3.2 INFORMATION WE COLLECT ABOUT YOU

We use the information we collect to operate and improve our Site and our Services, and to send you information about our Services where you have agreed to receive it. We also use it to manage our website and for internal operations such as troubleshooting, data analysis, testing, research and surveys. This information helps us present content effectively for you and your device, and assists us in keeping our Site safe and secure. We also use your information to determine whether you qualify as an accredited prospective investor under Regulation D, Rule 501(a) of the Securities Act of 1933, or as a non-US person under Regulation S of the same Act. We do not use your information to deliver targeted or cross-context behavioural advertising.

When you use our mobile app, we collect device and usage data for analytics, performance and security purposes, including app version, device type, operating system version, crash reports, and in-app activity such as screens viewed and features used. We use this information to operate the app, diagnose faults, and improve your experience. We do not collect advertising identifiers such as the Apple Identifier for Advertisers or the Google Advertising ID, we do not integrate advertising software development kits, and we do not transmit app event data to advertising platforms.

3.3 INFORMATION WE RECEIVE FROM OTHER SOURCES

We will combine this information with information you give to us and information we collect about you. We will use this information and the combined information for the purposes set out above (depending on the types of information we receive).

4. DO WE SHARE YOUR PERSONAL INFORMATION WITH ANY THIRD PARTIES?

We do not sell your Personal Information, and we do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA and comparable state privacy laws. To provide the Services, we disclose Personal Information to service providers for the business purposes described below. Each of those disclosures is made under a written contract that specifies the limited purpose of the disclosure and prohibits the service provider from selling or sharing the information, from retaining, using or disclosing it for any purpose other than performing the services for us, and from combining it with information received from other sources. Some of those service providers, such as our identity verification providers described in Section 5, collect your Personal Information from you in the first instance and provide the relevant results to us.

Our service providers are contractually obligated to comply with all applicable laws (e.g., CalOPPA, CCPA, other U.S. state privacy laws, the GDPR, the UK GDPR and the Indian Digital Personal Data Protection Act, 2023), and all such third parties use your Personal Information only on our behalf and under our instructions on how your information may be used and processed. We take reasonable steps to ensure these third parties use your Personal Information only for the purposes for which they have been engaged by us and that they do not share or sell your Personal Information to anyone else.

By enjoying our Services and sharing your Personal Information, you agree that we have the right to share the categories of Personal Information we collect, as identified in Section 2 with our service providers for the following business purposes:

Sales – for the purpose of fulfilling requests from you to purchase materials and services from our Site

Marketing – for the purpose of sending you direct marketing about our Services where you have agreed to receive it.

Cloud services – for provision of cloud storage services

Contractual performance – for the performance of any contract we or our service providers enter into with you with respect to your use of our Site

Web analytics – analytics and search engine service providers that assist us in the improvement and optimization of our Site

Investment administration – banks, escrow agents, fund administrators, transfer agents, custodians, tax advisers, auditors and legal counsel engaged in connection with an offering in which you invest

Identity and compliance verification – providers of know-your-customer, anti-money laundering, sanctions screening, fraud prevention and investor accreditation or eligibility verification services

Cross-border payments – authorised dealer banks and remittance partners, including for remittances made under the Reserve Bank of India Liberalised Remittance Scheme

We may also disclose your personal information to third parties in the following circumstances:

In the event that we sell or buy any business or assets, in which case we will disclose your Personal Information to the prospective seller or buyer of such business or assets as part of the purchase, transfer, or sale of services or assets

If we sell all or substantially all of our assets to a third party, in which case personal information about our customers will be one of the transferred assets

If we are under a duty to disclose or share your Personal Information in order to comply with any legal obligation, or any lawful request by public authorities (including to meet national security or law enforcement requirements), or in order to enforce or apply our Terms of Service and other agreements; or to protect the rights, property, or safety of us, our customers, or others

Whenever we share information with third parties, we will take steps to ensure that the third parties put in place adequate measures to safeguard your Personal Information, and they will be required to use any Personal Information for only the intended purpose for which it was shared.

5. OUR STORAGE OF YOUR PERSONAL INFORMATION.

5.1 Identity and KYC data is collected and stored by our verification providers, not by us. We do not collect or store the documents and biometric data used to verify your identity. That verification is carried out for us by third party providers:

for investors located in India, Pine Labs, and

for investors located outside India, Veriff.

You submit your identity documents and any facial image or liveness scan directly to the relevant provider through its own interface. The provider collects, processes and stores that information on its own systems.

5.2 What we receive from the provider. We receive only the outcome of the verification and a limited record of it, namely your name as verified, the verification status, the document type and issuing country, the provider's reference number, the date and time of the check, and the results of any sanctions, politically exposed person or adverse media screening. We do not receive, and we do not store, images of your identity documents, your facial image, or any biometric template derived from it.

5.3 The providers' own privacy practices. Pine Labs and Veriff each handle your information in accordance with their own privacy policies, which we encourage you to read before you complete verification. Their retention periods for the underlying documents and biometric data are set by them, subject to the contractual limits and instructions in our agreements with them and to the retention obligations imposed on them by applicable law. Requests relating to the underlying verification data, including requests for deletion of your identity documents or biometric data, should be directed to the relevant provider, and we will assist you in doing so.

5.4 What we do store. We store the information you give us directly and the information described in Section 5.2. This includes your account and contact details, your investment records and subscription documents, your tax and payment details, your communications with us, and the verification record.

5.5 Security. We use reasonable and appropriate measures to protect the Personal Information we hold from loss, misuse and unauthorised access, disclosure, alteration and destruction, taking into account the risks involved in the processing and the nature of the Personal Information. These measures include encryption of data in transit and at rest, access controls based on business need, multi-factor authentication for administrative access, logging and monitoring, and contractual security and confidentiality obligations on our service providers. We review these measures periodically.

5.6 Retention. We keep the Personal Information we hold for as long as we need it for the purposes set out in this Policy, or for longer where the law requires it. We retain the verification record described in Section 5.2 for the period required by applicable anti-money laundering and securities law, and we retain tax and accounting records for the period required by applicable US and Indian law. Where you have registered but have not invested, we retain your account information for as long as your account remains open and for a reasonable period afterwards. We may also keep a record of correspondence with you, for example if you have made a complaint about a service, for as long as is necessary to protect us from a legal claim.

5.7 Marketing communications. You may unsubscribe from any of our online e-mail updates and marketing by following the unsubscribe instructions in the body of any e-mail message we have sent to you. We will take commercially reasonable steps to implement your unsubscribe requests promptly, but you may still receive promotional information from us by mail for up to 45 days, and up to 10 days for e-mail. You may also continue to receive information from those third parties to whom we have previously disclosed your Personal Information. When you unsubscribe, we will keep a record of your email address to ensure we do not send you marketing emails in future.

6. ACCESS TO OTHER WEBSITES.

Our Site may contain links to websites and services operated by third parties, including sponsors, banks, payment processors, identity verification providers and social media platforms. We provide these links for convenience only. We do not control those websites and services, and this Privacy Policy does not apply to them. We are not responsible for their content or their privacy practices. We encourage you to read the privacy policy of every website you visit before providing any personal information to it.

7. PROTECTING CHILDREN’S PRIVACY.

We are strongly committed to protecting the safety and privacy of children who visit our Site. Our Site is not designed nor is it intended to be used by anyone under the age of 18, at a minimum, and we do not knowingly collect personal information online from children under 13 and have adopted techniques to ensure compliance with this Privacy Policy and the Children’s Online Privacy Protection Act of 1998 (“COPPA”). Our Site includes content that we believe to be unsuitable for children under 13, and we encourage all parents to talk to their children about online safety and to monitor their children’s use of the Internet.

8. ADDITIONAL POLICIES IN COMPLIANCE WITH THE CCPA (CALIFORNIA).

The CCPA affords California consumers the rights with respect to their Personal Information set forth in this section.

8.1 RIGHT TO KNOW ABOUT PERSONAL INFORMATION COLLECTED, USED, DISCLOSED, OR SOLD

California consumers have the right to request that the Company disclose what personal information it has collected, used, disclosed, and sold over the 12-month period preceding the Company’s receipt of such a request and, for Personal Information collected on or after 1 January 2022, beyond that period unless doing so proves impossible or would involve disproportionate effort. To exercise this right, a California consumer must submit to the Company a verifiable request to know such information. This request can be submitted by following the procedures set forth in the Contact Us section.

8.2 RIGHT TO REQUEST DELETION OF PERSONAL INFORMATION

California consumers have the right to request the deletion of their personal information collected or maintained by the Company. To exercise this right, a California consumer must submit to the Company a verifiable request to delete such information. This request can be submitted by following the procedures set forth in the Contact Us section.

8.3 RIGHT TO NON-DISCRIMINATION FOR THE EXERCISE OF A CONSUMER’S PRIVACY RIGHTS

California consumers have the right to not be discriminated against because the consumer exercised any of the consumer’s rights under the CCPA. That means that the company may not deny goods or services to the consumer, charge different rates for goods or services, or provide a different level or quality of goods or services if the consumer chooses to exercise their rights under the CCPA (unless the different rate or different level or quality is reasonably related to the value to the business of the consumer’s data).

8.4 RIGHT TO CORRECT INACCURATE PERSONAL INFORMATION

California consumers have the right to request that the Company correct inaccurate Personal Information that it maintains about them, taking into account the nature of the Personal Information and the purposes for which it is processed. This request can be submitted by following the procedures set forth in the Contact Us section.

8.5 RIGHT TO KNOW WHAT PERSONAL INFORMATION IS SOLD OR SHARED

California consumers have the right to request that the Company disclose the categories of Personal Information it has sold or shared about them and the categories of third parties to whom that Personal Information was sold or shared. We have not sold or shared any Personal Information in the preceding twelve months. Accordingly, there are no categories of Personal Information sold or shared, and no categories of third parties to whom Personal Information has been sold or shared, for us to disclose.

8.6 RIGHT TO OPT OUT OF THE SALE OR SHARING OF PERSONAL INFORMATION

California consumers have the right to direct a business not to sell or share their Personal Information, including for cross-context behavioural advertising. We do not sell Personal Information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months. We also do not sell or share the Personal Information of individuals we know to be under sixteen years of age, and our Services are in any event not available to anyone under eighteen.

Because we do not sell or share Personal Information, there is nothing for you to opt out of, and we do not provide a "Do Not Sell or Share My Personal Information" link. If our practices change, we will update this Privacy Policy and provide an opt-out mechanism before any sale or sharing begins.

8.8 SUBMITTING A CCPA DATA REQUEST

To submit a request to know about the Personal Information we collect about you as described in Section 8.1,a request for correction as described in Section 8.4 or a request for deletion of your Personal Information as described in 8.2, please contact us by emailing us at support@raveum.com.

We are required to verify the identity of the individual requesting access to a consumer’s data or requesting deletion of a consumer’s data. To verify your identity, you must provide:

UserId and password for our Site; or

if we have previously received your email address, we may verify that you have access to that email address by sending a verification code; or

If we have previously received your mobile number, we may text you a verification code.

8.9 AUTHORIZED AGENT

California consumers may designate an authorized agent to exercise a CCPA right on the consumer’s behalf. If a consumer utilizes an authorized agent to exercise a CCPA right, the following proof that the agent has been authorized to act on the consumer’s behalf will need to be provided:

A written authorisation signed by the consumer permitting the agent to act on the consumer’s behalf, or a power of attorney granted under the California Probate Code; and

verification of the consumer’s own identity using one of the methods described in Section 8.8, and, where the agent is not acting under a power of attorney, direct confirmation from the consumer that the agent is authorised to act.

9. ADDITIONAL POLICIES IN COMPLIANCE WITH CALOPPA.

CalOPPA is the first state law in the United States to require commercial websites and online services to post a privacy policy. The law’s reach stretches well beyond California to require a person or company in the United States (and conceivably the world) that operates websites collecting personal information from California consumers to post a conspicuous privacy policy on its website stating exactly the information being collected and those individuals with whom it is being shared, and to comply with this policy. See more at: http://consumercal.org/california-online-privacy-protection-act-caloppa/#sthash.0FdRbT51.dpuf

According to CalOPPA we agree to the following:

Users can visit our Site anonymously

Once this privacy policy is created, we will add a link to it on our home page, or as a minimum on the first significant page after entering our website.

Our Privacy Policy link includes the word ‘Privacy’ and can be easily found on the page specified above.

Users will be notified of any privacy policy changes:

On our Privacy Policy page or on our Terms of Service page

Users are able to change their personal information:

By logging in to their account

We do not respond to Do Not Track browser signals, because no common industry standard for those signals has been adopted. We do not sell or share Personal Information, so there is no opt-out preference signal, including the Global Privacy Control, for us to act upon. If we ever begin selling or sharing Personal Information, we will honour such signals as required by law.

10. ADDITIONAL POLICIES IN COMPLIANCE WITH EEA PRIVACY LAWS AND UK PRIVACY LAWS .

In addition to the other policies described in this Privacy Policy, residents of the European Union, the EEA, Switzerland and the United Kingdom are afforded the following additional rights and protections as required by the General Data Privacy Regulation (“GDPR”)and, for the United Kingdom, the UK GDPR and the Data Protection Act 2018 (together, the “GDPR”) . The additional rights and protections set forth in this section of this Policy apply only to residents of the European Union or the EEA.

10.1 GDPR DEFINITIONS

THE FOLLOWING ADDITIONAL DEFINITIONS APPLY TO THIS SECTION OF THE PRIVACY POLICY:

“Controller” means the Company which is the organization that determines the purposes for which, and the manner in which, any Personal Information is Processed and used in its business.

“Processor” means any Person Processing Personal Information.

“Person” means a natural person, corporation, association, organization, partnership, or other legal entity.

“Processing” is any activity that involves use of the Personal Information. It includes, without limitation, obtaining, recording or holding the Personal Information, or carrying out any operation or set of operations on the Personal Information including organizing, amending, retrieving, using, disclosing, erasing or destroying it. Processing also includes transferring Personal Information to third parties.

10.2 THE LEGAL BASIS FOR PROCESSING YOUR PERSONAL INFORMATION

In order to comply with the GDPR, we are required to set out the legal basis for the processing of your Personal Information. In accordance with the purposes for which we collect and use your Personal Information, as set out above, the legal basis for processing your Personal Information will typically be one of the following:

our own legitimate business interests, or the legitimate business interests of our third party suppliers, vendors, and subcontractors, such as, for example, providing direct marketing to our customers of our materials and services that we think would be of interest, permitting prospective employees to search and apply for job opportunities, handling inquiries from our vendors and customers, or other instances where we have carried out a legitimate interests assessment and have established an existing legitimate interest

the performance of a contract that we have in place with you

your consent where appropriate

compliance with our legal obligations, including to meet national security or law enforcement requirements

10.3 WHERE WE STORE YOUR PERSONAL INFORMATION

Your personal information is stored on secure cloud infrastructure located in the United States. Our databases are hosted on MongoDB Atlas running on Amazon Web Services (AWS) data centers in the United States, and encrypted backups are maintained within the United States. For disaster-recovery purposes, copies of our encryption keys may be maintained in a secondary AWS region, also within the United States.

All personal information is encrypted in transit using TLS 1.2 or higher and encrypted at rest using AES-256 encryption. Highly sensitive identifiers — such as Social Security Numbers and Employer Identification Numbers collected for federal tax reporting — receive additional protection through field-level encryption: they are encrypted within our application before they ever reach our databases, using encryption keys managed separately in AWS Key Management Service, and are never stored, logged, or transmitted in unencrypted form. After submission, these identifiers are displayed only in masked form (last four digits).

We retain personal information only for as long as necessary for the purposes described in this Privacy Policy, including the retention of tax records for the period required under U.S. federal tax law. When the applicable retention period expires, sensitive identifiers are rendered permanently unreadable through cryptographic erasure.

Unfortunately, the transmission of information via the Internet is not completely secure. Although we will do our best to protect your Personal Information, we cannot guarantee the security of your data transmitted to our Site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorized access.

10.4 ADDENDUM TO HOW LONG WE STORE YOUR PERSONAL INFORMATION

In some cases, there is a legal requirement to keep Personal Information for a minimum period of time. Except in those circumstances, we do not keep your Personal Information for any longer than is necessary for the purposes for which the Personal Information was collected or for which it is to be further processed.

10.5 YOUR RIGHTS WITH RESPECT TO YOUR PERSONAL INFORMATION

Subject to certain exceptions, you have the following rights with respect to your Personal Information:

To receive or access a copy of the Personal Information that we hold about you

To request that any inaccurate or incomplete Personal Information be corrected or supplemented

To have your Personal Information erased, unless we have a legitimate reason to retain the Personal Information (such as if we are required to do so for legal reasons)

To ask us not to process your Personal Information for a particular purpose, including for marketing

To ask us to restrict the processing of your Personal Information in certain circumstances, for example while we check the accuracy of data you have challenged

To receive the Personal Information you have provided to us in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible

To object to processing carried out on the basis of our legitimate interests, and to object at any time to processing for direct marketing purposes

To withdraw your consent at any time where we rely on consent, without affecting the lawfulness of processing carried out before the withdrawal

To lodge a complaint with your local supervisory authority, or with the Information Commissioner’s Office in the United Kingdom

Not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not currently make investor eligibility decisions by automated means alone.

All of these rights are subject to certain conditions and exemptions. For example, we will not be obligated to erase your Personal Information if we need to retain it to protect ourselves in the event of a legal claim.

To exercise any of these rights, please submit a written request to us using the contact information set forth below. The Company reserves the right to charge a fee in dealing with such a request as permitted by applicable law and regulations. You may also opt out of receiving additional marketing information by using the unsubscribe feature in any marketing email we send you.

Our data protection contact for the purposes of this Section 10 is support@raveum.com. We will respond to your request within one month, and will tell you if we need to extend that period.

11. ADDITIONAL POLICIES FOR RESIDENTS OF OTHER U.S. STATES.

Residents of other U.S. states with comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware and others as those laws come into effect, have rights that are broadly similar to the California rights described in Section 8. Depending on your state, these may include the right to confirm whether we process your personal data and to access it, the right to correct inaccuracies, the right to delete personal data, the right to obtain a portable copy, and the right to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects. We do not engage in targeted advertising, we do not sell personal data, and we do not carry out profiling of that kind, so there is nothing for you to opt out of in relation to those activities. Where your state law provides a right of appeal, you may appeal our refusal of a request by replying to our decision, and we will respond in writing within the period your state law allows. To exercise any of these rights, contact us at support@raveum.com.

We do not knowingly process the personal data of a known child, and we do not use personal data for targeted advertising or sell personal data where we know the individual is under the age at which consent is required by the applicable state law.

12. ADDITIONAL POLICIES FOR INDIA (DIGITAL PERSONAL DATA PROTECTION ACT, 2023).

This Section 12 applies to individuals in India whose personal data we process. For that processing, Raveum Inc. acts as the Data Fiduciary and Raveum LLP, our Indian subsidiary, acts on our behalf as a Data Processor. You are the Data Principal.

We process your personal data on the basis of the consent you give us when you register or submit information through our Platform, or on the basis of a legitimate use permitted by the Digital Personal Data Protection Act, 2023, including compliance with a legal obligation in India. Where we rely on consent, we give you an itemised notice at the point of collection describing the personal data we collect and the purpose of processing, and you may withdraw your consent at any time by writing to support@raveum.com. Withdrawing consent does not affect processing carried out before the withdrawal, and we may continue to retain personal data where Indian law requires it.

As a Data Principal you have the right to obtain a summary of the personal data we process and the processing activities we carry out, the identities of other Data Fiduciaries and Processors with whom we have shared your personal data and the categories of data shared, the right to correction, completion, updating and erasure of your personal data, the right to nominate another individual to exercise your rights in the event of your death or incapacity, and the right to a grievance redressal mechanism.

To exercise these rights or to raise a grievance, contact our Grievance Officer at support@raveum.com. We will respond within the period prescribed under the Digital Personal Data Protection Act, 2023 and the rules made under it. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

We may transfer your personal data outside India, including to the United States, in order to provide the Services. We do so subject to the restrictions notified by the Central Government from time to time and subject to contractual protections with the recipients of the data. If you are investing through the Reserve Bank of India Liberalised Remittance Scheme, we will also share your personal data with your authorised dealer bank and with our remittance partners as required to process the remittance.

13. INTERNATIONAL USERS.

The Site may be accessed by users located outside the United States. If you choose to use the Service from the European Union, the Far East, or other regions of the world with laws governing data collection and use that may differ from U.S. law, then please note that you are transferring your personal information outside of those regions to the United States, and that by providing your personal information on or through the Site then you consent to that transfer.

15. CONDITIONS OF USE AND CHANGES TO OUR PRIVACY POLICY.

If you choose to visit our Site, your visit and any dispute over privacy is subject to this Notice and our Terms of Service, including limitations on damages, resolution of disputes, and application of the law of the State of Delaware. If you have any concern about our privacy practices, please contact us with a thorough description, and we will try to resolve it. As our business changes, and laws and regulations concerning our business change, our Privacy Policy and Terms of Service may change also. We may e-mail periodic reminders of our notices and conditions, but you should check our Site frequently to see recent changes. Unless stated otherwise, our current Privacy Policy applies to all information that we have about you and your account.

16. FAIR INFORMATION PRACTICES.

The Fair Information Practices Principles form the backbone of privacy law in the United States and the concepts they include have played a significant role in the development of data protection laws around the globe. Understanding the Fair Information Practice Principles and how they should be implemented is critical to comply with the various privacy laws that protect Personal Information.

In order to be in line with Fair Information Practices, should a data breach occur, we will notify affected users by email without undue delay and in any event within the time limits required by the applicable law, which for many U.S. states is as soon as reasonably practicable and, under the GDPR, is without undue delay and where feasible within 72 hours of our becoming aware of a notifiable breach.

We also agree to the individual redress principle, which requires that individuals have a right to pursue legally enforceable rights against data collectors and processors who fail to adhere to the law. This principle requires not only that individuals have enforceable rights against data users, but also that individuals have recourse to courts or a government agency to investigate and/or prosecute non-compliance by data processors.

17. CAN SPAM ACT AND TEXT MESSAGES.

The CAN-SPAM Act is a United States federal law that sets the rules for commercial email, establishes requirements for commercial messages, gives recipients the right to have emails stopped from being sent to them, and spells out tough penalties for violations.

We collect your email address to:

Process orders and to send information and updates pertaining to orders

Send you additional information related to our materials or Service.

To be in accordance with CANSPAM we agree to the following:

NOT use false, or misleading subjects or email addresses

Identify the message as an advertisement in some reasonable way

Include the physical or post office box address of our business or site headquarters

Monitor third party email marketing services for compliance, if one is used

Honor opt-out/unsubscribe requests quickly

Allow users to unsubscribe by using the link at the bottom of each email

If at any time you would like to unsubscribe from receiving future emails, you can follow the instructions at the bottom of each email, and we will promptly remove you from ALL correspondence.

If you provide us with a mobile number and consent to receive text messages, we may send you service messages, one-time verification codes and, where you have separately agreed, marketing messages. Message and data rates may apply. You can stop marketing text messages at any time by replying STOP, and you can obtain help by replying HELP. We do not sell or share mobile numbers collected for text messaging with third parties for their own marketing.

18. CONTACTING US.

This Site is owned and operated by Raveum Inc., a Delaware corporation. If you have any questions or suggestions with respect to this Privacy Policy or our privacy practices, please e-mail us at legal@raveum.com, or you can contact us by mail at:

Raveum Inc.

600 Congress Avenue,

Austin, Texas 78701, USA

Raveum LLP

Thane, Maharashtra, India

Privacy queries and data rights requests: support@raveum.com

CCPA-SPECIFIC REQUESTS

Please submit CCPA-specific data requests through the procedures set forth in Section 8.