Privacy policy.

Why this policy exists.

Katapult Holdco AS takes your privacy very seriously. This privacy policy has been prepared in line with the EU's General Data Protection Regulation (GDPR), which promotes fairness and transparency for all individuals in respect of their personal data.

This policy applies to all data we process across Katapult Holdco AS sites and services — including the Katapult Impact Platform. By using our services, you consent to our collection and use of personal data as described here.

The data controller.

We are Katapult Holdco AS, and our registered address is Universitetsgata 2, Oslo, Norway. For any question about this policy or about your personal data, you can contact us using our website's contact form or send an email to privacy@katapult.vc.

As a data controller, we collect a variety of data to deliver our services. Whenever we collect personal information from you, we let you know — and you are able to access information about what we collect and why.

What we collect, and why.

Personal data is any information that can be directly or indirectly linked to a living person — for example a name, email address, telephone number, or IP address. The categories of data we may collect include:

• Identification & contact data Name, email address, phone number, organisation, and role — for example when you fill in a contact form, subscribe to a newsletter, or apply for funding.
• Application & pipeline data Information you submit through applications, intake forms, or correspondence with our team about your company, your work, or a potential partnership.
• Technical & usage data Device, browser, IP address, time zone, and how you interact with our pages — collected automatically to operate, secure, and improve the site.
• Communications data Records of email, form, and event correspondence so we can follow up, send you information you request, and improve our processes.

The purposes we process for.

Marketing

We may send you marketing content about our application process, events, sites, services, products, and services of third-parties we consider our partners or members of the Katapult Holdco AS corporate family, through various communication channels.

Informational and other

We will send communications to you that are required or necessary to send to users of our services — notifications that contain important information and other communications you request from us.

You may opt out of receiving these communications by requesting to have your personal data deleted from our records by contacting us at privacy@katapult.vc.

Service operation & improvement

We use device and usage information to help us screen for potential risk and fraud, and more generally to improve and optimise our services — for example by generating analytics about how visitors browse and interact with our pages.

How we use cookies.

We collect cookies. Cookies are small pieces of data that websites send to a user's computer and are stored on the user's web browser. They are designed to enable the website to remember information — such as what a user might have put in a shopping cart, for example.

On our sites we always set cookies that are strictly necessary, meaning they are needed for the site to function properly. If you consent to it, we will also set other types of cookies — for example analytics cookies to help us understand how the site is being used.

You can provide or withdraw your consent to the different cookie categories at any time, by clicking the link "Manage cookies", which is available at the bottom of every page.

Sharing with third parties.

We may share information about you with other parties for Katapult Holdco AS's business purposes or as permitted or required by law, including:

• To comply with law Where required by law, legal process, or regulation — including responses to law enforcement authorities, government officials, or other third parties acting under a subpoena, court order, or other legal process or requirement applicable to Katapult Holdco AS or our corporate family.
• To prevent harm or fraud Where we believe, in our sole discretion, that disclosure of personal data is necessary or appropriate to prevent physical harm or financial loss, or in connection with an investigation of suspected or actual illegal activity.
• With service providers Vendors who help us run our infrastructure, communications, and analytics. They may only process data on our instructions and under appropriate safeguards.
• Within the Katapult family With other entities in the Katapult ecosystem where relevant to the service you are engaging with, on the basis described in this policy.

Your rights under the GDPR.

Under the GDPR you have a number of rights in relation to your personal data. These include:

• The right to be informed About the collection and use of your personal data.
• The right of access To your personal data and any supplementary information.
• The right to rectification To have any errors in your personal data corrected.
• The right to erasure To have your personal data deleted from our records.
• The right to restrict or object to processing Including for direct marketing purposes.
• The right to data portability To receive a copy of your data in a structured, commonly used format.
• Rights around automated decision-making Including profiling — i.e. where certain personal data is processed to evaluate an individual without human involvement.

We also give you the option to manage your data via an online account, if you have been signed up as a customer and received login information.

How long we keep your data.

While we do not hold personal data any longer than we need to, the duration depends on your relationship with us — for example whether you are a member of our community, an applicant, a portfolio company, or a counterparty in an active engagement.

When it is no longer necessary to retain your personal information, we delete or anonymise it. Different retention periods apply to different categories of data, and we may retain certain records longer where required by law.

Changes to this policy.

We update this privacy policy when necessary — for example, because we start processing your personal data in a new way, because we want to make the information clearer to you, or if it's necessary to comply with applicable data protection laws. We encourage you to regularly check this page for any changes. You can always check the top of this page to see when it was last updated.

By continuing to access or use our services after those changes become effective, you agree to be bound by the revised privacy policy.

Get in touch about your data.

If you want to exercise any of your rights, or if you have questions, comments, or concerns about how we handle your personal data, please reach out.