Privacy Notice

OKETO Inc., a Delaware corporation, is the controller responsible for the personal information described in this Notice.

Our registered office is:

For privacy questions or requests, contact privacy@oketo.com. You may also write to our registered office, marking your correspondence “Privacy”.

Our representative in the European Union under Article 27 GDPR is:

You may contact our representative at privacy-eu@oketo.com or by writing to the address above regarding the processing covered by this Notice.

This Notice covers the public website at oketo.com, general contact and partnership enquiries, and preliminary investor-interest and opportunity-submission forms operated by or on behalf of OKETO that expressly link to this Notice. It also covers correspondence and initial assessment arising from those enquiries.

Formal loan applications, restricted portal accounts, identity verification, investments and professional engagements require additional or separate privacy information. This includes lending application and account services at capital.oketo.com. The relevant notices identify the parties and processing involved.

OKETO remains responsible for processing for which it determines the purposes and means. Another provider’s privacy notice explains that provider’s independent processing where applicable.

References to our “Privacy Policy” elsewhere on the public website mean this Notice.

Depending on your interaction with us, we collect:

Contact and professional information, such as your name, email address, telephone number where provided, organisation, role, country and authority to represent an organisation.

Enquiry and project information, such as your message, investment interests, project location, sector, general capital requirements, public project website and non-confidential project summary.

Preliminary investor declarations, where requested, concerning your jurisdiction and professional or investor category. A declaration is not completed verification of investor status.

Correspondence and administrative records, including our communications, submission dates, review records and relevant form, notice and preference versions.

Technical information needed to deliver and protect the website and forms, which may include IP address, browser and device information, requested pages, timestamps and security or error records. Technical information can constitute personal information even where it does not include your name.

Privacy preferences and, where optional analytics are enabled with the required consent, information about use of the website.

We receive information directly from you and through your use of our website and forms. We may also receive relevant information from someone authorised to represent or introduce you, or consult public professional and company sources relevant to an enquiry.

Where we obtain your personal information indirectly, we provide the information required by applicable law within the required period, unless a lawful exception applies.

Our preliminary forms are intended for non-confidential initial enquiries. Do not submit identity documents, PESEL or Social Security numbers, bank or payment-card details, passwords, health information, other special-category information or criminal-conviction information through these forms.

If unnecessary or sensitive information reaches us, we assess whether to restrict access, delete it or arrange an appropriate secure process.

Where the GDPR or another applicable law requires a legal basis, we use the following bases for the relevant activities.

Responding to enquiries and assessing preliminary interest

We use contact, professional and enquiry information to understand your request, respond and assess whether further discussion or a business relationship is appropriate.

Our basis is our legitimate interest in managing enquiries and evaluating potential business relationships, balanced against your rights and reasonable expectations.

Steps before or during a contract

Where you personally request steps necessary before entering into a contract with you, or processing is necessary to perform that contract, we rely on contractual necessity for those specific activities. Communicating with someone representing a company does not automatically make all processing necessary for a contract with that individual.

Website operation and security

We use necessary technical and administrative information to deliver the website, maintain its operation, diagnose problems and prevent abuse. Our basis is our legitimate interest in providing a functional and secure service. Where device access or storage requires consent, we obtain it separately.

Optional analytics and marketing

Where optional analytics or marketing subscriptions are offered, we explain the relevant purpose and obtain consent where required. Making an enquiry does not subscribe you to marketing.

Legal obligations and claims

We process information where necessary to comply with applicable legal obligations. We may also retain and use necessary information to establish, exercise or defend legal claims, relying on our legitimate interests or another applicable legal basis.

Providing information is generally voluntary. Fields marked as required are needed to handle the relevant request. Without them, we may be unable to respond or assess the enquiry.

Before using information for a materially different purpose, we assess whether that use is lawful, provide any required additional information and obtain consent where required.

Information is available to authorised personnel and service providers who need it for the purposes described in this Notice.

Providers supporting the covered website and enquiry channels include:

• Vercel Inc., for website hosting, delivery and related technical services.
• Formspree, for general contact-form processing where that integration is used.
• Tally BV, for preliminary enquiry, investor-interest and opportunity-submission forms where those forms are provided through Tally.
• Providers of corporate email, secure storage, IT support and enquiry-record management used to handle the relevant communications and records.

Not every provider receives every category of information. Access depends on the function performed and the information needed.

Providers processing information on our behalf act under the applicable processing arrangements and instructions. Some providers also process limited information for their own purposes, such as account administration, security or legal compliance; their notices explain that processing.

We may disclose necessary information to professional advisers, competent authorities or parties involved in a proposed business transfer or reorganisation where lawfully justified and subject to appropriate restrictions.

Submitting an enquiry does not authorise unrestricted circulation to investors, lenders or other commercial counterparties. Any subsequent disclosure must have an appropriate legal basis, respect applicable confidentiality arrangements and be accompanied by additional privacy information where required.

OKETO is incorporated in the United States. Information covered by this Notice may be processed in the European Economic Area, the United States and other countries where relevant service providers and their authorised subprocessors operate.

Storage in Europe does not necessarily prevent access from another country.

Where an international transfer requires a transfer mechanism under applicable data-protection law, we use the mechanism appropriate to the recipient and processing. Depending on the arrangement, this is:

• An applicable adequacy decision, including the EU-US Data Privacy Framework where the US recipient’s participation and the relevant processing are covered.
• Applicable standard contractual clauses, together with the required assessment and any necessary supplementary safeguards.

Accepting our Website Terms or submitting an enquiry does not constitute blanket consent to international transfers.

Contact privacy@oketo.com for information about the safeguards relevant to your information and how to obtain a copy. Where necessary, confidential information may be redacted without preventing you from understanding the protection provided.

We retain information for the purpose for which it is needed and apply the following standard retention rules:

• Raw form submissions in the provider’s active response storage: up to 180 days after submission. Information needed for an ongoing enquiry may be transferred to the relevant correspondence or case record.
• Routine enquiries and correspondence: up to 24 months after the last substantive contact or resolution of the enquiry, whichever is later.
• Preliminary investor-interest or project cases that are declined, withdrawn or closed without proceeding: up to 12 months after closure. This period takes priority over the general correspondence period for records belonging to that case.
• Security and diagnostic logs directly controlled by OKETO: normally up to 30 days, unless particular records are needed to investigate an incident or preserve evidence.
• Privacy-request and complaint records: up to three years after closure, limited to information reasonably needed to demonstrate how the matter was handled.
• Browser privacy preferences: for the period stated in the Cookie Notice and relevant preference control.

These are maximum standard periods for the stated purposes. We may delete information earlier when it is no longer needed.

Where an enquiry becomes an engagement or transaction, necessary records follow the retention requirements applicable to that activity. Additional privacy information is provided where required.

We may retain a necessary, restricted record longer to comply with a specific legal obligation, investigate an active incident or establish, exercise or defend a legal claim. We assess and review the reason for continued retention.

Deletion from active systems may occur before removal from recovery systems or backups. Deleted Tally submissions may remain recoverable in its Trash for up to 90 days unless erased earlier. Residual provider backups follow the applicable documented deletion cycle. Recovery copies are restricted and are not used to extend ordinary business use.

If backup data are restored, applicable deletion and restriction requirements must be reapplied.

We may retain a minimal suppression record where necessary to respect a marketing objection.

The website and forms may use cookies or similar technologies for functions such as security, form operation and remembering privacy preferences.

Optional analytics and other optional tracking are activated only after you choose to allow them. You can reject optional tracking without losing access to the public website’s basic information and enquiry functions.

Our Cookie Notice explains the technologies used, their purposes, relevant providers and durations. Where optional tracking is offered, the website’s privacy controls allow you to change your choices and withdraw consent.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Any optional marketing subscription is presented separately and explains how to unsubscribe. You may object to processing for direct marketing at any time, and we will stop processing for that purpose.

Acceptance of the Website Terms is not consent to optional cookies, analytics or marketing.

We apply technical and organisational measures appropriate to the information and processing involved. These include access restrictions, appropriate authentication, protection of data transfers, oversight of service providers and procedures for responding to security incidents.

Access is limited according to responsibilities and the needs of the relevant enquiry or service.

No internet transmission or storage system can guarantee absolute security. This does not reduce our obligations under applicable law.

If you believe information submitted to OKETO has been exposed or misused, contact privacy@oketo.com. Do not include passwords or unnecessary sensitive documents in your report.

Depending on applicable law and the circumstances, you may have the right to:

• Obtain confirmation of processing, access your personal information and receive a copy.
• Correct inaccurate information and complete incomplete information.
• Request deletion or restriction of processing.
• Object to processing based on legitimate interests.
• Receive information in a portable format where the conditions for portability are met.
• Withdraw consent where processing relies on consent.
• Complain to a competent data-protection authority.

These rights are subject to the conditions and exceptions established by applicable law. An objection to direct marketing does not require you to demonstrate a particular personal situation.

To make a request, email privacy@oketo.com or write to our registered office. You do not need to create an account or agree to marketing to exercise a privacy right.

We may request proportionate information to verify identity or authority where necessary. If you no longer have access to the email address previously used, contact us so that we can consider an appropriate alternative verification method.

Where the GDPR applies, we respond without undue delay and normally within one month of receiving a request. Where legally permitted because of complexity or the number of requests, that period may be extended by up to two additional months. We explain the extension and reasons within the initial period.

Requests are normally free. We charge a fee or refuse a request only where applicable law permits, and explain the reason and available remedies.

You may complain to a competent supervisory authority, including the authority in the EEA country where you habitually live or work, or where an alleged infringement occurred. In Poland, this is the President of the Personal Data Protection Office, Prezes Urzędu Ochrony Danych Osobowych. In the United Kingdom, this is the Information Commissioner’s Office.

You do not need to contact OKETO before complaining to an authority.

US privacy rights depend on the applicable state law, its scope and relevant exemptions.

The categories, sources, purposes, recipients and retention rules for information covered by this Notice are described in the preceding sections.

For the public website and preliminary enquiries covered by this Notice, we do not sell personal information or share it for cross-context behavioural advertising, as those terms are defined under applicable law. We do not use this information for targeted advertising.

Depending on applicable law, you may have rights to access information about processing, correct information, request deletion or portability, limit certain uses of sensitive information, and opt out of sale, sharing, targeted advertising or certain profiling.

We do not use the preliminary enquiry functions to make decisions based solely on automated processing that produce legal or similarly significant effects. A submission does not automatically establish investment eligibility, approve financing or create an entitlement to participate in a transaction.

You may exercise applicable rights through privacy@oketo.com or by writing to our registered office. An authorised agent may act for you where permitted, subject to appropriate verification of authority.

If we decline a request, we explain the reason. Where an appeal right applies, you may appeal by replying to the decision or contacting privacy@oketo.com and identifying the decision you want reviewed.

We respond within applicable state-law deadlines, including any shorter deadlines for opt-out requests, and provide notice of any permitted extension.

We honour recognised opt-out preference signals, including Global Privacy Control, where applicable law requires. Legacy “Do Not Track” signals are not treated as consent to optional tracking.

We do not unlawfully discriminate or retaliate against anyone for exercising applicable privacy rights.

The preliminary enquiry functions are intended for adults acting in a business or investment capacity and are not directed to children. Do not submit children’s personal information through these forms.

If you believe a child has provided personal information, contact privacy@oketo.com. We assess the information and take appropriate steps to restrict or delete it, subject to applicable legal requirements.

We may update this Notice to reflect changes in processing or applicable requirements. The current version shows its effective date. Material changes are brought to your attention through an appropriate channel, and new consent is requested where required.

Publishing an updated Notice does not retrospectively create consent or remove privacy rights.

Earlier versions and an accessible copy of this Notice are available on request from privacy@oketo.com.