Privacy & Cookies Policy

Controller Information

Prospera Ventures Limited (registered in Ireland) ("Prospera", "we", or "us"), with registered office at 1st Floor, Dockgate, Dock Road, Galway City H91 22N2, Ireland, is the controller of personal data processed through your use of our platform or your interactions with us. We are committed to protecting your personal data in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Data Protection Acts 1998–2018 (together, "Data Protection Law"), and applicable Irish data protection law.

This Privacy & Cookies Policy ("Policy") explains how we collect, use, and protect personal information obtained through your use of our platform or your interactions with us. It also sets out your rights under data protection law and how you can exercise them.

Note: Links to other websites are included for convenience. We are not responsible for the content or privacy practices of external sites, and you should review their privacy notices separately.

What Data We Collect and Why

Technical Data

Like most online platforms, we gather statistical and analytical information on an aggregate basis about visitors to our website. This data cannot be used to identify or contact you directly and may include:

• IP addresses (anonymised where possible)
• Browser type and operating system
• Referring URLs and similar technical information
• Device identifiers and platform performance metrics

Purpose: We use this data to improve the functionality and performance of our services, detect technical issues, and enhance user experience. We do not use technical data for direct marketing.

Legal Basis: Legitimate interest in improving and maintaining our platform.

Personal and Contact Data

When you register, communicate with us, or use our services, we collect personal data such as:

• Name, email address, and phone number
• Correspondence and communication details
• Platform usage data (e.g., logins, clicks, aggregated activity logs)
• Investment preferences and account preferences
• Mobile device identifiers
• AML/KYC information as required by anti-money laundering and financial services regulations

Purpose: We process this data to provide and manage platform access, manage your account, personalise your user experience, comply with legal and regulatory obligations (including anti-money laundering and Know Your Customer requirements), and maintain records for business purposes.

Legal Basis:

• Contract performance – for providing and managing platform access and account services
• Legal obligation – for AML/KYC compliance and regulatory reporting
• Legitimate interest – for platform improvement, user personalisation, and fraud prevention

Platform Usage, Analytics, and Profiling

We may analyse your platform usage patterns, investment preferences, and interaction history to personalise your experience and improve our services (e.g., recommending relevant investment opportunities or tailoring content). This may include automated analysis to understand user behaviour and preferences.

Purpose: To improve user experience, support matchmaking and deal flow management, and provide relevant service recommendations.

Legal Basis: Contract performance (to deliver personalised services) and legitimate interest in improving our platform.

Your Rights: You have the right to know if we use automated decision-making with significant effects on you (see "Your Rights" section below).

Communications Data

When you contact us by email, phone, or via our web platform, we retain relevant correspondence for business, legal, and service improvement purposes, in line with our records management policy.

Purpose: To respond to your enquiries, maintain records of business interactions, and comply with legal obligations.

Legal Basis: Contract performance and legitimate interest.

Legal Basis for Processing

We process your personal data only where a lawful basis exists under the GDPR. The table below sets out our main purposes and corresponding legal bases:

Data Sharing and Disclosure

We may share your personal data with the following categories of recipients:

Service Providers

• IT service providers and hosting providers (data storage, security, backup)
• Analytics providers (e.g., Google Analytics)
• Email and communications service providers
• Legal, compliance, and accounting advisers
• Payment processors and financial service providers

All data processors acting on our behalf are contractually bound to maintain confidentiality and comply with applicable data protection standards. We enter into Data Processing Agreements where required by law.

Legal and Regulatory Authorities

We may disclose your personal data to legal, regulatory, or law enforcement authorities where:

• Required by law
• Necessary to protect our legal rights or the rights of others
• Needed to prevent fraud or abuse of our platform
• Required for anti-money laundering or counter-terrorism financing compliance

Business Transactions

We may disclose your personal data to third parties involved in business transactions such as mergers, acquisitions, reorganisations, or asset sales. In such cases, we will notify you and ensure appropriate protections are in place.

International Data Transfers

Some of your personal data may be transferred outside the European Economic Area (EEA), including to the United States (e.g., via Google Analytics and YouTube). When we do so, we ensure your data is protected by:

• An adequacy decision from the European Commission
• Standard Contractual Clauses (SCCs) or Binding Corporate Rules
• Other appropriate safeguards approved under GDPR

For further information: You can request details of the specific safeguards used for particular transfers. Please contact our Data Protection Officer (see "Contact Us" section).

Your Rights

Under EU and Irish data protection law, you have the following rights:

• Right of access: You can request a copy of the personal data we hold about you
• Right of rectification: You can request that we correct inaccurate or incomplete data
• Right of erasure: You can request that we delete your personal data (subject to certain exceptions)
• Right to restrict processing: You can request that we limit how we use your data
• Right to data portability: You can request a copy of your data in a structured, commonly used format
• Right to object: You can object to certain types of processing, including direct marketing
• Right to withdraw consent: Where we process data based on your consent, you can withdraw it at any time (this does not affect the lawfulness of processing before withdrawal)
• Rights relating to automated decision-making: You have the right not to be subject solely to automated decision-making that produces legal or similarly significant effects. We do not currently use automated decision-making of this kind, but we will inform you if this changes.

How to Exercise Your Rights

To exercise any of these rights, please contact our Data Protection Officer:

Email: compliance@prospera.ie

We will respond to requests within 30 days, or notify you if an extension is necessary.

Right to Lodge a Complaint

If you are unsatisfied with how we handle your data, you have the right to lodge a complaint with the Irish Data Protection Commission:

You may also contact your local Data Protection Authority in another EU member state.

Data Security

While no data transmission over the internet can be guaranteed to be 100% secure, Prospera implements appropriate technical and organisational measures to protect your personal data from unauthorised access, loss, alteration, or destruction. These measures include:

• Access controls and role-based access permissions
• Encryption of data in transit and at rest where appropriate
• Regular security assessments and updates
• Staff training on data protection and confidentiality
• Secure data storage and backup procedures

If you become aware of a security breach affecting your data, please contact us immediately at compliance@prospera.ie.

Data Retention

We retain your personal data only as long as necessary to fulfil the purposes for which it was collected, including compliance with legal, accounting, tax, and reporting requirements. Retention periods vary by data category:

After the retention period, data is either deleted or anonymised. Where anonymisation is not possible, secure deletion methods are used.

Cookies and Similar Technologies

What Are Cookies?

A cookie is a small text file stored on your device to help the website function, remember your preferences, and analyse usage. Prospera uses cookies and similar technologies (e.g., web beacons, pixels) to enhance user experience, analyse usage, support security, and deliver targeted communications.

Our Cookies

Strictly Necessary vs Non-Essential Cookies

Strictly necessary cookies (SESSION_ID, OptanonConsent) are essential for the platform to function and comply with your consent preferences. These are set automatically and do not require consent.

Analytics and tracking cookies (_ga, _gid, _gat, YouTube CONSENT) collect data about how you use our site. These cookies are only set after you have given explicit consent via our cookie consent banner.

Cookie Consent and Management

Consent requirement: Non-essential cookies (analytics, YouTube) are only set after you provide explicit consent through our cookie consent tool. Consent is not pre-ticked, and you can change or withdraw your cookie preferences at any time.

How to manage cookies:

• You can manage or disable cookies through your browser settings (see browser help pages for Chrome, Edge, Safari, or Firefox).
• You can manage your cookie consent preferences at any time via our cookie consent tool on the website.
• To withdraw or update consent, you can use our cookie consent banner or contact us.

Consent refresh: We will ask you to refresh your cookie consent preferences approximately every 6 months in line with Irish Data Protection Commission guidance.

Third-Party Analytics and Tracking

We use Google Analytics to understand how users interact with our platform. Google may process your data in the United States under Standard Contractual Clauses. YouTube cookies may also be set if you view embedded YouTube content.

• Google's privacy policy: https://policies.google.com/privacy
• Google Analytics opt-out: https://tools.google.com/dlpage/gaoptout
• YouTube's privacy notice: https://www.youtube.com/intl/en-GB/howyoutubeworks/our-commitments/protecting-user-data/

Third-Party Links

Our website may include links to third-party websites, social media platforms, and external services. Prospera is not responsible for their content, security, or privacy practices. We encourage you to review the privacy notices of any third-party sites before providing your personal data.

Changes to This Policy

Prospera may update this Policy periodically to reflect changes in our data processing practices, legal requirements, or platform functionality. When we make material changes, we will:

• Post the updated Policy on our website with a new "Effective Date"
• Notify you by email if the changes materially affect your rights or data processing
• Seek your consent if required by law

Your continued use of our platform following the posting of an updated Policy means you accept the updated terms.

Contact Us

If you have questions, concerns, or wish to exercise your data protection rights, please contact our Data Protection Officer:

Email: compliance@prospera.ie

We will respond to enquiries and data subject requests within 30 days or notify you if an extension is needed.