Privacy Policy

COTU Ventures FZE, COTU Ventures Investments LLC, and COTU Ventures Limited (together with our affiliates and the funds we manage, "COTU," "us," "our," or "we") have created this Privacy Policy to explain how we collect, use, store, share, and transfer personal data and information ("Personal Data") we obtain through our website at cotu.vc (the "Site"), the internet services we offer (together with the Site, the "Internet Services"), and through other means as described below. This Website is operated by COTU Ventures FZE, which provides administrative and management services to the COTU group. Investors, employees, contractors, and job applicants may receive a supplementary privacy notice; in the event of any conflict between this Privacy Policy and a supplementary notice, the terms of the supplementary notice will control.

When we use the term “Personal Data” in this Privacy Policy, we mean information relating to an identifiable individual person.

Where permitted by law, by using the Internet Services you consent to the use of your Personal Data described in this Privacy Policy.

Depending on where you are located and how you interact with the Internet Services, certain processing of your Personal Data by COTU may be subject to data protection laws including the United Arab Emirates Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “UAE PDPL”); the EU General Data Protection Regulation (the “GDPR”); the UK Data Protection Act 2018, together with the UK GDPR (the “UK GDPR”); and the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the “CCPA”). For example, this may apply where COTU processes the Personal Data of individuals in the EU, the UK, or California who use the Internet Services.

This Privacy Policy makes clear where its disclosures apply only to a specific regime. All other disclosures apply generally to all Personal Data we process.

Personal Data We Collect

We collect and use Personal Data in a number of ways, depending on how you interact with us. These include when you interact with us on the Internet Services, when you contact us by email or by other means, and when you visit one of our offices. If you provide Personal Data about any person other than yourself, you must ensure that they understand how their Personal Data will be used and have given their permission for you to disclose it to us and to our service providers.

Information you submit through the internet services

When you interact with the Internet Services, we may collect information you voluntarily provide to us, for example, when you complete an online form, send us a pitch deck, join our mailing list, or log in to an investor portal. This information may include:

• Identifiers, such as your name, username, password, and contact details (postal address, email address, phone number);
• Information about your role and organization, such as your employer, title, and professional background;
• Sensitive information such as account login credentials;
• Information about your communications with us, including Personal Data you provide in emails or in conversations with our personnel;
• Materials you submit voluntarily, such as pitch decks, business plans, financial information, and supporting documents; and
• Your marketing preferences, including any consents you have given us.

Information we collect automatically through the internet services

We may automatically collect certain Personal Data, including internet and other electronic activity information, to help us understand how the Internet Services are used (“Usage Data”). For example, each time you visit the Site, we may automatically collect your IP address; your browser, computer, or device type; access time; the webpage from which you arrived; and the webpages you access during your visit. We may combine Usage Data with other Personal Data in a way that allows us to associate Usage Data with an individual user. Some web browsers offer “do not track” settings; the Site does not currently honor those settings.

Information we collect from third parties

On occasion, we may receive Personal Data from third-party sources, for example, where service providers offer web analytics or reporting services to us, where publicly available sources (such as company websites, professional networks, or news media) inform our diligence on prospective investments and business contacts, or where vendors support our KYC, AML, or compliance obligations.

Information we collect when you visit one of our offices

When you visit one of our offices, we may collect Personal Data including your name when you sign in at reception, and visual information collected through security cameras.

Sensitive personal information

We may collect information that is considered “sensitive” under some laws (including the CCPA and the UAE PDPL), such as your account login credentials when you log in to an investor portal. Where we do, we use such information only for lawful purposes in compliance with applicable privacy laws, such as to provide the services or fulfill the requests you make of us, and to protect against malicious, deceptive, fraudulent, or illegal activity. Where required, we will obtain your consent prior to processing sensitive information.

Cookies

We may use cookies (small amounts of data sent from a web server to your browser and stored on your device) to keep track of your use of the Internet Services, validate your identity, remember your preferences, tailor the Internet Services to your interests, and improve their quality. You can generally set your browser not to accept cookies, or to notify you when a cookie is sent, giving you the opportunity to choose whether to accept it. If you set your browser to refuse cookies, certain Internet Services may not function properly. We may use Google Analytics to understand Site traffic; to learn more about Google’s use of cookies for analytics and to opt out, visit the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout.

Children

We do not knowingly collect Personal Data from minors under the age of 18, and we do not target the Internet Services to minors.

Our Use of Personal Data

We use Personal Data for the following purposes:

• To respond to inquiries, pitches, and requests from founders, investors, and other contacts;
• To evaluate potential investment opportunities and conduct related diligence;
• To establish and manage relationships with founders, limited partners, co-investors, advisors, service providers, and other counterparties;
• To operate, secure, monitor, and improve the Internet Services, including through analytics;
• To send updates, newsletters, and other communications where you have opted in or where permitted by law;
• To comply with legal, regulatory, audit, tax, KYC, and AML obligations applicable to our business and our funds;
• To establish, exercise, or defend legal claims and to protect our rights, property, and safety and those of others;
• For any other purpose disclosed to you at the time of collection or for which you have given consent.

Where required, our processing is based on one or more of the following legal bases: your consent (which you may withdraw at any time); the performance of a contract with you, or steps taken at your request before entering into a contract; compliance with a legal obligation; the protection of vital interests; or our legitimate interests in operating, promoting, and securing our business, where these are not overridden by your rights and interests.

EU/UK Disclosure: Where we require Personal Data to comply with our legal or contractual obligations, the provision of such Personal Data is mandatory. If it is not provided, we may not be able to provide the Internet Services. In all other cases, the provision of requested Personal Data is optional. We will not use Personal Data to formulate a decision based solely on automated processing (including profiling) which produces legal effects or similarly significantly impacts you.

How We Share Personal Data

We engage other companies and individuals to perform functions on our behalf, such as data analytics, hosting, communications, fund administration, audit, and legal and compliance services. These third-party service providers have access to Personal Data needed to perform their functions, but we require that they not use Personal Data for other purposes. Personal Data is not shared with unaffiliated third parties for their own marketing purposes unless we have obtained your consent in accordance with applicable law.

We may also share Personal Data with third parties: (1) in response to subpoenas, court orders, regulatory requests, or legal process, or to establish, protect, or exercise our legal rights and interests, or to defend against legal claims; (2) where we believe it is necessary to investigate, prevent, or take action regarding inappropriate or illegal activities, fraud, or potential threats to the safety of any person or property; (3) where we believe it is necessary to investigate, prevent, or address inappropriate use of the Internet Services; (4) with our affiliates, subsidiaries, or other entities under common control with us (in which case we will require those entities to honor this Privacy Policy); and (5) in connection with a corporate transaction, including any actual or proposed merger, acquisition, sale of assets, or financing involving COTU.

CCPA Disclosure: We may disclose the following categories of Personal Data to third parties for the business or commercial purposes described above: (1) identifiers, including your name, username, password, and contact details; (2) commercial information, including your marketing preferences and any consents you have given us; (3) internet or other electronic network activity information, including browser and device information, IP address, and cookie preferences; (4) professional and employment information, such as where we provide or receive employment references; and (5) visual information collected through office security cameras for security and investigatory purposes. We do not sell your Personal Data, nor do we share it for purposes of cross-context behavioral advertising, and we have not done so in the preceding 12 months. We do not sell or share the Personal Data of minors.

EU/UK Disclosure: Your Personal Data may be transferred to, processed in, and accessed from jurisdictions outside the EU and the UK by COTU and the third parties with which we share your Personal Data. Specifically, your Personal Data may be transferred to COTU entities and third parties in the United Arab Emirates and other jurisdictions. Where we transfer your Personal Data among COTU entities or to third-party organizations, we do so in accordance with the GDPR and/or the UK GDPR, including through the use of standard contractual clauses approved by the European Commission, a third party’s binding corporate rules, or another safeguard permitted by the GDPR or the UK GDPR.

UAE Disclosure: Where required under the UAE PDPL, cross-border transfers of Personal Data outside the UAE will be conducted only to jurisdictions providing an adequate level of protection or under appropriate contractual safeguards, or in accordance with another lawful basis recognized by the UAE PDPL.

Your Rights

We have controls in place designed to ensure that the Personal Data we collect and process is relevant, accurate, and appropriate for the purposes for which it is used. If you believe that any Personal Data about you is inaccurate, please contact us at ops@cotu.vc. Personal Data we have copied may remain in backup storage for a period of time after your request, and if you delete certain Personal Data, you may be unable to use the Internet Services in the future without re-submitting it. We will retain Personal Data whenever required to do so by applicable law or regulation.

Individuals in a number of jurisdictions may have rights in relation to their Personal Data. These rights vary by jurisdiction but may include the right to: (1) request access to and rectification or erasure of your Personal Data; (2) restrict or object to the processing of your Personal Data; (3) obtain a copy of your Personal Data in a portable format; and (4) lodge a complaint with a data protection authority. The rights described here are not absolute and may not apply to you in every case. To exercise any of these rights, please contact us at ops@cotu.vc.

If you wish to exercise your rights, we will need to verify your identity. We may ask you to confirm specific information you have previously provided to us. If we collect additional information for verification purposes, we will use it only for verification and delete it as soon as practicable. If you make a request through an authorized agent, we will require written proof that the agent is authorized to act on your behalf. We will respond within the time required by applicable law.

EU/UK Disclosure: You may be entitled to ask COTU for a copy of your Personal Data, to correct, delete, or restrict its processing, and to obtain the Personal Data you have provided in a structured, machine-readable format and ask us to share it with other organizations. You may also have the right to object to processing in some circumstances and may ask us not to send you direct marketing or carry out profiling at any time. You have the right to lodge a complaint about COTU’s processing of your Personal Data with a data protection authority in the place you live, work, or where the alleged infringement occurred. Where we have asked for your consent, you may withdraw it at any time without affecting any processing that has already taken place. These rights may be limited — for example, where fulfilling your request would reveal Personal Data about another person, infringe the rights of a third party, or where we are required by law to retain the Personal Data.

CCPA Disclosure: If you are a California resident, you may be entitled to request access to the categories or specific pieces of Personal Data that COTU collects about you, request that COTU delete or correct your Personal Data, and opt out of the sale and sharing of your Personal Data. COTU does not sell or share Personal Data as those terms are used under the CCPA, and has not done so in the preceding 12 months. The CCPA prohibits COTU from discriminating against you for exercising your CCPA rights. To exercise these rights, please email ops@cotu.vc.

UAE Disclosure: Under the UAE PDPL, you may have rights including the right to access, correct, delete, or restrict the processing of your Personal Data; to object to processing; to data portability; and to withdraw consent. You may also have the right to lodge a complaint with the UAE Data Office. To exercise any of these rights, contact us at ops@cotu.vc.

Retaining Your Personal Data

Where we process your Personal Data in connection with the Internet Services, we retain it for as long as needed to comply with our legal obligations or to communicate with you in connection with our relationship. Where we process Personal Data for marketing purposes or with your consent, we retain it until you ask us to stop and for a short period thereafter to allow us to implement your request. We also keep a record of any objection so we can respect your preferences in future. We retain administrative and financial records as required by applicable law and our internal record retention policies. All other Personal Data is retained for the time necessary to fulfill the purposes set out in this Privacy Policy, taking into account applicable statute-of-limitations and record-retention requirements.

Regulatory Notices

Some regulators have adopted rules requiring financial institutions to provide privacy notices to their clients. Where COTU is subject to such rules in connection with its regulated activities, those notices will govern how we use Personal Data for the purposes specified in them, in addition to this Privacy Policy.

Security

We have implemented administrative, technical, and organizational measures designed to help protect Personal Data from loss, misuse, and unauthorized access or disclosure. While we strive to protect Personal Data, no transmission or storage method can be guaranteed to be fully secure.

Vulnerability Reporting

If you believe you have found a vulnerability or security concern with a COTU application or product, please submit a report to ops@cotu.vc. Please include the type of issue, the name of the application or URL, a proof of concept, and the detailed steps required to reproduce the issue. We take all disclosures seriously.

Links

The Internet Services may contain links to other websites. We are not responsible for the privacy practices of any such website (whether accessed through an advertisement, service, or content link), and we urge you to review such practices before submitting any information or Personal Data to those websites.

Changes

We may update this Privacy Policy from time to time at our sole discretion and encourage you to review this page periodically. Any updated version will be effective as of the date set out in it. By continuing to use the Internet Services after such updates, you agree to the updated Privacy Policy, except where additional consent is required by applicable law.

Questions

If you have any questions about this Privacy Policy, please contact us by email at ops@cotu.vc.