1. Introduction and Scope

Leveiir Capital Management LLC ("Leveiir Capital," "we," "us," or "our") is committed to protecting the privacy and security of personal information we collect about individuals who interact with our website, investment platform, and business operations. This Privacy Policy applies to all personal data collected through our website at https://leveiir.com (the "Site"), as well as through our investment evaluation, portfolio management, and LP relations activities.

This policy has been designed to comply with the European Union General Data Protection Regulation (EU GDPR) Regulation (EU) 2016/679, the UK General Data Protection Regulation (UK GDPR), the California Consumer Privacy Act of 2018 (CCPA) as amended by the California Privacy Rights Act (CPRA), and other applicable data protection laws. To the extent any provision of this policy conflicts with applicable law, the applicable law shall govern.

Leveiir Capital Management LLC is incorporated in the State of Delaware, United States. Our EU operations are conducted through Leveiir Capital Europe SARL, registered in France, which acts as a joint data controller for EU resident data. For EU and UK residents, Leveiir Capital Europe SARL serves as the designated EU Representative.

2. Data Controller Information

Primary Data Controller

Leveiir Capital Management LLC
228 Hamilton Avenue, 3rd Floor
Palo Alto, CA 94301
United States
Email: privacy@leveiir.com

EU Representative and Joint Controller

Leveiir Capital Europe SARL
12 Rue du Commerce
75015 Paris, France
Email: eu-privacy@leveiir.com

Data Protection Officer

Our Data Protection Officer can be reached at:
Email: dpo@leveiir.com
Postal: DPO, Leveiir Capital Management LLC, 228 Hamilton Avenue, 3rd Floor, Palo Alto, CA 94301, United States

UK Representative

For UK GDPR purposes:
Email: uk-privacy@leveiir.com

3. Categories of Personal Data We Collect

3.1 Information You Provide Directly

When you contact us, submit a pitch, request investor information, or otherwise interact with us, we may collect:

• Identity Data: Full name, job title, professional credentials, date of birth (for KYC purposes only), and government-issued identification numbers where required by law.
• Contact Data: Email addresses, telephone numbers, company address, and any other contact information you voluntarily provide.
• Business Information: Company name, role, industry, stage of business, funding history, revenue information, business plan details, pitch decks, and financial projections submitted for investment consideration.
• Financial Information: Accredited investor status, investment history, net worth and income information collected for regulatory compliance purposes from Limited Partners and prospective investors.
• Communications: The content of emails, meeting notes, due diligence reports, and other correspondence between you and Leveiir Capital representatives.

3.2 Information Collected Automatically

When you visit our Site, we automatically collect certain technical information including:

• Device and Browser Data: IP address (anonymized where required), browser type and version, operating system, device type, screen resolution.
• Usage Data: Pages visited, time spent on pages, referring URLs, click-through paths, download activity, and other interaction data.
• Cookie Data: Please see our Cookie Policy for detailed information about the cookies we use and how to manage them.

3.3 Information from Third Parties

We may receive personal data about you from:

• Professional networks and databases (such as LinkedIn, PitchBook, Crunchbase) in the course of investment sourcing activities
• Portfolio company founders who recommend colleagues or potential hires
• Co-investors and other venture capital firms with whom we have shared investment activities
• Background check providers and financial compliance services used in KYC/AML processes
• Publicly available sources including company filings, press releases, and professional publications

4. How We Use Your Personal Data

4.1 Investment and Business Activities

We process personal data related to founders, potential investees, and co-investors for the following purposes:

• Evaluating investment opportunities and conducting due diligence
• Managing relationships with portfolio company founders and executives
• Facilitating introductions between portfolio companies, co-investors, and strategic partners
• Assessing and monitoring the performance of our investment portfolio
• Complying with our fiduciary obligations to Limited Partners
• Preparing investment committee materials and board documentation

4.2 LP Relations and Fund Administration

For Limited Partners and prospective Limited Partners, we process personal data to:

• Fulfill our contractual obligations under Limited Partnership Agreements
• Conduct accredited investor verification and know-your-customer (KYC) procedures
• Satisfy anti-money laundering (AML) requirements under applicable law
• Provide capital call notices, distribution notices, and quarterly performance reports
• Maintain required regulatory records as a registered investment adviser

4.3 Website and Communications

We process technical and contact data to:

• Operate and improve our website and digital communications
• Respond to inquiries submitted through our contact form
• Send newsletters and investment-related updates where you have subscribed
• Analyze website performance and user experience
• Detect and prevent fraudulent or unauthorized access

5. Legal Basis for Processing (GDPR)

For individuals in the European Economic Area and United Kingdom, we rely on the following legal bases under Article 6 of the GDPR:

Processing Activity	Legal Basis (GDPR Art. 6)
Investment evaluation and due diligence	Legitimate Interests (Art. 6(1)(f)) — our legitimate interest in identifying and evaluating investment opportunities
Fulfilling contractual obligations to LPs	Contract Performance (Art. 6(1)(b))
KYC/AML compliance	Legal Obligation (Art. 6(1)(c))
Portfolio company management	Legitimate Interests (Art. 6(1)(f)) and Contract Performance (Art. 6(1)(b))
Newsletter and marketing communications	Consent (Art. 6(1)(a)) — where you have opted in
Website analytics	Legitimate Interests (Art. 6(1)(f)) — where non-essential cookies are used with consent
Regulatory reporting and legal compliance	Legal Obligation (Art. 6(1)(c))

Where we process special categories of personal data (such as biometric data for identity verification in certain jurisdictions), we rely on Article 9(2)(g) (substantial public interest) or Article 9(2)(b) (employment and social security obligations) as applicable.

6. Data Retention

We retain personal data for as long as necessary for the purposes described in this policy, subject to longer retention periods required by law:

• Investment inquiry and pitch data: 5 years from last contact, or 7 years if an investment was made
• LP and financial records: 7 years from the end of the relevant fund, as required by SEC and applicable financial regulatory requirements
• KYC/AML records: 5 years from the end of the relevant business relationship, as required by applicable AML law
• Portfolio company management records: For the duration of the investment plus 7 years
• Website analytics data: 26 months from collection (anonymized after 13 months)
• Contact form submissions: 3 years from last contact
• Newsletter subscribers: Until unsubscription plus 30 days

7. Data Sharing and Third-Party Disclosure

We do not sell your personal data. We may share your information with the following categories of recipients:

• Co-investors and syndicate partners: Where relevant to a shared investment opportunity, with appropriate confidentiality protections
• Legal and professional advisers: Law firms, accountants, and auditors supporting our business and fund operations
• Technology service providers: Cloud hosting, CRM software, email infrastructure, and data analytics providers acting as data processors under Article 28 GDPR agreements
• Regulatory authorities: The SEC, FINRA, relevant EU financial regulators, and other authorities where required by law
• Background check providers: Where required for KYC/AML compliance
• Successors in interest: In the event of a merger, acquisition, or wind-down of fund activities

All third-party processors are subject to data processing agreements that require them to implement appropriate technical and organizational security measures and process data only on our documented instructions.

8. International Data Transfers

Leveiir Capital operates globally, which may require transferring your personal data to countries outside the European Economic Area (EEA) or United Kingdom that do not provide an equivalent level of data protection. Where we transfer personal data from the EEA or UK to third countries, we rely on the following transfer mechanisms:

• Standard Contractual Clauses (SCCs) approved by the European Commission under Article 46 GDPR
• UK International Data Transfer Agreements (IDTAs) for transfers from the United Kingdom
• Adequacy decisions made by the European Commission for transfers to countries deemed to provide adequate protection
• Binding Corporate Rules, where applicable for intra-group transfers

You may request a copy of the relevant transfer mechanism by contacting our DPO at dpo@leveiir.com.

9. Your Rights Under GDPR (EEA and UK Residents)

If you are located in the EEA or United Kingdom, you have the following rights under GDPR:

• Right of Access (Art. 15): Request a copy of the personal data we hold about you
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal data
• Right to Erasure (Art. 17): Request deletion of your personal data where we no longer have a lawful basis for processing
• Right to Restriction of Processing (Art. 18): Request that we limit how we use your data in certain circumstances
• Right to Data Portability (Art. 20): Receive your personal data in a machine-readable format and transmit it to another controller
• Right to Object (Art. 21): Object to processing based on legitimate interests, including profiling for direct marketing purposes
• Rights Related to Automated Decision-Making (Art. 22): Not to be subject to solely automated decisions that produce significant legal effects
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing

To exercise any of these rights, please contact our DPO at dpo@leveiir.com. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection supervisory authority. For EU residents, you may contact the Commission Nationale de l'Informatique et des Libertes (CNIL) in France or your local supervisory authority. For UK residents, you may contact the Information Commissioner's Office (ICO).

10. Your Rights Under CCPA/CPRA (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act and California Privacy Rights Act:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, the purposes for which we use it, and the categories of third parties with whom we share it
• Right to Delete: Request deletion of personal information we have collected, subject to certain exceptions
• Right to Correct: Request correction of inaccurate personal information we maintain about you
• Right to Opt-Out of Sale or Sharing: We do not sell personal information. We do not share personal information for cross-context behavioral advertising purposes
• Right to Limit Use of Sensitive Personal Information: Limit our use of sensitive personal information to purposes that are necessary for providing our services
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights

To submit a CCPA request, email privacy@leveiir.com with the subject line "CCPA Rights Request." We will verify your identity and respond within 45 days, with an additional 45-day extension if needed. Authorized agents may submit requests on your behalf with appropriate proof of authorization.

11. Security Measures

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS 1.3 and at rest using AES-256
• Role-based access controls and multi-factor authentication for all personnel with access to personal data
• Regular security assessments and penetration testing
• Data minimization practices to limit collection to what is necessary
• Vendor security assessments for all third-party processors
• Incident response procedures including notification obligations under applicable breach notification laws

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware and will notify affected individuals where required by applicable law.

12. Cookies and Tracking Technologies

We use cookies and similar tracking technologies on our Site. Please refer to our Cookie Policy for detailed information about the types of cookies we use, their purpose, duration, and how to manage your preferences. We obtain your consent before placing any non-essential cookies in accordance with applicable law.

13. Children's Privacy

Our Site and services are not directed to individuals under the age of 18. We do not knowingly collect personal data from children under 18. If we become aware that we have inadvertently collected personal data from a child under 18, we will take immediate steps to delete such information. If you believe we may have collected data from a child, please contact us at privacy@leveiir.com.

14. Do Not Track and Global Privacy Control

Our Site responds to the Global Privacy Control (GPC) signal. When we receive a GPC signal from your browser, we will treat it as a valid opt-out from the sale or sharing of your personal information to the extent required by applicable law. We currently do not have a mechanism to respond to "Do Not Track" (DNT) signals due to the lack of an established standard, but we are committed to respecting GPC as a recognized opt-out mechanism.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will notify you by updating the "Last Updated" date at the top of this policy and, where required by applicable law, by sending email notice or providing prominent website notice at least 30 days before the changes take effect. We encourage you to review this policy periodically.

16. Contact Information

For any questions, concerns, or requests related to this Privacy Policy or our data processing practices, please contact us through the following channels:

• Privacy Team: privacy@leveiir.com
• Data Protection Officer: dpo@leveiir.com
• EU Representative (France): eu-privacy@leveiir.com
• UK Representative: uk-privacy@leveiir.com
• Postal Address: Leveiir Capital Management LLC, Attn: Privacy Team, 228 Hamilton Avenue, 3rd Floor, Palo Alto, CA 94301, United States