Privacy Policy

1. Our Commitment to Privacy

Your privacy is important to us. IO Capital, LLC, a Delaware limited liability company, and its affiliates ("IO Capital," "IO," "we," "us," or "our") have developed this Privacy Policy to explain our practices for personal data collected through the website located at www.iocapital.com (the "Site") and in connection with related interactions, such as when you contact us, subscribe to our communications, or apply for a position with us.

This Privacy Policy describes what personal data we collect, how we use and protect that data, how we share it, and the rights and choices you have in relation to your personal data.

IO Capital is responsible for the processing of personal data under this Privacy Policy (as a controller or business, where applicable). If you have any questions concerning this Privacy Policy, please contact us as described in the "Contact Information" section below.

2. Scope of This Privacy Policy

This Privacy Policy applies to personal data we collect through the Site and through related interactions described above. It does not apply to:

• The privacy practices of companies we do not control, including any portfolio companies of funds managed or advised by IO Capital.
• Personal data we collect in connection with a separate business relationship with IO Capital, including as an investor or prospective investor in any IO Capital-managed fund. If you provide personal data to us in connection with such a relationship, you will receive a separate privacy notice that will govern that personal data.

3. The Information We Collect

3.1 Information You Provide to Us

You can visit the Site without telling us who you are or revealing any personal data. We collect personal data when you choose to provide it to us, including:

• Contact and inquiry information. When you submit a contact form, send us an email, or otherwise reach out to us, we may collect your name, email address, business affiliation, title, telephone number, and the content of your message.
• Newsletter and communications subscriptions. When you subscribe to our newsletter or market commentary, we collect your email address and, where you provide it, your name and business affiliation.
• Careers and recruiting information. We do not maintain an online job application form. If you are interested in a position with IO Capital, you may reach out to us by email at team@iocapital.com. We accept resumes, messages, and any other materials you choose to send to that address, and by sending them to us you acknowledge that we may retain and use that information for recruiting and related business purposes.
• Domain Report submissions. When you submit a company website through our Domain Report tool, we collect the submitted URL, your IP address, and (if you choose to provide it) your email address. We use that information to (i) run an automated assessment of the company against our investment criteria using our internal sourcing platform, (ii) generate a report describing what we found in publicly available sources, (iii) deliver that report to you, and (iv) contact you about IO Capital. The report itself is stored on our infrastructure and made available at a unique, randomly generated URL that we share with you; the URL is not publicly indexed, but anyone with the link can view the report while it remains active. Submissions and the resulting reports are retained as described in Section 8.

3.2 Information We Collect Automatically

When you visit the Site, our servers and certain third-party services collect information about your interaction with the Site, including:

• Internet Protocol (IP) address and approximate location derived from it.
• Device and browser information, including device type, operating system, browser type and version, and screen resolution.
• Information about your use of the Site, including pages visited, time spent, referring website, click paths, and session duration.
• Information collected through cookies and similar technologies, as described in our Cookie Policy.

3.3 Information from Third Parties

We use third-party visitor identification services to better understand which organizations and, in some cases, which individuals are visiting the Site. These services include RB2B and Leadpipe, which use identity-graph and similar matching technology to associate visit activity with a company or, where possible, an individual professional profile based on publicly available business information.

We may also receive information about you from data enrichment providers, marketing partners, and customer relationship management platforms that augment the contact information you provide with publicly available business information (e.g., professional title, firm, professional background).

4. How We Use Your Information

We use your personal data for the purposes described below. For visitors in the European Economic Area, the United Kingdom, and other jurisdictions where lawful-basis disclosures are required, we have identified the corresponding legal basis under applicable data protection law.

We will not use your personal data for purposes that are materially different from those described in this Privacy Policy without providing you with notice and, where required, obtaining your consent.

5. How We Share Your Information

We do not sell personal data for monetary consideration. We disclose personal data only as follows:

• Service providers and processors. We share personal data with vendors and service providers that perform services on our behalf, including website hosting and analytics providers, cookie consent management providers (Osano), visitor identification providers (RB2B, Leadpipe), bot-protection providers (Cloudflare), email delivery providers (Resend), large-language-model providers used to process Domain Report submissions (Anthropic, OpenAI), public-data and web-content providers used to enrich those reports (Bright Data, Exa), database and edge-function hosting providers (Supabase), email and marketing platforms, customer relationship management systems, communication and meeting platforms, recruitment platforms, professional advisors (legal, accounting, audit), and information technology and security providers. These providers are contractually limited to using your personal data only for the purposes for which we engage them.
• Affiliates. We may share personal data with our affiliates for the purposes described in this Privacy Policy.
• Marketing and advertising partners. We may use marketing technologies — including conversion pixels, advertising cookies, and customer relationship management integrations — that involve sharing limited personal data (such as IP address, device identifiers, and Site activity) with marketing platforms. Where this activity constitutes "sharing" or "selling" under applicable U.S. state privacy laws (see Section 9), you may opt out as described in this Privacy Policy.
• Compliance, legal process, and protection of rights. We may disclose personal data when we believe in good faith that disclosure is required by law, regulation, legal process, or lawful request from a public authority, or where necessary to protect the rights, property, safety, or interests of IO Capital, our personnel, our investors, or others.
• Business transactions. In connection with, or during negotiations of, any merger, sale of assets, financing, acquisition, restructuring, or similar corporate transaction, we may share personal data with the counterparties and their advisors, subject to appropriate confidentiality obligations.

6. Cookies and Similar Technologies

The Site uses cookies and similar technologies to operate, analyze, secure, and improve the Site, and for marketing purposes. A "cookie" is a small text file stored on your device by your browser. Detailed information about the cookies we use, the purposes for which we use them, and how you can manage your cookie preferences is provided in our Cookie Policy.

When you visit the Site, our cookie consent banner (provided by Osano) gives you choices about which categories of cookies you allow. Non-essential cookies are active by default in all regions, including the European Economic Area and the United Kingdom, and you may opt out of any category at any time using the consent banner. In the United States, you may also use the consent banner and your browser settings to exercise your right to opt out of "sharing" and "selling" as those terms are defined under applicable state privacy laws.

7. International Data Transfers

IO Capital is headquartered in the United States, and personal data collected through the Site will be processed and stored on servers located in the United States. Personal data may also be transferred to and processed by service providers and other recipients located in jurisdictions other than the one in which you are located.

For transfers of personal data from the European Economic Area, the United Kingdom, or Switzerland to the United States or other countries that have not received an adequacy decision from the relevant regulator, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, and equivalent mechanisms recognized under applicable law. You may request a copy of these safeguards by contacting us as described in the "Contact Information" section below.

8. Data Retention

We retain your personal data for as long as is reasonably necessary for the purposes described in this Privacy Policy, for as long as we have a legitimate business need to retain it, or as required by applicable law (including for tax, accounting, regulatory, or legal-defense purposes), whichever is the longer.

To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the personal data; the potential risk of harm from unauthorized use or disclosure; the purposes for which we process the personal data and whether we can achieve those purposes through other means; and applicable legal requirements.

Domain Report submissions, the IP address and email associated with them, and the generated reports are retained on our infrastructure for our internal sourcing, diligence, and business-development purposes. The publicly accessible report URL we share with you is available for a limited time and then expires; the underlying record may be retained beyond that period as described above.

9. Your Privacy Rights

Depending on where you reside, you may have certain rights with respect to your personal data. Rights vary by jurisdiction; the rights described below may not all apply to you.

9.1 Rights Applicable to All Visitors

You may at any time:

• Opt out of marketing communications by following the unsubscribe instructions in any marketing email we send you, or by contacting us at privacy@iocapital.com.
• Manage your cookie preferences through our cookie consent banner or your browser settings, as described in our Cookie Policy.

9.2 California Residents (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act of 2018, as amended ("CCPA"):

• Right to know. You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which we collected it, our business or commercial purposes for collecting it, and the categories of third parties with whom we have shared it.
• Right to delete. You may request that we delete personal information we have collected from you, subject to certain exceptions provided by law.
• Right to correct. You may request that we correct inaccurate personal information we maintain about you.
• Right to opt out of "sale" or "sharing." You have the right to opt out of the "sale" or "sharing" (as those terms are defined under the CCPA) of your personal information. Visitor identification services such as RB2B and Leadpipe, and certain marketing-related cookies, may constitute "sharing" for cross-context behavioral advertising under the CCPA. You may opt out using our cookie consent banner, by enabling the Global Privacy Control signal in your browser (which we honor as a valid opt-out request), or by emailing privacy@iocapital.com.
• Right to limit use of sensitive personal information. We do not collect sensitive personal information for purposes that would trigger this right.
• Right to non-discrimination. We will not discriminate against you for exercising any of your CCPA rights.
• Authorized agents. You may designate an authorized agent to submit a request on your behalf, provided we receive written authorization signed by you.

We have collected the following categories of personal information about California residents in the preceding twelve (12) months:

To exercise your CCPA rights, please email privacy@iocapital.com or submit a request through our cookie consent banner where applicable. We will verify your identity before responding, and we may request additional information to do so.

9.3 Other U.S. State Residents

If you reside in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Tennessee, Indiana, Florida, Delaware, Minnesota, Maryland, New Hampshire, New Jersey, Rhode Island, Kentucky, or another U.S. state with a comprehensive privacy law, you may have rights similar to those described above, including the right to access, correct, delete, port, and opt out of certain processing of your personal data. The specific rights and how they apply depend on your state of residence and the volume and nature of the data we process about you.

To exercise these rights, please email privacy@iocapital.com. You may appeal a decision we make about your request by replying to our response with the word "appeal" and a description of your concern.

9.4 Residents of the European Economic Area and United Kingdom

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights under the EU General Data Protection Regulation, the UK General Data Protection Regulation, and equivalent law, where applicable:

• Access. Request a copy of the personal data we hold about you.
• Rectification. Request that we correct inaccurate or incomplete personal data.
• Erasure. Request that we delete personal data, subject to certain exceptions.
• Restriction. Request that we restrict the processing of personal data in certain circumstances.
• Portability. Request that we provide personal data you have provided to us in a structured, commonly used, machine-readable format.
• Objection. Object to the processing of personal data based on our legitimate interests, including direct marketing.
• Withdraw consent. Where we process personal data based on consent, withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
• Lodge a complaint. Lodge a complaint with the data protection regulator in the country where you live or work, or where you believe an infringement of applicable law has occurred. A list of EU supervisory authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en. The UK Information Commissioner's Office can be contacted at https://ico.org.uk/.

To exercise these rights, please email privacy@iocapital.com.

10. Security

We employ administrative, technical, organizational, and physical safeguards designed to protect personal data against unauthorized access, disclosure, alteration, and destruction. No security program is impenetrable, however, and we cannot guarantee the security of personal data transmitted to or through the Site.

11. Children's Privacy

The Site is not directed to children under the age of 18. We do not knowingly collect personal data from children under the age of 18. If you believe that a child under 18 has provided personal data to us, please contact us at privacy@iocapital.com and we will take appropriate steps to delete that information.

12. Do Not Track and Global Privacy Control

Some browsers transmit "Do Not Track" (DNT) signals or Global Privacy Control (GPC) signals to websites you visit. We honor the Global Privacy Control signal as a valid opt-out request from California residents and others where required by applicable law. We do not currently respond separately to DNT signals.

13. Third-Party Websites and Services

The Site may contain links to third-party websites, applications, and services that are not operated by IO Capital. This Privacy Policy does not apply to those third-party websites or services. We encourage you to review the privacy policies of any third-party site or service before providing them with your personal data.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the "Last Updated" date at the top of this Privacy Policy. If we make material changes, we will provide additional notice as required by applicable law (for example, by posting a notice on the Site or, where appropriate, sending a direct communication). We encourage you to review this Privacy Policy periodically.

15. Contact Information

If you have questions or concerns about this Privacy Policy or our processing of your personal data, please contact us at:

IO Capital, LLC
Attn: Privacy
Los Angeles, California
Email: privacy@iocapital.com