Data Processing & Compliance

1. Our role

For personal data you provide directly (your own account and profile information), Capmatter acts as the Data Fiduciary under the Digital Personal Data Protection (DPDP) Act, 2023. For data a company enters about others through the platform - shareholders, option holders, employees, directors, investors, and fund limited partners - the company acts as the data fiduciary, and Capmatter processes it on the company's behalf as a service provider. That includes the grants, holdings, acceptances, and exercise requests shown to those people in the employee and investor portal.

2. Legal basis for processing

We process personal data on the following bases:

• Consent - given when you create an account, as described in our Privacy Policy, and withdrawable at any time (subject to processing already lawfully underway not being affected).
• Performance of a contract - processing necessary to provide the cap table, ESOP administration, portal, liquidity, valuation, compliance, and reporting features you've signed up to use.
• Legal obligation - retention of financial, audit, and tax-relevant records as required by applicable law.
• Legitimate interests - fraud prevention, abuse detection, platform security, and service reliability.

3. Sub-processors

We use the following categories of sub-processors to operate the platform. We do not sell personal data to any third party, and no sub-processor is permitted to use your data for their own marketing purposes.

4. Cross-border data transfers

Our infrastructure providers may process and store data in jurisdictions outside India. Where this occurs, we rely on our providers' own compliance certifications and contractual safeguards, and only transfer data to jurisdictions not restricted by the Central Government under the DPDP Act. By using the platform, you consent to this processing, as described in our Privacy Policy.

5. Automated decision-making

We do not use fully automated decision-making that produces legal or similarly significant effects about you without human involvement. Approvals of equity actions (plans, grants, exercises, corporate actions, liquidity programs) are always made by people at the company. Tax and expense figures the platform computes are indicative and are reviewed by people before use.

6. Your rights and how to exercise them

• Access & correction - most of your data is directly viewable and editable in your account settings.
• Export - download a copy of your data on demand from Privacy & data in the Capmatter app.
• Erasure - request account deletion from Privacy & data; we confirm it with you by email, subject to the ownership and retention exceptions described in our Data Retention Policy.
• Grievance - contact our Grievance Redressal Officer (details below) for anything not covered by self-service tools.

7. Grievance Redressal Officer

We will acknowledge and address grievances within the statutory timelines prescribed under the DPDP Act, 2023.