Privacy Notice

KingStone Capital Ltd ("KingStone", "we", "us", "our") is an Irish commercial finance operating company. This Privacy Notice explains how we collect, use, store and protect personal data submitted through this website in accordance with applicable data protection law, including the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018. If you have any questions about this Privacy Notice or our data practices, please contact us at the details set out in Section 10.

When you register interest through this website, we may collect the following categories of personal data: • Identity data: your name, company name, role or title. • Contact data: email address, telephone number, website or LinkedIn URL. • Financial and business data: funding amount sought, loan type, purpose, timeframe, security available, company registration number. • Investor data: investor type, indicative investment range, areas of interest. • Growth Partner data: partner type, expected introductions, background and experience. • Project data: project name, project type, funding sought, use of funds, security or assets available. • Technical data: IP address, browser type, device type, pages visited, cookie preferences. • Communications data: records of any correspondence between you and KingStone. We do not collect special category personal data (such as health, biometric or criminal data) through this website.

We use your personal data for the following purposes: • To review and assess your expression of interest (borrower finance, investor interest, Growth Partner registration or project opportunity). • To contact you about your expression of interest and any next steps in our review process. • To record and manage Growth Partner introductions. • To comply with applicable legal and regulatory obligations. • To improve this website and our services. • To send you updates about KingStone's launch, if you have consented. We do not use your personal data for automated individual decision-making or profiling.

We process your personal data on the following legal bases: • Consent: where you have ticked the relevant consent checkbox when submitting a form, including consent to be contacted and consent to our Privacy Notice. • Legitimate interests: to operate our pre-launch review pipeline, manage Growth Partner introductions, and improve this website, where these interests are not overridden by your rights. • Legal obligation: where processing is necessary to comply with applicable legal or regulatory requirements. You may withdraw your consent at any time by contacting us using the details in Section 10.

We may share your personal data with: • Service providers who assist us in operating this website and our review pipeline (such as hosting, CRM and email providers), bound by appropriate data processing agreements. • Professional advisers including legal, financial and tax advisers, under confidentiality obligations. • Potential provider partners (such as approved structured note / compartment providers or authorised crowdfunding providers) where necessary to progress your expression of interest, and only where you have consented or where we have a legitimate interest to do so. • Regulatory or law enforcement authorities where required by applicable law. We do not sell your personal data to third parties. We do not transfer your personal data to countries outside the European Economic Area (EEA) without appropriate safeguards.

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting or reporting requirements. In general, we will retain expression-of-interest records for up to 6 years following the end of any active engagement or formal review process. Where you withdraw consent and have no active engagement with KingStone, we will delete or anonymise your personal data within a reasonable time.

Under applicable data protection law, you have the following rights: • Right of access: to request a copy of the personal data we hold about you. • Right to rectification: to request that we correct inaccurate personal data. • Right to erasure: to request that we delete your personal data in certain circumstances. • Right to restriction: to request that we restrict processing of your personal data in certain circumstances. • Right to data portability: to receive your personal data in a structured, machine-readable format in certain circumstances. • Right to object: to object to processing based on legitimate interests. • Right to withdraw consent: to withdraw any consent you have given at any time. • Right to lodge a complaint: with the Data Protection Commission (Ireland) at www.dataprotection.ie. To exercise any of these rights, please contact us using the details in Section 10.

This website uses cookies. Please see our Cookie Policy for details of the cookies we use, what they do and how to manage your preferences. You can also manage your cookie preferences at any time using the cookie consent banner on this website.

We may update this Privacy Notice from time to time. We will notify you of any material changes by posting the updated notice on this page with a revised date. We encourage you to review this Privacy Notice periodically.

If you have any questions, requests or complaints relating to this Privacy Notice or our data protection practices, please contact: KingStone Capital Ltd Data Protection Contact [Address to be confirmed] Email: [privacy@kingstonecapital.ie — to be confirmed] You also have the right to lodge a complaint with the Data Protection Commission (Ireland) at www.dataprotection.ie.