Privacy Policy INTRODUCTION Greenhouse Capital is the venture capital arm of Nigerian tech scale-up Venture Garden Group. We’re building a Venture Capital-as-a-Service platform connecting world class entrepreneurs, corporations and regulators to support African start ups and create a wide-reaching pan-Africa ecosystem. This Privacy Notice (“Notice”) governs your use of the GreenHouse Capital’s (“We”, “Our”, or “Us”) website: www.greenhouse.capital (“the Website) and your rights regarding our collection, use, storage, protection of your Personal Information when you use or access our services. Your privacy is important to us. “By using or accessing our services in any manner, you acknowledge that you accept the practices and policies outlined below, and you hereby consent that we will collect, use and share your information in line with this Privacy Notice.” THE PERSONAL INFORMATION WE COLLECT ABOUT YOU Personal Information means any information or data about an individual from which that person can be identified. While using the Website, we may collect or ask you to provide us with certain Personal Information that can be used to contact or identify you. Personal Information may include, but is not limited to the following: Name and email address. Personal information entered into any surveys and/or forms that we may ask you to complete that we use for research purposes Information provided to us through our websites such as demographic and geolocation data. Any other Personal Information that you choose to provide to GreenHouse Capital or that you consent to us collecting. Any other interaction with any of our smart representatives. Log Data: We use log files which store automatic information collected when users visit our Website. The log data which may be collected are as follows: The domain and host from which you accessed the website Name of the internet service provider (ISP) Data and time of visit Your computer operating system and browser software Web pages visited, duration and frequency of visits Your Internet Protocol (IP)address Personal Information may be given to us directly by you or by people or companies authorized by you to act on your behalf. We may also collect Personal Information about you from third parties in connection with our Services (for example, a credit reporting agency, advertising partners etc.). Where we need to collect Personal Information by law, or under the terms of a contract we have with you and you fail to provide that information when requested, we may not be able to provide the Services envisaged or requested. COOKIES We use cookies to collect data in order to offer you the best experience on our Website. Cookies are information stored on your browser when you visit our Website or use a social network with your PC, Smartphone or Tablets. They contain various data which includes the name of the server from which it comes, the numeric identifier, etc. We may also supplement the information we collect form you with information received from third parties, including third parties that have placed their own Cookies on your device(s). The types of cookies we use are as follows: Strictly Necessary Cookies: These cookies are essential for the correct functioning of our website and they are required to provide the service required to our users. Disabling these cookies may make certain features and services unavailable. We do not have to obtain your consent to use these cookies. Performance Cookies: These are used to gather data on how users use our website and the pages visited most often. They monitor only the performance of our website as the user interacts with it. Data collected by these cookies enable us to personalize our content for you and remember your preferences (for example, your choice of language or region). Advertisement/Targeting Cookies: These cookies are placed there by us to understand how users interact with our services, what pages are viewed by users. We are also able to measure the performance of our advertising campaigns in order to help us improve our services’ content for those who engage with our advertising. You have the option to decline the activation of these cookies. Name Purpose Expiration Type __cf_bm It identifies and mitigates automated traffic to protect our website from bad bots. Expires after 30 minutes of inactivity First Party/Strictly Necessary _gid It is placed by Google Analytics to count and track page views Expires after one day First Party/Performance _gat It is used by Google Analytics to track performance of our website. 30 minutes maximum First Party/Targeting Cookies _ga It is used by Google Analytics to count and track page views. We also use it to distinguish visitors to our websites. 2 years First Party/Performance __cfduid It is used to identify trusted web traffic and minimize obstruction for legitimate users. It does this by collecting IP addresses and anonymizing them. 30 days First Party/Strictly Necessary PHPSESSID It is used to keep track of sessions on our website. Immediately after the session is closed First Party/Strictly Necessary Support in Configuring Your Browser: You can manage these cookies through the settings of your browser on your device. However, deleting strictly necessary and performance cookies from your browser may remove or limit your access to some functionality on this website. You can decline targeting/advertisement cookies by choosing your preference from the cookies banner. WHY WE COLLECT YOUR PERSONAL INFORMATION Purpose Lawful basis To enable us provide our services to you to fulfill the reason you provided the information to us. Contractual basis To maintain and make improvements to the service we provide to you; To develop new products on the Website;To provide personalized service to you, including making recommendations and providing personalized content;To provide analytics to understand how our service is used and market research;To notify you about changes to our services;To update our records. Legitimate interest provided that our interests are not outweighed by your rights and interests. To comply with a legal or regulatory obligation Legal obligation To manage risk, detect or prevent or remediate fraud or other potentially prohibited or illegal services Protection of your vital interest or of a third party For any other purpose you have specifically consented to. Consent OUR PRINCIPLES OF DATA PROCESSING Personal data will be processed fairly, lawfully and in a transparent manner; Personal data will be processed for a specific purpose and not in a way which is incompatible with the purpose with which it is collected; Your personal data is adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed; Your personal data will be kept accurate and, where necessary kept up to date; Your personal data will not be kept for longer than it is necessary for the purposes for which it is processed; We will take appropriate steps to keep your personal data secure. LAWFUL BASIS FOR PROCESSING YOUR PERSONAL INFORMATION Consent: If we have to use consent as a lawful basis, we will provide you with a consent form. You have the right to refuse to consent or withdraw your consent at any time by contacting us at info@greenhouse.capital. Contract: If the processing of your data is necessary for a contract you have with us, or because we have asked you to take specific steps before entering into that contract. Legal Obligation: If the processing of your personal data is necessary where there is a statutory obligation upon us. Legitimate interests: Processing your data is necessary for our legitimate interests or the legitimate interests of a third party, provided those interests are not outweighed by your rights and interests. WHAT CONSTITUTES CONSENT? At any point where consent is the appropriate lawful basis for processing of your personal data, we will provide you the option to either accept or not. In addition, whenever we introduce new services and technologies, we will ensure you understand and agree to any new ways in which your information will be processed. You will be considered to have given your consent for the processing of your personal data when; You continue to use the Website; You accept the installation of cookies on your device. If we ask for your personal information for a secondary reason, like marketing, we will ask you for your express consent. We will not collect additional categories of Personal Data or use the Personal Data we collected for materially different, unrelated or incompatible purposes without providing you notice. We should mention that after you give consent, withdrawal of that consent would not affect the lawfulness of any processing carried out before you withdraw your consent. Where consent is obtained a record of this will be made confirming what you have consented to, the time and date and how consent was obtained. HOW TO WITHDRAW YOUR CONSENT? If after you opt-in, you change your mind, you may withdraw your consent to the continued processing of your personal data, at any time, by contacting us at info@greenhouse.capital. Marketing and Communications Before you register with us or ask us for information on our products or services, we seek your express consent to send marketing information to you. Until you opt out of receiving that marketing information, we may send you information on our range of products, services, promotions, special offers and other information which we think you may find interesting by phone, email and/or SMS. We will get your express opt-in consent before we share your personal data with any third party for marketing purposes. You can ask us or third parties to stop sending you marketing messages at any time by contacting us at info@greenhouse.capital. RETENTION OF PERSONAL INFORMATION Your Personal Information or any other information collected may be stored for as long as necessary to fulfil the purposes described in this privacy notice. However, we will also retain data subject to relevant provisions of applicable laws, resolve disputes, and enforce our legal agreements and policies. Please note that your Personal Information may be retained for a longer period notwithstanding your request to remove your Personal Information, where there is a legal requirement to do so. We will inform you of this within one month of your notice to exercise the right. INFORMATION STORAGE AND SECURITY We store and process your Personal Information on our computers in Lagos, Nigeria, Africa and on a cloud-based network hosted in the Republic of Ireland region of Amazon Web Services. Data protection laws vary among countries, with some providing more protection than others. Regardless of where your information is processed, we apply the same protections described in this Notice. You have a right (upon your request) to be informed of the appropriate safeguards for data protection in the foreign country. We protect your Personal Information using physical, technical, and administrative security measures to reduce the risks of loss, misuse, unauthorized access, disclosure and alteration. Some of the safeguards we use are firewalls and data encryption, physical access controls to our data centers, and information access authorization controls. In the event of an actual or suspected breach of your Personal Information, we will use best effort to remedy the breach within one (1) month from the date we report the breach to you. However, please be aware that no method of transmitting or storing data over the internet is completely secure. We cannot guarantee the complete security of any data you share with us, and except as expressly required by law, we are not responsible for the theft, destruction, loss or inadvertent disclosure of your information or content. YOUR RIGHTS AS A DATA SUBJECT You have the following rights in relation to your Personal Information held with us; To access the Personal Information held by Greenhouse Capital about you; To have your Personal Information corrected e.g., if it is incomplete or incorrect; To have your Personal Information erased (“the right to be forgotten”); To opt out of receiving marketing communications at any time; To restrict or object to the processing of Personal Information or request erasing Personal Information (subject to applicable law); To receive a copy of the Personal Information which you have provided to Greenhouse Capital, in a structured, commonly used and machine-readable format (in certain circumstances and subject to applicable law) Where you have provided Personal Information voluntarily, or otherwise consented to its use, the right to withdraw your consent; and The right to complain to a data protection authority (see section on “Complaints”). WHO WE SHARE YOUR PERSONAL INFORMATION WITH We may share your Personal Information with third parties as described below. However, you may withdraw your consent to disclose at any time as provided in this policy. When we share your personal data with third parties who are not legal or regulatory authorities, we enter into a data processing agreement with them to ensure the protection and security of your personal information. Besides, we carry out due diligence to certify their privacy and data protection practice. We share your information with the following third parties: Google Marketing Platform: They are a third party that provides us with analytics services. They collect information from our website which is needed to get to know and understand our users, analyse the data collected and provide us with insights for the benefit of our business. Google Tag Manager: It allows us to track conversions, website analytics, retargeting, and more by letting us easily add code snippets to our websites. Affiliates – Our Affiliates may access your Personal Information to help us develop, maintain and provide the services via the Website. Service Providers – Our Service Providers provide us support for our services, including website and maintenance development, hosting, maintenance, backup, storage, virtual infrastructure, payment processing, third party lenders and other services which may require them to access or use Personal Information about you. Professional Advisers – Our lawyers, accountants, auditors may need to review your Personal Information to provide consultancy, compliance, legal, accounting and similar services. Legal / Regulatory Authority – Greenhouse Capital may disclose your Personal Information if we believe it is reasonably necessary to comply with a law, regulation, order, subpoena or audit or to protect the safety of any person, to address fraud, security or technical issues. Advertisers – We may allow third parties including ad-servers or ad-networks, to serve advertisement on the Platform, and such third parties may be provided with access to your Personal Information to provide advertising tailored to your interest with your consent. Other parties – Please note that top level employees, authorized employees required to have access to the Website in the course of their employment with Greenhouse Capital, may have access to your Personal Information. In the event of a corporate sale, merger, reorganization, dissolution or similar event, we may also transfer your Personal Information as part of the transferred asset without your consent or notice to you. INTERNATIONAL TRANSFER OF PERSONAL INFORMATION To achieve the purposes described in this Privacy Notice, we may transfer your Personal Information to countries that may not offer an adequate level of protection or not considered to have adequate law by the National Information Technology Development Agency (NITDA). Where Personal Information is to be transferred to a country outside Nigeria, We shall put adequate measures in place to ensure the security of such Personal Information. Our data transfers to the countries that do not offer an adequate level of protection are subject to either of the conditions in accordance with the Nigeria Data Protection Regulation (NDPR). We will therefore only transfer Personal Data out of Nigeria on one of the following conditions: Your consent has been obtained; The transfer is necessary for the performance of a contract between Us and you or implementation of pre-contractual measures taken at your request; The transfer is necessary to conclude a contract between Us and a third party in your interest; The transfer is necessary for reason of public interest; The transfer is for the establishment, exercise or defense of legal claims; The transfer is necessary in order to protect your vital interests or other persons, where the Data Subject is physically or legally incapable of giving consent. To obtain any relevant information regarding any transfers of your Personal Data to third countries (including the relevant transfer mechanisms), please contact us at info@greenhouse.capital. SECURITY OF YOUR PERSONAL INFORMATION We value your trust in providing us with your Personal Information in connection with your use of the Website and shall endeavor to use commercially acceptable means of protecting it. However, we do not guarantee its absolute security. CHILDREN’S PRIVACY We do not use the Website to knowingly solicit data from children or individuals under the age of Eighteen (18). Where a parent or guardian discovers that a child or individual under the age of Eighteen (18) has provided us with his/her Personal Information without their consent, he or she should contact us at info@greenhouse.capital and we shall immediately delete the user’s account from our servers. CHANGES TO OUR PRIVACY NOTICE We may update this Notice from time to time without any prior notice to you or consent. Thus, you are advised to consult this Website periodically for any changes. We will notify you of any changes by posting the revised Notice on the Website. COMPLAINTS If you are concerned about an alleged breach of privacy law or any other regulation by GREENHOUSE CAPITAL, you can contact the Data Protection Officer via info@greenhouse.capital. The Data Protection Officer will investigate your complaint and provide information about how your complaint is handled. Please be informed that where your complaints are not satisfactorily addressed, you may lodge a complaint with the data protection authority at info@nitda.gov.ng ACCESS If you wish to access, review, modify any information we have about you, You may do so by simply contacting us via info@greenhouse.capital Date of last revision: 23rd January, 2023