Growceanu is aware of the importance of your data and is committed to protecting its confidentiality and security. It is therefore important to us to provide you,in an integrated and practical manner, with information regarding the processing of your personal data as data subjects and as users of the Platform.The Platform is operated by Growceanu and is accessible from any device, as an application at app3.growceanu.com or via the website at www.growceanu.com.

This policy applies to all devices used to access the Platform — smartphones, PCs,tablets. If you do not agree with the terms and conditions regarding their use (as set out in this document from a personal data protection perspective), please do not use the Platform.

Please read this policy carefully to understand how we handle your personal data.

Please visit this section regularly, as the policy may be subject to changes orupdates. Any significant changes to this policy will be notified.

By using the Platform, you agree to the collection, processing and transfer of your data as described in this privacy policy.

In addition to this policy, please read our Cookie Policy and our Terms and Conditions.

The information collected on our Platform is subject to the General Data Protection Regulation 2016/679 (Regulation (EU) 2016/679, also known as the GDPR).

Ifyou need further information about how we use your personal data, you may write to us using the contact page or send us an email at dpo@growceanu.com.

Who We Are

Growceanu Angel Investment S.R.L. (hereinafter "Growceanu") is a limited liability company registered in Romania, registered with the Trade Register under number J2018003430353, and our tax identification number is RO39963685.

Registered address: Romania, Timis County, Timisoara, Penes Curcanu str. no. 4-5

Contact Details: +40 744 702 061 | support@growceanu.com | growceanu.com

Use of Our Platform

By accessing or using any part/feature of our Platform, you agree to accept and comply with the terms, conditions and policies mentioned and/or available via hyperlink, and you acknowledge that you have reached the minimum legal age under applicable national law. If you do not accept the terms, conditions and policies set out in this documentation, you should not continue to access thePlatform and/or use our services.

‍Where We Obtain Your Data‍

WIngeneral, the personal data we collect is provided by you via email, via thecontact form on the Platform, or on the Platform when you create an account.

We may also receive your personal data from the legal entities you represent in connection with Growceanu, for example if you are named as a contact person or legal representative. In all cases where we receive your personal data from a legal entity, that legal entity is obliged to inform you accordingly.

Furthermore,when you interact with us on social media (e.g. likes, shares, comments, reviews, etc.), we will inevitably have access to your information, in particular the data you have made public on your social media profile.

How We Use Your Personal Data

Please find below the purposes for which we process your data, who has access to yourdata, and how we store it.

1. We collect your data when you interact with us using the contact details available on the Platform or on social media

If you interact with us using the contact details available on the Platform or via social media messenger (e.g. for information, feedback, etc.), we will use your contact data and the data you provide to us to manage your request, to assess the satisfaction of our customers, and to continually improve the services weoffer.

Personal Data: Your name, surname, telephone number, email address, the data you have made available on your social mediaaccount and any other data you send us voluntarily.

Legal Basis for Processing:

●     We process your data torespond to your request prior to the conclusion of a contract [Art. 6(1)(b) ofRegulation (EU) 2016/679].

●     Pursuit of ourlegitimate interest in responding to any queries, complaints or recommendations you send us and in improving the services and experience we offer our customers [Art. 6(1)(f) of Regulation (EU) 2016/679].

With Whom We May Share Your Data:

●     IT service providers forour company (hosting and data storage), providers to whom we outsource certain technical support services for the Platform.

●     Social media platforms: Facebook, LinkedIn.

●     Collaborators andpartners involved in the operational activities of the Platform.

●     Regulatory authorities (FSA) and other state authorities, where required by legal or statutory provisions.

We will disclose your personal data only to the extent strictly necessary to achieve our specified purpose.

How Long We Will Store the Data: We willstore your data in our communications database for a maximum period of 12 months from the last interaction. Data transmitted via social media will bestored by those platforms in accordance with their own policies.

Where the Data is Stored: Data recordedthrough the Platform will be stored on the hosting provider's servers. Data transmitted via social media will be stored by those platforms in accordance with their own policies. Data we download locally will be stored locally and inthe cloud.

2. We collect your data when you create an account on the Platform

We use this information to facilitate your full access to the Platform. Without the processing of this personal data, managing and operating a user account isimpossible.

By registering an account on our Platform, you will be able to:

●     Personalise yourprofile.

●     View the profiles ofother members.

●     Express interest in a Project Developer.

●     Express interest inevents.

●     Communicate with the Growceanu team.

●     Access documents related to fundraising campaigns.

●     Evaluate Project Developers.

Once a user has created an account on the Platform, they have the option to voluntarily complete their profile details. If an investor sets their profile as public, their profile image and LinkedIn profile link will be published on the Platform.

Personal Data: Your full name, telephone number, email address, profile image, LinkedIn profile, your interests, your expertise.

Legal Basis for Processing: We process your data for the performance of a contract (Art. 6(1)(b) GDPR).

With Whom We May Share YourData:

●     IT service providers for our company (hosting and data storage), providers to whom we outsource certain technical support services for our Platform or providers of customer relationship management systems: Google Cloud Platform.

●     Regulatory authorities(FSA) and other state authorities, where required by legal or statutory provisions. Entities that assist Growceanu in processing data as processors, insurers, public authorities (prosecutor's office, police, courts and other competent state bodies).

●     Notary offices.

●     Customer relationshipmanagement system providers.

●     Email service providers.

●     KYC/AML and paymentservice provider ConnectPay UAB.

We will disclose your personal data only to the extent strictly necessary toachieve our specified purpose.

How Long We Will Store the Data: We willretain your data for the duration of the contract and thereafter, in accordancewith national legislation (such as accounting data).

Where the Data is Stored: Data we downloadlocally will be stored locally and in the cloud. We use Google Cloud serviceswhich store your data in Belgium.

We recommend you follow these guidelines when choosing a password:

●     Include uppercase andlowercase letters (e.g. a-z and A-Z).

●     Include numbers andspecial characters (e.g. ! @ # $ % ^ & * () _ + = } { : " ? ><).

●     Include at least sixalphanumeric characters.

●     Do not use a word in anylanguage, jargon, dialect, etc.

●     Do not use personalinformation, surnames, etc.

3. Conclusion of contracts — for investments and services provided byGrowceanu

We process the following data and information:

●     Information from documents and information required for the conclusion and performance of the investment facilitation framework agreements, the related annexes, and the service agreements.

●     Information regarding the use of the Platform and the user account, such as login details and password, IP address and data on user actions on the Platform.

●     Information on fund transfers and other user activities, such as payment details, applications, agreements and other data relating to the use of the services we offer.

●     Documents and data received during the KYC/AML process, such as copies of identity documents,evidence of source of income, etc.

●     Biometric data foridentity verification, collected by the third-party identity verification service provider in the context of anti-money laundering and counter-terrorist financing (KYC/AML).

●     Information onwallets/accounts opened with ConnectPay UAB and other necessary financialinformation, where applicable.

●     Any data made availableby you during our interactions, including through requests and complaints.

Personal Data: Your full name, telephonenumber, email address, profile image, LinkedIn profile, your interests, yourexpertise and all the data mentioned above.

Legal Basis for Processing: We process yourdata for the performance of a contract (Art. 6(1)(b) GDPR).

With Whom We May Share Your Data:

●     IT service providers for our company (hosting and data storage), providers to whom we outsource certaintechnical support services for our Platform or providers of customerrelationship management systems: Google Cloud Platform.

●     Regulatory authorities (FSA) and other state authorities, where required by legal or statutoryprovisions. Entities that assist Growceanu in processing data as processors,insurers, public authorities (prosecutor's office, police, courts and othercompetent state bodies).

●     Notary offices.

●     Customer relationshipmanagement system providers.

●     Email service providers.

●     KYC/AML and paymentservice provider ConnectPay UAB.

●     The undisclosed agentacting in its own name but on behalf of and in the interest of investors, pursuant to Articles 2039–2041 of the Civil Code, for the signing of investment documents.

●     The shareholder registry agent, an independent entity that maintains records of investors' securities.

Wewill disclose your personal data only to the extent strictly necessary to achieve our specified purpose.

How Long We Will Store the Data: We willretain your data for the duration of the contract and thereafter, in accordancewith national legislation (such as accounting data).

Where the Data is Stored: Data we downloadlocally will be stored locally and in the cloud. We use Google Cloud serviceswhich store your data in Belgium.

 4. We collect your data when you react to our content posted on socialmedia platforms or when you share information from the Platform

You can find us on Facebook, X (formerly Twitter), YouTube, Instagram and LinkedIn.Whenever you interact with us through our social media accounts (e.g. comments,likes, shares, reviews, etc.), we will have access to the data you have madepublicly available on your profiles.

Personal Data: Your name, photograph, anyinformation publicly accessible on your social media profiles or voluntarilycommunicated by you.

Legal Basis for Processing: We process yourdata pursuant to our legitimate interest (Art. 6(1)(f) of Regulation (EU)2016/679) in improving our services and keeping you informed of news publishedby Growceanu that may be of interest to you.

With Whom We May Share YourData:

●     IT service providers for our company (hosting and data storage), providers to whom we outsource certaintechnical support services for the Platform.

●     Online platforms:Facebook, X (formerly Twitter), YouTube, LinkedIn, Instagram.

●     The integrated social media marketing service provider with whom the company has an ongoing contract.

●     Regulatory authorities and other state authorities, where required by legal or statutory provisions.

We will disclose your personal data only to the extent strictly necessary toachieve our specified purpose.

How Long We Will Store the Data: Datashared on social media will be stored by those platforms in accordance withtheir own policies.

Where the Data is Stored: Data we downloadlocally will be stored on our secure servers, locally and in the cloud.

5. Enabling easy and enjoyable browsing on our Platform

When you visit our Platform, we collect data about you through online identifiers(cookies and IP addresses), stored in log files. We use this information to design the Platform in line with our users' needs. We may also use your IP address to diagnose any malfunctions of our servers and to manage our Platform, to analyse trends, to track visitor movements and to collect generaldemographic information that helps us identify visitor preferences.

Youcan find more information about cookies, as well as how to delete cookies anddisable tracking, by accessing the Cookie Policy available on our Platform.

Personal Data: Internet Protocol (IP) address,general computer location, device (at country level), Platform browsing history, timestamp, request/action.

Legal Basis for Processing:

●     We use cookies in pursuit of our legitimate interest in making your experience on our Platform easy and enjoyable (Art. 6(1)(f) of Regulation (EU) 2016/679).

●     Non-essential cookies are not used without your consent (Art. 6(1)(a) of Regulation (EU) 2016/679).

With Whom We May Share Your Data:

●     IT service providers forour company (hosting and data storage), providers to whom we outsource certaintechnical support services for our Platform.

●     Third parties that place cookies: google.com, webflow.com, hotjar.com, intercom.io, customer.io.

●     Regulatory authorities and other state authorities, where required by legal or statutory provisions.

Wewill disclose your personal data only to the extent strictly necessary to achieve our specified purpose.

How Long We Will Store the Data: There are session cookies and persistent cookies. While session cookies are deletedwhen the browser is closed, persistent cookies may have a different lifespan depending on the purpose of the cookie. You can find more information about the lifespan of the cookies we use in our Cookie Policy.

Where the Data is Stored: Data is stored on servers located in the USA.

6. Marketing and commercial communications

We may send you information about the products and services we offer if you have requested this (by email, via the contact page, or by subscribing to our newsletter), or if you are already our customer and this information is of particular interest to you.

PersonalData: First name, surname, telephone number, email address.

Legal Basis for Processing:

●     We process this data onthe basis of your consent (Art. 6(1)(a) of Regulation (EU) 2016/679) given forthe purposes of carrying out marketing communications.

●     We will process this data in pursuit of our legitimate interest where you are already our customer and we consider that the information may be of great interest to you (Art.6(1)(f) of Regulation (EU) 2016/679).

With Whom We May Share Your Data:

●     IT service providers for our company (hosting and data storage), providers to whom we outsource certaintechnical support services for our Platform.

●     Newsletter serviceprovider: with whom the company has an ongoing contract.

●     SMS Marketing serviceprovider: with whom the company has an ongoing contract.

●     Integrated social mediamarketing service provider: with whom the company has an ongoing contract.

●     Regulatory authoritiesand other state authorities, where required by legal or statutory provisions.

We will disclose your personal data only to the extent strictly necessary toachieve our specified purpose.

How Long We Will Store the Data:

●     In the case of anewsletter subscription, data processing will continue until you request tounsubscribe.

●     In the case ofprocessing carried out in our legitimate interest, where you are already ourcustomer, we will process your data during the performance of the contract andwill continue to do so for 1 year after the termination of the contract.

Where the Data is Stored: Data recordedthrough our Platform will be stored on the hosting provider's servers, locatedin the EU, the United Kingdom and the United States of America. Data shared with the newsletter or SMS service provider will be stored on their servers, in accordance with their own policies. Data we download locally will be stored locally and in the cloud.

 Important:

Ifyou no longer wish to receive newsletters or informational materials fromGrowceanu, you must click the "Unsubscribe" button available in theemails sent to you.

Is the Data Processed by Growceanu Secure?

Growceanu pays particular attention to protecting your data and applies appropriate technical and organisational measures to ensure the protection of the personal data it processes, commensurate with the risks and the categories of data being protected. In particular, we protect your data by restricting access toauthorised persons, complying with applicable legislation, and taking measures against the modification, loss, deterioration or destruction of data.

If you suspect a breach of the confidentiality of your data, please contact us immediately at dpo@growceanu.com.

Important: Once the data retention period has ended, your data will be deleted. We will continue to use such data only after its irreversible anonymisation, where we believe it could help us improve the quality of our products or services.

Links to Other Websites

‍Our Platform may contain links to other websites that are not owned or controlled by us. Please note that we are not responsible for the privacy practices of other websites or third parties. We encourage you to be aware of this when leaving our Platform and to read the privacy policies of each website that may collect your personal data.

Disclaimer

The content included on our Platform is presented for informational purposes only and is made available in good faith. If any published content or other information is subject to copyright law or related laws, please notify us at support@growceanu.com so that we may take legal action.

Growceanu assumes no responsibility and cannot be held liable for any damages caused by the improper use of products/services contracted through this Platform.

Wedo not accept liability for malfunctions, viruses or damages caused by system errors when accessing the Platform.

Nevertheless,we will do our best to keep the information provided up to date.

Processing of Minors' Data

The Growceanu Platform is not intended to be used by minors. Growceanu does not knowingly collect information about minors under the age of 18. If we discover that a minor has used our Platform without the consent of their legal guardian, we will delete all personal data relating to them.

International Data Transfers

Your personal data will be transferred to recipients established outside theEuropean Economic Area, including the United Kingdom and the United States of America. We will ensure that all transfers take place in accordance with applicable data protection laws.

In particular:

●     United Kingdom —benefits from the adequacy decision of the European Commission of 28 June 2021(Commission Implementing Decision (EU) 2021/1772), as extended.

●     United States of America— transfers are carried out on the basis of the EU-US Data Privacy Framework,verifying the recipient's adherence, or on the basis of the StandardContractual Clauses (SCCs) adopted by the European Commission, accompanied byadditional safeguards where necessary.

●     ConnectPay UAB(Lithuania) — entity within the EEA, no additional transfer mechanism required.

●     Intercom, Inc. (USA) —transfer on the basis of the EU-US Data Privacy Framework or SCCs.

●     Customer.io, Inc. (USA)— transfer on the basis of the EU-US Data Privacy Framework or SCCs.

In the event that the country to which we transfer your data is outside the EEAand has not been recognised as providing adequate protection by the European Commission, the transfer will be carried out on the basis of agreements using standard contractual clauses or other appropriate safeguards, in accordance with applicable legislation. We will only authorise the international transferof data to controllers/processors that offer adequate guarantees, provide opposing rights and effective remedies for data subjects.

This means that we will take additional steps to ensure that your personal data istreated as safely and securely as within the EEA in accordance with the GDPR,including:

●     Having a GDPR-compatibledata processing addendum with sub-processors in third countries.

●     Ensuring that thesesub-processors have adequate security procedures in place.

Your Rights

As a data subject, you have specific legal rights regarding the personal data we collect and process. Growceanu respects your rights and supports yourinterests.

Withdrawal of consent: If processing is carriedout on the basis of your consent, you may withdraw it at any time.

Rectification of data: If you notice that we havestored your personal data with any error, you may request rectification at anytime. We make reasonable efforts to keep the personal data — which is incontinuous use and in our possession or under our control — accurate, complete, up to date and relevant, based on the most recent information available.

Restriction of processing: If you find yourself in one of the following situations, you may request that we restrict the processing of your data:

●     You contest the accuracyof the personal data for the period during which we must verify its accuracy.

●     The processing is unlawful and you request restriction of processing rather than erasure.

●     We no longer need your personal data but you require it for the establishment, exercise or defence ofa right.

●     You object to processingwhile we verify whether our legitimate grounds override your rights.

Access to your data: You may requestinformation about the personal data we process, including information on the categories of data, its use, where we collected it from (if not collected directly from you), and to whom it has been disclosed (if applicable). You may obtain a copy from us, free of charge, along with the personal data we holdabout you. We reserve the right to charge a reasonable fee for abusive requests.

Data portability: Upon request and wheretechnically feasible, we will transfer your personal data to another controller, where processing is based on consent or the performance of acontract and is carried out by automated means. Instead of receiving a copy ofyour personal data, you may request that your data be transferred directly toanother controller specified by you.

Right to erasure: You may obtain theerasure of your personal data if:

●     The data is no longer necessary for the purposes for which it was processed.

●     You object to the further processing of personal data (see Right to Object below).

●     The personal data has been unlawfully processed.

●     You withdraw the consent on the basis of which processing takes place.

Unless processing is necessary:

●     To fulfil a legal obligation requiring us to process the data.

●     In accordance with legal provisions on data retention.

●     For the establishment, exercise or defence of a right in court.

Right to object: You may object at any timeto the processing of your personal data on grounds relating to your particularsituation. In such a case, we will no longer process your personal data, unlesswe can demonstrate compelling legitimate grounds for the processing or for theestablishment, exercise or defence of a right. When you object to processing,please specify whether you wish to have your personal data erased or to haveprocessing restricted.

Right to lodge a complaint: In the event ofan alleged breach of data protection legislation, you may lodge a complaintwith the national supervisory authority for data protection.

Please note!

Time period: We will endeavour to respondto your request within 30 days. However, the period may be extended depending on the complexity of the request.

Restriction of access: In certain situations, we may not be able to grant you access to all or part of your personal data due torestrictions provided by law. If we refuse your request for access to yourdata, we will inform you of the reason for the refusal.

Inability to identify: In some cases, we maynot be able to identify personal data due to the lack of identifying elementsprovided in the request you send us. In such cases, if you do not provideadditional information to identify yourself, we will be unable to fulfil yourrequest and to allow you to exercise your legal rights as described in thissection.

Exercising Your Legal Rights

To exercise your legal rights or if you wish for any further information about howwe use your data, please contact us in writing at dpo@growceanu.com.

Last updated: 16.06.2026