Privacy Policy

Introduction

Leus Danışmanlık Anonim Şirketi ("Leus", "Company", "we", "us", or "our") respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, disclose and safeguard your personal data when you visit our website at leus.capital (the "Website") and when you create an account on, or otherwise use, our eligibility scoring and analytics application at app.leus.capital (the "Application"), and describes your rights and how the law protects you. The Website and the Application together form the "Platform", as that term is defined in the User Agreement.

We aim to comply with Law No. 6698 on the Protection of Personal Data of Türkiye (the "Law" or "KVKK"), and, where applicable to visitors and users in those regions, the UK GDPR and the Data Protection Act 2018, and the EU GDPR. Where this Policy refers to the "GDPR", it means the UK GDPR and the EU GDPR as applicable to you.

Scope

This Privacy Policy applies to personal data collected through the Platform, that is:

• the Website (leus.capital), including visitors who browse it, contact us or subscribe to our communications; and
• the Application (app.leus.capital), including the registration and account creation flow, the eligibility scoring service, our funding-related products (Capital, ReLoad and any successor products), predictive analytics (Lumina) and creative intelligence (Visua).

Where this Policy describes processing that applies only to the Website or only to the Application, this is stated expressly.

This Policy does not cover third-party websites and services linked from, or connected to, the Platform, which are governed by their own privacy policies.

This Policy is incorporated into, and forms an integral part of, the User Agreement that governs your use of the Application. Where the User Agreement and this Policy differ in relation to personal data, this Policy prevails. Capitalised terms that are not defined in this Policy — including "Services", "Score", "Partner Institutions", "User Account" and "Authorised Representative" — have the meaning given to them in the User Agreement.

Please also review our Cookie Policy, which forms part of this Privacy Policy and describes the cookies and similar technologies used across the Platform.

Data controllers and contacts

The Leus entity responsible for your personal data depends on the services you use, the location from which those services are offered to you and the entity that determines the purposes and means of the relevant processing.

• United Kingdom: our UK establishment above acts as our UK point of contact; a separate UK representative is therefore not required.
• Data protection contact: [email protected]

Categories of personal data we collect

We collect the following categories of personal data, depending on whether you use the Website, the Application, or both.

Through the Website

• Contact and identity data: such as your email address and any name or other identifying information you choose to provide when you use our support chat or contact us by email, including at [email protected].
• Usage and technical data: such as your IP address, device and browser type, operating system, referring URL, pages viewed, time spent on pages, clicks and other interactions, session information, performance data, error and diagnostic information, and approximate location derived from your IP address.
• Cookie and analytics data: identifiers, session and interaction data, session recordings and related information collected through cookies, local storage and analytics technologies, including Google Analytics, PostHog and Cloudflare Web Analytics, as further described in our Cookie Policy.
• Communications data: including support chat messages, email correspondence, enquiries, feedback, records of communications and any other information you choose to provide when communicating with us.

We do not intentionally collect special categories of personal data (for example health or biometric data) through the Website. Please do not submit such data to us via the Website. For the avoidance of doubt, if you nevertheless submit such information to us, we will process it only where necessary and permitted under applicable law.

Through the Application

The Application is used by businesses, and most of the information submitted through it is company information rather than personal data. Where that information identifies an individual — typically an authorised representative, shareholder, director or employee of the user company — it is personal data and this Policy applies to it.

• Account and registration data: name and surname, business email address, company/organisation name, job title or position, hashed account password, preferred language, and how you heard about us (including any referrer name or referral code you choose to enter).
• Authority and onboarding data: information and documents evidencing that an individual is authorised to act for the user company, such as signature circulars, trade registry records, tax identification details and identity information contained in those documents, together with the identity and contact details of other members you invite to the account.
• Funding application, company and financial data: the information and documents you submit for eligibility assessment, including company financial statements, revenue and expense data, banking and funding information, and any personal data contained in those documents.
• Integration data: data retrieved, with your authorisation, from third-party accounts you connect to the Application using API keys or similar credentials — including Adjust, AppsFlyer, Singular, Adapty, RevenueCat, AppLovin, Apple Search Ads, App Store Connect, Google Play, Google Ads, Google Analytics and Meta — together with the credentials themselves, which are stored in encrypted form. This data is predominantly aggregated performance, marketing and revenue data about your applications, but may include personal data relating to the individuals who administer those accounts.
• Scoring data: the eligibility Score generated for your company, the inputs and intermediate results used to produce it, and the record of Scores and supporting information shared with Partner Institutions.
• Electronic signature data: information processed when a non-disclosure agreement is signed through DocuSign, including signer name, email address, signature, IP address and signature audit trail.
• Consent and contract records: records of your acceptance of the User Agreement and acknowledgement of this Policy, including timestamp and the version of the documents shown, together with any explicit consents you give and any withdrawal of those consents.
• Usage, technical, cookie and communications data: as described for the Website above, collected while you use the Application.

We do not request special categories of personal data (for example health or biometric data) through the Application, and you should not upload documents containing such data unless we specifically ask for them. If special-category data reaches us within a document you submit, we process it only where necessary and permitted under applicable law, and delete it where it is not required.

Where you submit personal data relating to other individuals (for example your colleagues, representatives or shareholders), you are responsible under the User Agreement for having the necessary rights and, where required, consents to do so, and for informing those individuals about this Policy.

How we collect personal data

We collect personal data by electronic means:

• directly from you, through the forms you complete and the documents you upload — including the contact and support channels on the Website, and the registration form, onboarding steps, member invitations, document uploads and support requests on the Application;
• automatically, through cookies, local storage, server logs and analytics technologies when you use the Platform, as described in our Cookie Policy;
• from third-party platforms you connect to the Application, using the API keys or similar credentials you provide; and
• from publicly available and official sources, such as trade registry records, where necessary to verify company or authority information.

We may also receive personal data about you from the user company on whose behalf you act, for example when an authorised representative invites you to a User Account.

Purposes of processing and legal bases

We process your personal data for the purposes and on the legal bases below. Under Article 5 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") our bases are performance of a contract, compliance with a legal obligation, our legitimate interests (where your fundamental rights and freedoms are not harmed), and, where required, your explicit consent. Under the GDPR (Art. 6) our bases are performance of a contract, compliance with a legal obligation, our legitimate interests, and your consent.

Purposes common to the Website and the Application

Purposes specific to the Application

Where processing is based on your consent, you may withdraw it at any time (see "How to exercise your rights" below). Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Where processing is necessary for the performance of the User Agreement, withdrawing the underlying information or connections may mean we can no longer provide the Services.

Automated decision-making and eligibility scoring

The eligibility scoring performed on the Application is fully automated: a Score is generated from the information you provide and the data retrieved from the accounts you connect, without human review at the point it is produced. The Score, together with the supporting information, may be shared with Partner Institutions at your instruction. Funding decisions are taken by the relevant Partner Institution, not by Leus.

Scoring is carried out on company information and is directed at assessing the eligibility of a business, not of an individual. Where, nevertheless, an automated evaluation produces a legal effect or a similarly significant effect for an individual, that individual has the right:

• under KVKK Article 11, to object to a result arising solely from the automated analysis of their personal data; and
• under GDPR Article 22, not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, and to obtain human intervention, to express their point of view, and to contest the decision.

To exercise these rights, contact us at [email protected].

Cookies and similar technologies

The Website and the Application use cookies and similar technologies for essential functionality (including keeping you signed in), performance/analytics, and (where you consent) personalisation and marketing. Detailed information about the cookies we use, their purposes, providers and durations, together with how to manage your preferences, is available in our Cookie Policy. This includes our use of Google Tag Manager and the tags it deploys, and PostHog and Google Analytics.

Recipients and data sharing

We do not sell your personal data. We may share your personal data with the following categories of recipients, only to the extent necessary for the purposes described above:

• Partner Institutions (Application only): the banks and financial institutions to which, at your instruction and where required with your explicit consent, we provide your Score and the supporting information so that they can evaluate a funding request. Each Partner Institution acts as an independent data controller for its own evaluation and processes personal data under its own privacy notice. You may withdraw this instruction at any time for future sharing, although this may mean we can no longer provide the Services.
• Hosting and IT infrastructure providers: the Website and the Application run on Amazon Web Services (AWS) infrastructure in the EU (Frankfurt, eu-central-1) region.
• Analytics providers: we use PostHog (product analytics), configured on its EU cloud environment and served through our own subdomain (n.leus.capital) acting as a reverse proxy, and Google Analytics (via Google Tag Manager), to understand how the Platform is used, as also described in our Cookie Policy.
• Electronic signature provider (Application only): DocuSign, used in the Application to deliver and record signature of the non-disclosure agreement. It is not used on the Website.
• Third-party platforms you connect (Application only): where you connect a third-party account (for example Adjust, AppsFlyer, Singular, Adapty, RevenueCat, AppLovin, Apple Search Ads, App Store Connect, Google Play, Google Ads, Google Analytics or Meta), we retrieve data from that provider using the credentials you supply. Data flows to us; we do not disclose the data you hold on the Application to those providers beyond what is technically necessary to authenticate the connection.
• Communication and support providers (Application only): email delivery and support/messaging providers used to send account, transactional and support messages.
• Web font provider: the Application loads web fonts from Google Fonts, which transmits your IP address to Google to deliver the font files. The Website serves its fonts from our own servers and makes no request to Google for fonts.
• Professional advisers and technical service providers: consultants, auditors, legal advisers and technical service providers from whom we procure IT and cookie-related services.
• Legally authorised public institutions and organisations: where disclosure is required by applicable law or in response to lawful requests by competent authorities.
• Corporate transactions: where we undergo a merger, acquisition, reorganisation or sale of assets, personal data may be disclosed to the counterparty and its advisers, subject to confidentiality obligations and applicable law.

International transfers of personal data

Our hosting (AWS) and product analytics (PostHog) are configured in the EU (EEA). However, some service providers, in particular Google Analytics, DocuSign and the third-party platforms you connect to the Application, are established outside Türkiye and/or the EU/EEA (for example in the United States) and may process personal data abroad. Our group also operates from Türkiye and the United Kingdom, so data may move between those countries.

Partner Institutions are, as a rule, established in Türkiye. Where a Score and supporting information would be shared with a Partner Institution abroad, that transfer is made on one of the bases below and, where required, on the basis of your explicit consent.

• Under KVKK (Art. 9), personal data may be transferred abroad on the basis of an adequacy decision, appropriate safeguards (such as standard contracts approved by the Board), another lawful condition, and/or your explicit consent where relied upon.
• Under the GDPR, where personal data of UK or EU/EEA users is transferred outside the UK/EEA, we rely on an adequacy decision or on appropriate safeguards such as the European Commission's Standard Contractual Clauses, and, for the UK, the International Data Transfer Agreement (IDTA) or UK Addendum (including the UK Extension to the EU-US Data Privacy Framework for certified providers).

Data retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting or reporting requirements.

• Subscription/contact data: retained until you unsubscribe or request deletion, and thereafter only as required by law.
• Analytics and cookie data: retained for the durations set out in the Cookie Policy.
• Server logs: 2 years.
• Account and profile data (Application): retained for the term of the User Agreement and, after your account is closed, for the applicable statutory limitation period.
• Funding application, company, financial and scoring data (Application): retained for the term of the User Agreement and thereafter for the periods required by commercial, tax and accounting legislation. Where you have obtained funding through a Partner Institution, the related records are retained until repayment is complete and for the statutory period thereafter.
• Integration credentials (Application): deleted when you disconnect the relevant integration or close your account, subject to Section 3.5 of the User Agreement while funding remains outstanding.
• Non-disclosure agreement and signature audit trail (Application): retained for the statutory limitation period following termination.
• Records of acceptance and consent (Application): retained for as long as necessary to evidence compliance with our legal obligations.

When personal data is no longer required, it is deleted, destroyed or anonymised in accordance with applicable law.

Your rights

Rights under KVKK (Article 11)

You have the right to:

• learn whether your personal data is processed;
• request information if it has been processed;
• learn the purpose of processing and whether it is used accordingly;
• learn the third parties to whom your data is transferred domestically or abroad;
• request correction of incomplete or inaccurate data and that this be notified to third parties;
• request deletion or destruction and that this be notified to third parties;
• object to a result arising solely from automated analysis of your data; and
• claim compensation for damage arising from unlawful processing.

Rights under the GDPR (UK and EU visitors and users)

You additionally have the right to: access; rectification; erasure ("right to be forgotten"); restriction of processing; data portability; objection to processing (including for direct marketing); and to withdraw consent at any time. You also have the right to lodge a complaint with a supervisory authority: the ICO (UK, ico.org.uk), your local EU Data Protection Authority, or the KVKK Board (Türkiye, kvkk.gov.tr).

For the avoidance of doubt, the withdrawal of consent does not affect the lawfulness of processing carried out before such withdrawal.

How to exercise your rights / contact us

To exercise any of the rights above, or for any questions about this Privacy Policy, contact us at:

For KVKK requests, your application must include: (a) your name, surname and signature if the application is in writing; (b) your Turkish ID number for Turkish citizens, or nationality, passport number or ID number for foreign nationals; (c) your residence or workplace address for notifications; (d) your email, telephone or fax for notifications, if applicable; and (e) the subject of your request. Your request will be finalised as soon as possible and within thirty (30) days at the latest, free of charge (a fee set by the Board's tariff may apply where a request incurs additional cost). Under the GDPR, we respond within one month.

Children's privacy

The Platform is intended for a business/professional audience and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

Data security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse or alteration, in accordance with the requirements of the Law and the GDPR.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated "Last updated" date and will be effective as soon as it is published on the Website. Where a change materially affects how we process personal data of Application users, we will notify account holders through the Application or by email before it takes effect. We encourage you to review this Policy periodically.