Privacy Policy

Introduction

Leus Danışmanlık Anonim Şirketi ("Leus", "Company", "we", "us", or "our") respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, disclose and safeguard your personal data when you visit our website at leus.capital (the "Website"), and describes your rights and how the law protects you.

We aim to comply with Law No. 6698 on the Protection of Personal Data of Türkiye (the "Law" or "KVKK"), and, where applicable to visitors in those regions, the UK GDPR and the Data Protection Act 2018, and the EU GDPR. Where this Policy refers to the "GDPR", it means the UK GDPR and the EU GDPR as applicable to you.

Scope

This Privacy Policy applies only to personal data collected through the Website. It does not cover:

• personal data processed through the Leus account and eligibility scoring platform (app.leus.capital), which is covered by our separate User Agreement; or
• third-party websites linked from the Website, which are governed by their own privacy policies.

Please also review our Cookie Policy, which forms part of this Privacy Policy and describes the cookies and similar technologies used on the Website.

Data controllers and contacts

The Leus entity responsible for your personal data depends on the services you use, the location from which those services are offered to you and the entity that determines the purposes and means of the relevant processing.

• United Kingdom: our UK establishment above acts as our UK point of contact; a separate UK representative is therefore not required.
• Data protection contact: [email protected]

Categories of personal data we collect

We collect the following categories of personal data through the Website:

• Contact and identity data: such as your email address and any name or other identifying information you choose to provide when you use our support chat or contact us by email, including at [email protected].
• Usage and technical data: such as your IP address, device and browser type, operating system, referring URL, pages viewed, time spent on pages, clicks and other interactions, session information, performance data, error and diagnostic information, and approximate location derived from your IP address.
• Cookie and analytics data: identifiers, session and interaction data, session recordings and related information collected through cookies, local storage and analytics technologies, including Google Analytics, PostHog and Cloudflare Web Analytics, as further described in our Cookie Policy.
• Communications data: including support chat messages, email correspondence, enquiries, feedback, records of communications and any other information you choose to provide when communicating with us.

We do not intentionally collect special categories of personal data (for example health, biometric, or financial-account data) through the Website. Please do not submit such data to us via the Website. For the avoidance of doubt, if you nevertheless submit such information to us, we will process it only where necessary and permitted under applicable law.

Purposes of processing and legal bases

We process your personal data for the purposes and on the legal bases below. Under Article 5 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") our bases are performance of a contract, compliance with a legal obligation, our legitimate interests (where your fundamental rights and freedoms are not harmed), and, where required, your explicit consent. Under the GDPR (Art. 6) our bases are performance of a contract, compliance with a legal obligation, our legitimate interests, and your consent.

Where processing is based on your consent, you may withdraw it at any time (see "How to exercise your rights" below). Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Cookies and similar technologies

The Website uses cookies and similar technologies for essential functionality, performance/analytics, and (where you consent) personalisation and marketing. Detailed information about the cookies we use, their purposes, providers and durations, together with how to manage your preferences, is available in our Cookie Policy. This includes our use of Google Tag Manager and the tags it deploys, and PostHog and Google Analytics.

Recipients and data sharing

We do not sell your personal data. We may share your personal data with the following categories of recipients, only to the extent necessary for the purposes described above:

• Hosting and IT infrastructure providers: the Website runs on Amazon Web Services (AWS) infrastructure in the EU (Frankfurt, eu-central-1) region.
• Analytics providers: we use PostHog (product analytics), configured on its EU cloud environment and served through our own subdomain (n.leus.capital) acting as a reverse proxy, and Google Analytics (via Google Tag Manager), to understand how visitors use the Website, as also described in our Cookie Policy.
• Electronic signature provider: DocuSign, used in the application (app.leus.capital) to deliver and record signature of the non-disclosure agreement. This is not used on this Website.
• Web font provider: the application loads web fonts from Google Fonts, which transmits your IP address to Google to deliver the font files. This Website serves its fonts from our own servers and makes no request to Google for fonts.
• Professional advisers and technical service providers: consultants and technical service providers from whom we procure IT and cookie-related services.
• Legally authorised public institutions and organisations: where disclosure is required by applicable law or in response to lawful requests by competent authorities.

International transfers of personal data

Our hosting (AWS) and product analytics (PostHog) are configured in the EU (EEA). However, some service providers, in particular Google Analytics, are established outside Türkiye and/or the EU/EEA (for example in the United States) and may process personal data abroad. Our group also operates from Türkiye and the United Kingdom, so data may move between those countries.

• Under KVKK (Art. 9), personal data may be transferred abroad on the basis of an adequacy decision, appropriate safeguards (such as standard contracts approved by the Board), another lawful condition, and/or your explicit consent where relied upon.
• Under the GDPR, where personal data of UK or EU/EEA visitors is transferred outside the UK/EEA, we rely on an adequacy decision or on appropriate safeguards such as the European Commission's Standard Contractual Clauses, and, for the UK, the International Data Transfer Agreement (IDTA) or UK Addendum (including the UK Extension to the EU-US Data Privacy Framework for certified providers).

Data retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting or reporting requirements.

• Subscription/contact data: retained until you unsubscribe or request deletion, and thereafter only as required by law.
• Analytics and cookie data: retained for the durations set out in the Cookie Policy.
• Server logs: 2 years.

When personal data is no longer required, it is deleted, destroyed or anonymised in accordance with applicable law.

Your rights

Rights under KVKK (Article 11)

You have the right to:

• learn whether your personal data is processed;
• request information if it has been processed;
• learn the purpose of processing and whether it is used accordingly;
• learn the third parties to whom your data is transferred domestically or abroad;
• request correction of incomplete or inaccurate data and that this be notified to third parties;
• request deletion or destruction and that this be notified to third parties;
• object to a result arising solely from automated analysis of your data; and
• claim compensation for damage arising from unlawful processing.

Rights under the GDPR (UK and EU visitors)

You additionally have the right to: access; rectification; erasure ("right to be forgotten"); restriction of processing; data portability; objection to processing (including for direct marketing); and to withdraw consent at any time. You also have the right to lodge a complaint with a supervisory authority: the ICO (UK, ico.org.uk), your local EU Data Protection Authority, or the KVKK Board (Türkiye, kvkk.gov.tr).

For the avoidance of doubt, the withdrawal of consent does not affect the lawfulness of processing carried out before such withdrawal.

How to exercise your rights / contact us

To exercise any of the rights above, or for any questions about this Privacy Policy, contact us at:

For KVKK requests, your application must include: (a) your name, surname and signature if the application is in writing; (b) your Turkish ID number for Turkish citizens, or nationality, passport number or ID number for foreign nationals; (c) your residence or workplace address for notifications; (d) your email, telephone or fax for notifications, if applicable; and (e) the subject of your request. Your request will be finalised as soon as possible and within thirty (30) days at the latest, free of charge (a fee set by the Board's tariff may apply where a request incurs additional cost). Under the GDPR, we respond within one month.

Children's privacy

The Website is intended for a business/professional audience and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

Data security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse or alteration, in accordance with the requirements of the Law and the GDPR.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated "Last updated" date and will be effective as soon as it is published on the Website. We encourage you to review this Policy periodically.