Privacy Policy

1. Purpose of This Privacy Policy

This Privacy Policy sets out how Marta Capital Advisors Private Limited (“Marta Capital”, “we”, “us”, or “our”) collects, uses, discloses, processes, and protects Personal Data in accordance with the Personal Data Protection Act 2012 of Singapore (“PDPA”). By interacting with us, whether through our website, email, in person, or otherwise, you consent to the collection, use, and disclosure of your Personal Data in accordance with this Policy.

This Policy applies to all persons whose Personal Data is in our possession or under our control, including clients, deal counterparties, investors, investment targets, business contacts, service providers, officers, directors, shareholders, and Connected Persons.

2. Definition of Personal Data

“Personal Data” means data, whether true or not, about an individual who can be identified:

1. from that data alone; or
2. from that data and other information to which Marta Capital has or is likely to have access.

Examples include: name, contact details, identification numbers, job title, shareholding or ownership information, electronic identifiers, and data relating to business or investment dealings with us.

A “Connected Person” includes (where relevant) a director, shareholder, beneficial owner, officer, trustee, settlor, authorised signatory, employee, mandate holder, partner, guarantor, or other individual linked to a transaction, investment, or legal entity.

3. Types of Personal Data We Collect

Depending on the nature of your relationship with us, we may collect:

• Identity data (name, nationality, date of birth, identification number, title)
• Contact data (email address, telephone number, correspondence address)
• Business and professional data (role, company name, shareholdings, directorships)
• Counterparty / investor relationship data (deal involvement, co-investor status, mandate history)
• Due diligence information (where provided via third-party KYC providers)
• Technical data (IP address, browser type, cookies, website analytics logs)
• Communications data (emails, meeting notes, submitted documents)

We do not collect or require sensitive biometric, medical, or financial account information unless strictly necessary and legally justified.

4. How We Collect Personal Data

We may collect Personal Data through:

• Direct communications (email, phone, business meetings)
• Exchange of business cards or corporate documents
• Submission of forms, NDAs, investment decks, or counterparty data
• Public databases, regulatory filings, LinkedIn and corporate registries
• Third-party due diligence providers (e.g., AML/KYC outsourcing vendors)
• Website use, inquiry forms, subscriptions, or investor update requests
• Referrals from law firms, advisors, investors, or business partners

We do not automatically collect Personal Data via our website unless it is voluntarily provided, or cookies/analytics are accepted.

5. Purpose of Use of Personal Data

We collect, use, and/or disclose Personal Data for the following purposes:

a) Core business purposes

• Assessing, sourcing, structuring, or evaluating investment or advisory opportunities
• Managing relationships with institutional investors, deal counterparties, founders, or partners
• Conducting commercial due diligence, market assessment or transaction feasibility
• Reviewing co-investment or strategic advisory options
• Preparing contracts, NDAs, engagement documents, or investment papers

b) Legal, regulatory, and compliance purposes

• KYC, AML, sanctions screening (whether performed by us or a third-party)
• Responding to lawful regulatory, tax, government, or court requests
• Record keeping and audit obligations

c) Business administration

• Internal reporting, business intelligence and workflow management
• IT system management, cyber security, or data hosting

d) Communications and marketing

• Sending updates, newsletters, event invitations, or transaction insights (only with consent)
• Contacting professional or institutional contacts for business development

We do not sell, rent, or trade Personal Data.

6. No Advisory Relationship to Individuals

Marta Capital does not provide personalised investment or financial advice to individuals unless a separate written advisory agreement has been executed. Any Personal Data relating to individuals is processed only in connection with corporate, institutional, investment, or transactional matters.

7. Disclosure of Personal Data

Personal Data may be disclosed to:

Category	Examples
Advisors & counterparties	Law firms, strategy consultants, professional services firms
Third-party processors	IT providers, cloud hosts, CRM systems, document management tools
Co-investment or transaction parties	Investors, acquirers, sellers, or deal syndicate members
Regulatory or government entities	Only where legally required
External KYC/AML providers	Screening and risk compliance service firms
Data room or escrow providers	Where needed for due diligence or transaction execution

We require all third parties to protect Personal Data in a manner consistent with the PDPA.

8. Cross-Border Transfers

Where Personal Data is transferred outside Singapore, Marta Capital ensures that the receiving party provides a standard of protection comparable to the PDPA, including via contractual safeguards or statutory exemptions.

9. Data Retention

Personal Data is retained only for as long as necessary to fulfil the business purpose for which it was collected, or to satisfy legal, regulatory, audit, or archival requirements.

10. Data Security

We implement reasonable administrative, technical, and organisational safeguards to prevent unauthorised access, disclosure, alteration, or destruction of Personal Data. However, no method of transmission over the Internet is fully secure.

11. Rights Under the PDPA

You may submit a written request to:

• access your Personal Data
• correct or update inaccurate Personal Data
• withdraw consent to continued use or disclosure (subject to legal or contractual restrictions)

Requests should be directed to our Data Protection Officer (details below). We may require identity verification. Withdrawal of consent may affect our ability to continue business relations or maintain contractual obligations.

12. Do Not Call (DNC) Registry

We comply with the DNC provisions of the PDPA. Marketing communications to Singapore telephone numbers will not be sent unless consent has been obtained or an exemption applies.

13. Updates to This Policy

We may amend this Policy at any time without prior notice. The updated version will be published on our website.

14. Contact