Carta Europe Privacy Statement

Background and this Statement

Your privacy is of crucial importance to Carta Europe.

This Privacy Statement describes how Carta Europe collects, processes and protects your personal data. Overall, Carta Europe processes your personal data in compliance with regulation protecting personal data, according to best practices for secure handling of personal data, and with the utmost respect.

This Privacy Statement also contains information on Carta Europe’s use of cookies and similar technologies.

If you wish to contact Carta Europe about processing of your personal data, our contact information is found in the bottom of this document.

Scope

This Privacy Statement applies to all business processes in Carta Europe and to all Carta Europe websites, domains, digital solutions, cloud or other services, branches, subsidiaries and communities as well as Carta Europe branded websites (collectively referred to as also as Carta Europe).

Service specific terms and conditions will be found in our Terms of Use agreement.

The Privacy Statement provides information about data processing carried out by Carta Europe when Carta Europe determines the purpose and means of the processing (Carta Europe act as data controller). Data processing Carta Europe perform on behalf of our Customers based on their instructions (the Customer acts as data controller and Carta Europe as data processor) is described in our Data Processor Agreement and is a part of our Customer Agreement.

Personal data is information that can identify you as a person, such as an email address, street address or phone number. Processing your personal data is necessary for us to serve you and our Customers. Please do not use Carta Europe services if you do not agree with how we process personal data according to this Privacy Statement.

This Privacy Statement is published with the aim to make it easy for our users, customers and the public to understand what personal data we collect, store and process, why we do so, how we receive and/or obtain that information, and the rights an individual has with respect to their data in our possession.

By using https://carta.com/uk/en/, or Carta Europe products and services, individuals consent to how we obtain and process personal data, including the purposes for which we process data and how we share data internally and with third parties. When you explicitly accept our Terms of Use, you also accept the conditions outlined in this Privacy Statement, as well as our Email Policy (https://carta.com/uk/en/legal/carta-europe/email-policy/).

Whose data do we collect and process

As a Data Controller, Carta Europe collects and process personal data about the following Data Subjects:

a) Carta Europe End Users (or just “Users”, “End Users” or “Carta Europe Users”), either Registered Users of the Carta Europe platform (End Users with a personal Carta Europe account), or other Carta Europe End Users, including, but not limited to, visitors to Carta Europe’s websites, and recipients of emails from a Carta Europe Customer sent via Carta Europe,

b) Submitters of support tickets (often Carta Europe Users already),

c) Job Applicants,

d) Potential customers’ contact persons (Leads),

e) Customers’ contact persons (Customer Representatives),

f) Customer companies’ owners,

g) Visitors to Carta Europe’s physical premises,

h) Employees.

Why we collect your data

Carta Europe collects and process your personal data for a variety of reasons:

a) Deliver promised services to our Customers or promises made to you as a person,

b) Improve and develop quality, functionality and user experience of our products, services and sites,

c) Offer support, education and other useful interaction types to users of our products, services and sites,

d) Perform invoicing, payments, and other financial tasks,

e) Being able to operate our services, including maintaining, debugging and developing the technical platform,

f) Secure our business secrets, intellectual property and general service delivery by detecting and preventing threats and abuses,

g) Perform employee administration tasks for Employees,

h) Provide relevant, targeted content to Customer Leads,

i) Evaluate potential for becoming a Carta Europe employee for Job Applicants.

The legal basis for processing your personal data according to the above-listed purposes a) – h) is Carta Europe’s legitimate business interest in simply being able to operate Carta Europe and deliver promised services to Customers. We sincerely believe that this does not conflict with your privacy rights. The legal basis for purpose i) is your consent, which we assume from your offering of personal data, but will confirm when processing, as part of the Job Application process.

How we collect your data

Carta Europe collects personal data through several channels:

a) Most personal data are collected directly from you, based on information you offer to us via the usage of Carta Europe products, services, or websites, or via other channels, such as a direct email or job application,

b) Some personal data are collected via cookies and other tracking technologies, such as pixel tagging in emails. Carta Europe uses such tracking mechanisms to pursue the purposes a)-f) of the previous section.

c) Some personal may be offered to Carta Europe via your consent to a third-party about sharing that data, for instance, you can log in to Carta Europe via LinkedIn, in which case LinkedIn will provide Carta Europe with e.g. your email and name,

d) Finally, Carta Europe also collects data about you from other sources, such as third-party data aggregators, marketing, legal, accountant or other partners or subcontractors, or public sources. Carta Europe will in some instances be able to combine personal data about you from multiple sources, helping us improve and personalize your experience.

You can read more about cookies in the section below. If you have questions about the data collection, feel free to contact us.

Our Customers may list personal data about you on the Carta Europe platform: for instance, if you are a shareholder in company A, then company A may include personal information about you (such as name and address) in their registry of shareholders on Carta Europe. This holds true even if you have never registered as a Carta Europe user or interacted with Carta Europe in any way. In the situation where personal data about you is registered by a Customer of Carta Europe, that Customer is the Data Controller of your data. If you have privacy concerns or any questions in this situation, we recommend that you contact that company.

Data we collect

Carta Europe collects and process data about you such as:

a) Contact information provided by you or a Customer (name, addresses, emails, telephone numbers, social security numbers, …),

b) Demographic information provided by you, directly or indirectly, or a Customer, such as, but not limited to, birth date, age, gender, and interests,

c) Financial information provided by you or a Customer (investments),

d) Contact information (such as the above), and employment information about you at a Customer company, such as job title,

e) Contact and CV information about you, if you provide it as a Job Applicant,

f) Personal information you provide to Carta Europe as a Registered User, such as profile pictures, comments, social security numbers, tax codes, external profile links, content of texts, hashed versions of your Carta Europe password, and more,

g) Shared content about you on third party social networks explicitly linked to your Carta Europe account or used for Carta Europe login, such as your LinkedIn-profile,

h) Technical identifiers, such as IP-address, geographic location, Carta Europe unique user id, browser information (type, device, language, referrer url, etc.),

i) Site navigation information about your behavior and movements on Carta Europe sites,

j) Email handling information such as which emails from Carta Europe you open when and how.

Carta Europe will only retain your personal data for a period of time necessary to fulfil the stated purpose of the data collected, however, to provide a better general service, comply with legal requirements, and speed up and ease support, we may keep relevant bits of data for a reasonable period of time after your last interaction with Carta Europe, unless otherwise stated, this period will be maximally 5 years from your last interaction. When we no longer retain your personal data, it is destroyed, deleted or anynomized suitably.

Carta Europe does not collect or process any kind of sensitive personal data, such as data about ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, data concerning health or sex life or sexual orientation, genetic data and/or biometric data. Neither does Carta Europe store collect or process any information about criminal offences or serious social problems.

Data we share

Carta Europe and its business partners, subsidiaries, and departments within Carta Europe, may share your personal data among them to provide efficient and best possible customer service, user experience, and general delivery of services. Such sharing ensures that we can access updated and relevant information about you when we need it, and also ensures that we do not need to contact you more often than needed to obtain or update such data.

Carta Europe does not share your personal data with any third parties, unless:

a) You consent to a particular sharing of your data with a particular third party.

b) The third party is a subcontractor, vendor, affiliate or service partner, and the sharing is legitimate and necessary or even legally required, from a business perspective.

c) Public authorities legally require it. Carta Europe may be demanded to hand over personal information about you to e.g. police or courts, by court order or other legal instruments.

By agreeing to this Privacy Statement, you explicitly consent to share certain tracking information we collect about you as a Carta Europe website visitor, such as an IP-address, with third-parties in order to e.g. analyze webpage usage patterns. You can read more about cookies and similar technologies in the section below.

By agreeing to this Privacy Statement, you also consent to sharing certain personal data with third parties – Carta Europe Customer companies – which then become the data controllers of that shared data at the moment of sharing. The purpose of this is to connect users and companies on the Carta Europe platform, a core reason for the Carta Europe platform to exist; we believe that this does not conflict with your privacy rights. The legal ground for this is your consent to this Privacy Statement. In details, this means that you consent to:

a) As a Registered User in Carta Europe, any information you add to your Carta Europe account may be shared with Carta Europe Customer companies, if these companies are suitably linked to your profile.

For instance, if a Carta Europe company lists you as a shareholder, and you add address information and a profile picture to your Carta Europe user profile, then that address information and that profile picture will be copied to your shareholder register entry in that Carta Europe company.

This is a central feature of Carta Europe for both Customers and End Users, minimizing the work needed for keeping data entries up to date across such registers, and that is the legal ground for this automatic data-sharing.

Depending on your privacy settings (can be accessed and modified on your Carta Europe user profile), your personal data may also be shared with other Carta Europe End Users. If, for instance, your address is copied to a shareholder register of a Carta Europe Customer company, depending on your privacy settings, and the configuration of that Carta Europe Customer company, your address may be disclosed to other shareholders of that company.

b) As a Registered User in Carta Europe, your contact email(s) are shared with Carta Europe Customer companies that you are connected to on Carta Europe, and depending on your privacy settings, these companies may send you email notifications via Carta Europe for business reasons, such as to keep you updated on important news and events. It is the obligation of these companies to ensure that the email notifications are in compliance with applicable law.

Data you provide or share

When you share data with other people via Carta Europe, personal or other, you understand that they may be able to, on a worldwide basis, use, save, record, reproduce, broadcast, transmit, share and display that data without prior permission or compensating you. If you do not want others to have that ability, do not use Carta Europe to share that data. By using the Carta Europe, you represent that you have (and will have) all the rights necessary for your data that is uploaded, stored, or shared on or through Carta Europe and that the collection, use, and retention of your data will not violate any law or rights of others.

Do not share sensitive personal data on Carta Europe, and do not share data that violates the privacy of others, is harmful, or is illegal.

Your rights

You have the right to opt out of any consents to usage of your personal data you have offered, and to demand corrections of personal data about you that Carta Europe controls. In such event, depending on the nature of your request, some or all of your personal data within Carta Europe will be deleted, altered, blocked or anonymized.

To be more specific,

a) You have the right to access your personal data and to get it exported.
You can request us to inform you about what personal data we have collected about you, and you can request a copy of that personal data.

b) You have the right to rectify your personal data.
You can request us to correct any inaccuracies in your personal data, provided you inform us of the corrections. If you are a Registered User, you can usually correct data yourself by logging onto Carta Europe and accessing your User Profile.

c) You have the right of erasure.

You can request us to delete your personal data on Carta Europe. Depending on the circumstances, you may be entitled to demand the deletion to be carried out before usual data retention periods expire.

d) You have the right of objection.

In some circumstances, you may object to the way we process your personal data.

In some instances, despite your request to the contrary, Carta Europemay be legally allowed to or obliged to keep your personal data unaltered, for instance in order to comply with regulation. In such cases, we will inform you about why we cannot fulfil your request or what partial fulfilment we can offer.

To assert your rights pertaining to personal data about you controlled by Carta Europe, you can contact us using the contact information found below.

To assert your rights pertaining to personal data about you, processed by Carta Europe as a Data Processor on behalf of a Customer (the Data Controller), please make your request with that Customer. For instance, if a company on Carta Europe lists an incorrect amount of shares held for you as a shareholder in that company’s shareholder register on Carta Europe, please contact that company, not Carta Europe, in order to rectify the data.

Security and privacy

In the course of handling your personal data, Carta Europe will store your personal data safely and confidentially and comply with the applicable requirements on the appropriate technical and organizational security measures to ensure an adequate level of protection of your personal data: Carta Europe keeps your data safe on the application level (via authentication and account-level authorizations), on the communication level (by encrypting traffic to and from Carta Europe), and on the data level, by frequently backing up your data. We also have logging and auditing in place for incident analysis and continuous security improvements. In the unlikely event of data loss, Carta Europe is not liable for any claims related to such incidents.

When using subcontractors, Carta Europe will enter Data Processing Agreements with each subcontractor to make sure your personal data is as well-protected as if it were in Carta Europe’s hands. Most of the time, your data physically resides in UK or the EU, but in some cases, your personal data may be exported outside the EU, for instance in case of backing up an encrypted database in a US-located data center. Whenever data is exported outside the EU, Carta Europe makes sure that the data importer is either certified according to the EU/US Privacy Shield framework (for US subcontractors) or offer a Data Processing Agreement that live up to the protection levels Carta Europe offer you.

A non-exhaustive list of some of our more central subcontractors is:

• Salesforce (Heroku), provider of a cloud environment for the Carta Europe Website to run in

• AWS, provider of secure cloud storage for files uploaded to the Carta Europe Website

When you register as user on Carta Europe, you can control your account privacy level yourself by configuring your user account, for instance, if you are a shareholder in a company that has registered you as such in their shareholder register, you can choose to appear as anonymous to other shareholders in that company. For transparency reasons and to comply with the most common needs of users and companies on Carta Europe, your privacy settings default to a reasonable level of information sharing with other users and companies on Carta Europe. We urge you to regularly ensure that your Carta Europe account privacy settings reflect your wishes.

Use of cookies and similar technologies

A cookie is a file that is stored on your computer’s hard drive, smartphone or any other IT device. It allows for recognition of your computer/IP address and for collection of information about the websites you visit and which features you use.

Carta Europe uses cookies and similar technologies on its website and products to optimize your visit, when browsing our website, to combat fraud, to generate statistics on the use of our website and for the purposes of marketing, including targeted marketing. By use of cookies, Carta Europe registers your activity on the website to help customize and improve your experience and use of Carta Europe’s different features. Carta Europe also uses usage statistics tools such as Google Analytics to collect information on the use of the website, e.g. on how the different functionalities are being used, and how users navigate the site.

The Carta Europe website will clearly notify you that you need to consent to cookie usage, if you have not explicitly done so yet. If you see this notification, do not actively confirm to cookies, and continue to access and use Carta Europe, we will interpret that as a valid consent to our usage of cookies by your affirmative action of continuing to use the website. If you no longer wish to consent to the use of cookies, you must disable cookies by changing your browser settings. Note, however, that you may not be able to use certain services and features, as they require cookies to remember the choices you make. Therefore, Carta Europe cannot guarantee that the website works optimally, in case you refuse to consent to our use of cookies.

Should you wish to remove cookies from your browser, the following websites provides you with specific guidelines in this regard:

• Guide on how to remove cookies from the various IE (Internet Explorer) versions

• Manage cookies and website data in Safari on Mac

• Guide on how to remove cookies from Google Chrome

Cookies used in the Carta Europe products are essential.

Google Single Sign-On

Users may sign up to the Carta Europe application using Google Single Sign-On (SSO). Upon sign-up, the application will retrieve and store a user’s first name, last name, email address and profile photo from Google. This data is used solely to create the Carta Europe user profile, and is not shared by the application.

This statement

This statement may be modified over time, and we recommend that you inspect the Privacy Statement regularly. The Statement is always available on Carta Europe’s website. In case of substantial changes to our approach to privacy, we may notify you directly, such as by email or upon login to the Carta Europe platform.

Contact information

If you have questions, experience any trouble, have any queries about your personal data at Carta Europe or Carta Europe privacy in general, or have any questions or comments concerning a possible breach of your privacy, feel free to contact Carta Europe Support (support@europe.carta.com). We will handle your request in full confidentiality.

Last updated

January 14, 2025