Privacy Policy

01. Introduction

This Privacy Policy explains how Cenotian Technologies Limited, a company incorporated in Ireland ("Cenotian", "we", "us" or "our"), collects, uses, discloses and protects personal data when you visit or interact with our website at www.cenotian.com (the "Website"), including any associated blogs, sub stacks or contact forms and any other content we make available (together, the "Site").

This Privacy Policy applies to personal data we collect through the Site. It does not apply to information collected by any third party, including through any website or service that may be linked to or from the Site, or through separate products or services we may offer under separate terms.

By using the Site, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Privacy Policy, you should not use the Site.

02. Who We Are and Data Controller

Cenotian Technologies Limited is the data controller responsible for your personal data collected through the Site for the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR") and the Irish Data Protection Act 2018, together with any other applicable data protection legislation (together, "Data Protection Law").

If you have any questions about this Privacy Policy or about how we handle your personal data, please contact us at:

03. Personal Data We Collect

We collect only limited personal data through the Site, as follows:

• Contact form data: when you complete a contact form on the Site (whether via the investor landing page, the customer landing page, or elsewhere on the Site), we collect the information you choose to submit, which may include your name, email address, company or organisation, telephone number, and the content of your message or enquiry.
• Usage and analytics data: when you browse the Site, including our blog, articles, and any Substack-hosted or embedded content, certain technical and usage information is collected automatically via cookies and similar technologies, as described in Section 5 (Cookies and Similar Technologies) below. This may include your IP address, browser type and version, device information, pages viewed, referring pages, and the date, time and duration of your visit.

We do not currently collect any special categories of personal data (such as data concerning health, racial or ethnic origin, or political opinions) through the Site, and we ask that you do not submit any such information to us via the contact form.

04. How and Why We Use Your Personal Data

We use the personal data described above for the following purposes and on the following legal bases under Article 6 GDPR:

05. Cookies and Similar Technologies

The Site uses cookies and similar tracking technologies to operate effectively and to help us understand how the Site is used. A cookie is a small file placed on your device that allows us, or a third party, to recognise your browser and collect certain information.

We use the following categories of cookies on the Site:

• Strictly necessary cookies: required for the Site to function properly (for example, to remember your cookie preferences). These cannot be switched off.
• Analytics cookies (Google Analytics): used to collect information about how visitors use the Site, such as which pages are visited most often, so that we can improve how the Site works. We have configured Google Analytics with the aim of minimising the identifiability of the data collected. For more information on how Google collects and processes data, please see Google's Privacy Policy at https://policies.google.com/privacy. You can opt out of Google Analytics by using the Google Analytics opt-out browser add-on available at https://tools.google.com/dlpage/gaoptout.
• Performance and monitoring cookies/technologies (Datadog): used to help us monitor the technical performance, availability, and security of the Site, including identifying and diagnosing errors. For more information, please see Datadog's Privacy Policy at https://www.datadoghq.com/legal/privacy/.

Where required by applicable law, we will request your consent before placing non-essential cookies (such as analytics cookies) on your device via a cookie consent banner or similar mechanism. You can change or withdraw your consent, or otherwise manage cookie preferences, at any time through the cookie settings tool on the Site or through your browser settings. Most browsers allow you to refuse or delete cookies; however, if you do so, some parts of the Site may not function as intended.

06. Third-Party Links

The Site may contain links to third-party websites, platforms, or content, including social media pages, Substack publications, or other external resources. This Privacy Policy does not apply to those third-party websites or platforms. We do not control and are not responsible for the privacy practices or content of any third party. We encourage you to review the privacy policy of any third-party website or platform before providing any personal data to it.

07. Disclosure of Your Personal Data

We do not sell your personal data. We may disclose your personal data in the following limited circumstances:

• Service providers: to third-party service providers who process personal data on our behalf for the purposes described in this Privacy Policy, including website hosting providers, Google (for analytics services), and Datadog (for monitoring and performance services). These service providers are only authorised to use your personal data as necessary to provide services to us and are subject to contractual obligations to protect your personal data in accordance with Data Protection Law.
• Professional advisers: to our legal, financial, tax, and other professional advisers, where necessary for the purposes described in this Privacy Policy or to comply with our legal obligations.
• With your consent: to any other third party where you have given your consent.

08. International Data Transfers

Some of the third-party service providers we use, including Google and Datadog, may process personal data outside the European Economic Area ("EEA"), including in the United States. Where we transfer personal data outside the EEA, we will ensure that appropriate safeguards are in place in accordance with Data Protection Law, such as reliance on an adequacy decision of the European Commission, or the use of Standard Contractual Clauses approved by the European Commission, together with any supplementary measures required. You may request further details of the safeguards used in relation to a specific transfer by contacting us using the details in Section 13 (Contact Us) below.

09. Data Retention

We retain personal data collected through the contact form only for as long as is necessary to respond to and, where relevant, follow up on your enquiry, and thereafter for such further period as may be necessary to comply with our legal obligations, resolve disputes, and enforce our agreements, in accordance with our data retention practices.

Usage and analytics data collected via cookies is retained in accordance with the retention periods applied by the relevant third-party providers (Google Analytics and Datadog), details of which are available in their respective privacy policies referenced in Section 5 (Cookies and Similar Technologies) above.

10. Data Security

We have implemented appropriate technical and organisational measures designed to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. However, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security of your personal data.

11. Your Rights

If you are located in the EEA or otherwise benefit from rights under Data Protection Law, you have the following rights in relation to your personal data, subject to certain exceptions and limitations set out in Data Protection Law:

• the right to be informed about how your personal data is processed;
• the right to access the personal data we hold about you;
• the right to have inaccurate personal data corrected, or incomplete personal data completed;
• the right to have your personal data erased (the "right to be forgotten"), in certain circumstances;
• the right to restrict processing of your personal data, in certain circumstances;
• the right to object to processing of your personal data, including processing based on our legitimate interests;
• the right to data portability, in certain circumstances; and
• the right to withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before consent was withdrawn.

To exercise any of these rights, please contact us using the details in Section 13 (Contact Us) below. We may need to verify your identity before responding to your request.

You also have the right to lodge a complaint with a supervisory authority. In Ireland, the relevant supervisory authority is the Data Protection Commission (www.dataprotection.ie). We would, however, appreciate the opportunity to address your concerns directly before you approach the Data Protection Commission or any other relevant supervisory authority, so please contact us in the first instance.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Site, or applicable law. We will post any updated version on this page and update the "Last updated" date at the top of this Privacy Policy. Where changes are material, we will take reasonable steps to bring them to your attention. We encourage you to review this Privacy Policy periodically.

13. Contact Us

If you have any questions, comments, or requests regarding this Privacy Policy or our data protection practices, or if you wish to exercise any of your rights described above, please contact us at: