Privacy Policy

Last updated: 28.09.2026

Who this applies to. Everyone who visits investclub.co, registers for our free content or webinars, speaks with our team, or buys and uses the Programme.

How it is organised. Sections I to XV apply to everyone. Section XVI adds information for US residents. Section XVII adds information for UK and EEA residents.

Investclub ("we") processes personal data of the users of our website - https://investclub.co ("you") in accordance with the provisions of the Bulgarian Personal Data Protection Act (ZZLD) and the General Data Protection Regulation (EU) 2016/679, together with the UK GDPR and the UK Data Protection Act 2018 (together, the "GDPR"), for residents of the United Kingdom and the European Economic Area, and with the applicable federal and state privacy laws for residents of the United States. References in this policy to articles of the GDPR concern UK and EEA residents only.

Investclub operates in the United States through Investclub International, Inc.:

Investclub International Inc.

Address: registered office 1007 N Orange St, 4th Floor, Ste 1382, Wilmington, DE 19801; mailing address 447 Broadway, 2nd Floor, 3398, New York, NY 10013 (mailing address only)

Registered Office: 1007 N Orange St. 4th Floor Ste 1382, New Castle, 19801, Delaware, US

This Privacy Policy aims to provide you with detailed information on the scope and purpose of the data processing carried out by us and on your rights as a subject of the data processed by us. Please read this document carefully before you continue to use our website.

Investclub is a financial-education company. We offer online personal-investing and markets education for adults, for personal interest, including 12-month programmes (such as our investing and trading programmes), shorter courses and memberships (each a "Programme"). Our Programmes are offered at launch to residents of the United States and the United Kingdom only. We are not an investment adviser or a broker-dealer, and we are not authorised or regulated by the UK Financial Conduct Authority.

In this policy, "Site" or "website" means investclub.co and "Platform" means our learning platform and client zone. Other capitalised terms have the meaning given in our Terms and Conditions.

I. DATA CONTROLLER

The data controller (the company responsible for your personal data) depends on where you live. For residents of the United Kingdom and the European Economic Area the data controller is:

Investclub EOOD

UIC (EIK) 203206527

Sofia 1000, Triaditsa district, ul. Alabin I. Vl. 34

www.investclub.co

[email protected]

For residents of the United States the data controller (the business responsible for your personal information) is Investclub International Inc., a Delaware corporation, whose details are set out above.

Group services. Investclub EOOD is the group service provider: it operates the Platform and runs customer support, sales operations and the course tutors. It therefore receives the personal data of all customers and prospective customers, including US residents, under a written intra-group agreement with data protection terms. For US residents it acts as a processor on behalf of Investclub International Inc. under that agreement.

We have not appointed a data protection officer.

II. PERSONAL DATA

The use of our website is possible without providing personal data. However, in order to use individual services or functionalities of the website, certain personal data may be collected, which we will indicate separately below.

Therefore, in principle we record and store only data which you yourselves communicate to us by entering them in fields provided for that purpose or through your active interaction with our website in another way. This does not cover the use of "cookies", the recording of calls and live sessions or the data which we receive from third parties, which are described in more detail below.

Personal data include all information relating to an identified or identifiable natural person. They include, for example, your name, email, address or your telephone number, but also your IP address or geolocation data, which allow certain conclusions to be drawn about you or your user behaviour.

Personal data which go beyond the information stored through "cookies", as described below, are, apart from the cases described in Section III, processed by us only if you provide them to us voluntarily, for example by creating a user profile, signing up for an event organised by us, subscribing to our newsletter, entering into contractual or pre-contractual relations with us or by another way of contacting us.

We use (process) the personal data provided by you solely in view of the specific purpose for which they were provided and the other purposes set out in this policy, in accordance with the requirements of the law and in particular of Art. 6 of the GDPR, for example for sending our newsletter, for answering your question or for performing our contractual obligations to you.

Data processing is carried out in particular in the following cases:

• processing of contracts (Art. 6(1)(b) of the GDPR)
• answering questions (Art. 6(1)(b) of the GDPR)
• for marketing purposes (Art. 6(1)(a) of the GDPR)
• for optimising our web presence and our services (Art. 6(1)(f) of the GDPR)
• for the performance of our legal obligations in connection with accounting, tax and consumer law (Art. 6(1)(c) of the GDPR)
• for recording and analysing calls and live sessions, for security and the prevention of fraud, and for protecting our legal position (Art. 6(1)(f) of the GDPR)

The full list of purposes, with the legal basis for each, is in the table in Section III.6.

Any use of your data going beyond this will normally be carried out only if you have given your express prior consent (Art. 6(1)(a) of the GDPR). You may withdraw this consent at any time for the future, as discussed below.

To the extent that we provide access to data to a third party within the scope of our activity (e.g. for processing payments), this is carried out either on the basis of a legal authorisation (e.g. where a transfer of data to a third party is necessary for processing the payment), or on the basis of your consent, or if this is provided for by a legal obligation, or on the basis of our legitimate interests (e.g. when using web hosting, tools for sending newsletters, etc.).

The recipients of your data are listed in Section XII.

III. DATA PROCESSING

1. Placing orders and concluding contracts

During the ordering process the following personal data are required - name, address, telephone number, email address and confirmation that you are aged 18 or over.

The personal data provided in the course of the ordering process are used for processing the conclusion and performance of a contract (Art. 6(1)(b) of the GDPR) and for the related purposes in the table in point 6 below.

The processing of payments is carried out by third-party payment providers. We do not receive or store your full payment details.

If you use a Payment Plan, we process its terms and your instalment history. If you apply for third-party finance, the provider you choose tells us whether you were approved and the status of payments. We do not receive your credit file and take no commission from any lender.

2. Answering questions

The following data are collected when you contact us (Art. 6(1)(b) of the GDPR) - name, email address, telephone number, postal address (if necessary). These data are used exclusively for preparing a reply to your question and for contacting you with our reply. Site chat conversations are stored by our chat provider on our behalf. Support calls may be recorded (point 7 below).

3. Sending marketing materials

The following data are collected upon registration for our newsletter (Art. 6(1)(a) of the GDPR) - name and email address. These data are used exclusively for sending bulletins. Our bulletins are sent only after voluntary registration in our list for receiving bulletins.

4. Collection of data for marketing purposes through social networks and direct marketing

We collect your name, email address and telephone number for the purpose of direct marketing (including telephone calls) through forms on our website, lead-ad forms on Meta (Facebook and Instagram), YouTube and other social networks. If you complete an Investclub form inside such a platform, the platform sends us what you submitted. We do this on the basis of your express consent, provided through the relevant form. You may withdraw your consent for the purposes of direct marketing or opt out of receiving marketing communications at any time by contacting us as indicated below in this policy.

Email. Every marketing email has an unsubscribe link.

SMS and WhatsApp. We send marketing texts and WhatsApp messages only with your prior express written consent. Consent is not a condition of any purchase. Message frequency varies. Message and data rates may apply. Reply STOP to stop and HELP for help.

Telephone calls. Our team calls people who asked for or booked a call. In the United Kingdom we make live marketing calls only to people who asked for a call or consented, and screen other numbers against the Telephone Preference Service. In the United States we follow federal and state telemarketing rules, including Do Not Call lists. To stop calls, tell the caller or email us.

Advertising audiences. We may upload hashed contact details, such as email addresses and telephone numbers, to advertising platforms, which match them to their users so that we can show you our advertisements, exclude you from them, or reach similar people. The platform may not use the list for its own purposes. In the United Kingdom and the EEA we do this only with your consent. To opt out, email us, use "Your Privacy Choices" in the footer of our website or Global Privacy Control (US residents), withdraw consent in the "cookie" settings (UK and EEA residents), or use the advertising settings of each platform.

Opting out of marketing does not stop service messages about your Order, account, Payment Plan or the Programme. We keep minimal details on a suppression list so that we do not contact you again.

5. Data which we collect, by source

Data which you give us - through forms and webinar registration (name, email address, telephone number, country and state or region, form answers, marketing choices); your account (log-in details, profile); your purchase (billing details, the Order, Payment Plan and instalment history, agreements, refund requests); support (emails, site chat, SMS and WhatsApp); calls and live sessions (recordings, transcripts, notes by our team, questions and chat messages); and feedback (surveys, reviews and community posts).

Data collected automatically - the device and log data in Section IV, the "cookies", pixels and tags in Section VII, and your use of the Platform (log-ins, modules unlocked and viewed, progress, attendance at live sessions and downloads).

Data from third parties - from the payment provider (payment status, card type and last four digits, fraud and dispute indicators); from payment-plan or finance providers (approval and payment status); and from advertising and social platforms (lead-ad form entries, which advertisement or campaign brought you to us, and aggregated or pseudonymous measurement data).

Data which we do not want. We do not intentionally collect special-category or sensitive personal data (for example about ethnic origin, political or religious beliefs, medical conditions, sexual orientation, biometrics or criminal records). Please do not send us this kind of information. If you do, we will use it only to deal with your message and delete it where practical. During sales conversations we may ask general questions about your investing experience and the amount you plan to invest, to check that the Programme is a good fit for you. We do not need, and ask you not to send, account numbers, statements or login details for any bank or brokerage account.

In the event that you do not wish to provide the personal data required for creating your account, taking payment and providing the Programme, we will not be able to provide you with the service requested by you.

6. Purposes and legal bases

The right-hand column applies to UK and EEA residents only.

7. Call and meeting recording

Sales, support and onboarding calls and live group sessions, by telephone or video, may be recorded, and we may create transcripts and summaries, for quality, staff training, compliance (checking that the Programme was described accurately and fairly) and resolving disputes and refund requests. Every recorded call or session begins with a spoken or on-screen notice.

Analysis with AI tools. Recordings and transcripts may be analysed, including with AI tools, which may be provided by third parties, to check how our team describes the Programme. The analysis assesses our team, not you. We do not use recordings to create voiceprints or to identify anyone by voice or face.

How to object. Tell the team member at any time, or contact us (Section XV). In a live group session you can keep your camera and microphone off. You may also ask us to delete a one-to-one recording under Section X (UK and EEA residents) or Section XVI (US residents). Storage periods are in Section V.

8. Community, live sessions and reviews

What other members can see. If you speak, appear on camera or post in a live session or in our community, other participants can see or hear you, with your display name and any profile details you choose to share, and live-session recordings may be available to enrolled customers. If the community runs on a third-party service, its operator also processes your data under its own terms.

Reviews and testimonials. A review you submit is published with the display name you choose, and anyone visiting the Site can read it. We welcome honest reviews, including critical ones, and do not suppress negative reviews. You can ask us to remove it at any time. We use a testimonial or review in our marketing only with your separate written release, which you can withdraw for the future.

IV. AUTOMATIC COLLECTION OF DATA

For technical reasons, when you visit our website, we collect certain data which your internet browser transfers to us, including the following:

• type and version of the browser
• operating system used
• website from which the user is visiting
• website visited by the user
• date and time of access
• IP address of the user's computer
• approximate location derived from the IP address (country, region or city); we do not collect precise geolocation

These data are stored separately from all user data provided by you (in particular name, email, telephone number, address) and are evaluated for statistical purposes in order to optimise our web presence and our services, but may also be used for investigating suspected unlawful use of our website.

We do not use automated decision-making, including profiling, which produces legal effects concerning you or similarly significantly affects you. AI tools assist our team; people make the decisions. The advertising "cookies" and audiences in Sections III.4 and VII do involve profiling for advertising purposes, which you can refuse or opt out of as described there.

V. LEGAL GROUNDS FOR DATA PROCESSING AND STORAGE PERIOD

In the case of placing orders (concluding contracts) or answering questions, personal data are processed because this is necessary for the performance of the order or, as the case may be, for replying to the question (Art. 6(1)(b) of the GDPR).

For the purposes of direct marketing by email, SMS, WhatsApp or telephone, your contact data are processed only with your permission (Art. 6(1)(a) of the GDPR).

For optimising our web presence and the services we provide, we process your personal data on the basis of our overriding legitimate interest, in order to achieve the purposes set out in this policy (Art. 6(1)(f) of the GDPR). This does not apply to non-essential "cookies" (Section VII).

We store personal data only for as long as needed for the purposes set out in this policy, and then delete or anonymise them. The criteria we use to determine the storage period are as follows. Customer and contract records (account, Order, payments, Payment Plan, agreements, refunds) are kept for as long as you have an account and for a period afterwards as needed for legal, accounting, tax and dispute-resolution purposes, determined taking into account the applicable general limitation and record-keeping periods. Data about leads and prospective customers are kept until they are no longer relevant to our marketing or you opt out. Call and live-session recordings, transcripts, support messages, community posts, reviews, Platform usage data and records of privacy requests are kept for as long as needed for the purposes described in this policy. The marketing suppression list is kept so that we keep honouring your opt-out. Where the applicable legislation provides for shorter or longer storage periods, we will comply with those periods.

At your express request we may delete your data even before the expiry of this period, to the extent that continued processing is not required by law or is not necessary for the protection of our lawful interests. In exceptional cases we may continue to store your data after the end of this period, where this is necessary for the protection or exercise of our rights and lawful interests (e.g. in the context of ongoing court proceedings where your data serve as evidence).

VI. HOSTING AND TRANSFER OF DATA

Our website is hosted by a third-party hosting provider. Our hosting service provider provides us with the IT infrastructure services, disk space, computing capacity, technical security and maintenance services which we need in order to cover the range of options of this web presence. User data are processed in the context of these services within the scope of our lawful interests (Art. 6(1)(f) of the GDPR), in order to ensure the provision of our online services.

Your personal data are processed in the European Union (Bulgaria), the United States and other countries where our providers operate. Their laws may differ from yours. You may inform yourself about possible transfers of personal data by third parties, e.g. Facebook, Instagram and YouTube, in the respective privacy policies of those third parties.

Where UK or EU law restricts a transfer, we rely on the following safeguards:

• within the group - an intra-group agreement incorporating the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), plus the UK International Data Transfer Addendum for UK residents' data
• between the United Kingdom and the EU - the adequacy decisions each has made in favour of the other
• providers in the United States - certification under the EU-US Data Privacy Framework and its UK Extension or, if not certified, Standard Contractual Clauses with the UK Addendum
• other countries - an adequacy decision, or Standard Contractual Clauses with the UK Addendum

To request a copy of the safeguards, email us (Section XV). We may remove commercially sensitive terms.

VII. COOKIES

We use "cookies" and similar technologies, such as pixels and tags, in order to operate our website, to improve our services and the user experience, and for analytics and advertising. Further information about the "cookies" we use is available in the "cookie" settings on our website.

"Cookies" are small text files which the user's internet browser places and stores on his computer. In addition to the data and technical information mentioned above, with your consent "cookies" may be stored on your computer when you use our website. This allows our website to recognise you when a connection is established between our web server and your browser. The main purpose of the "cookie" is to recognise the visitors of the website, so that our web server can present you with a more individual and personalised website, tailored to your needs. We (or the third parties mentioned below) also use "cookies" for marketing purposes, in order to analyse user behaviour and, in certain cases, in order to be able to offer you special offers.

In general we distinguish between first-party "cookies", third-party "cookies" and third-party requests:

• First-party "cookies"

First-party "cookies" are stored by us or by our website in your browser in order to offer you an optimal user experience. These "cookies" may be essential for the use of our website or some of its functions (e.g. by recording your IP address and location) or may be used for improving the performance and functionality of our website (e.g. by recording your language settings or email).

• Third-party "cookies"

Third-party "cookies" are stored by a third-party provider in your browser. They relate mostly to analysis, tracking or marketing tools which on the one hand evaluate your user behaviour and on the other hand offer the third-party provider the possibility of recognising you again on other websites which you may visit.

• Third-party requests

Third-party requests relate to all questions which you as a user of our website put to a third party - for example, if you activate social networks with plug-ins or use the options offered by a payment service. In this case, although "cookies" are not stored in your browser, it cannot be excluded that, through the interaction, personal data are collected by that third-party provider.

Below you can find additional information about the tools and applications which we use on our website.

Please bear in mind that some of the "cookies" which we use are "strictly necessary". This means that they do not require your consent, because they are needed for the functionality of our platform and cannot be switched off in our system.

Specifically, the necessary cookies used on our site are:

CSRF Token - requires your browser to process "cookies";

Session ID - ensures that any information which you give or accept is remembered by our website. Without this "cookie" our site will treat you as a "new" visitor each time you log in. It does not identify you personally and is not linked to other information.

We use strictly necessary "cookies" on the basis of Article 6, paragraph 1, letter (f) of the GDPR. We use all other "cookies" in the United Kingdom and the European Economic Area only with your prior consent, given through the "cookie" banner, where refusing is as easy as accepting; and in the United States with notice and the right to opt out through "Your Privacy Choices" in the footer of our website or Global Privacy Control (GPC), which we honour. You may change your choice at any time in the "cookie" settings. You may also refuse the storage by setting your browser so that it informs you when a site wishes to store "cookies" on your device, and you respectively accept them or not.

Bear in mind that deactivating "cookies" in your browser may limit the functionality of our site for you.

For the sake of full transparency we also inform you about the optional "cookies" which we use, namely:

Advertising "cookies" and pixels - these are provided by advertising platforms such as Meta and Google. With them we measure our advertising and show you our advertisements on other websites and services. The providers receive online identifiers and may combine them with other data which they hold, under their own privacy policies;

Google Analytics - this is a performance "cookie", provided by Google. With it we analyse your internet traffic. The data are linked to online identifiers and are not anonymous;

You have the right at any time to refuse to use optional "cookies", including through the relevant field of the "cookie" banner provided on our website.

VIII. INTEGRATION OF THIRD-PARTY SERVICES AND CONTENT

We may place links to other websites; this is done for information purposes only. We do not control these websites; therefore they are not subject to this Privacy Policy. If you use such a link, it is possible that the provider of the relevant website collects data about you and processes them in accordance with its own privacy policy, which may differ from ours. Please always inform yourself about the current privacy policies of all websites shown on our website.

On our website there is also the possibility of interacting with various social networks through embedded content. They include:

• Facebook (www.facebook.com) and Instagram (www.instagram.com), operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland or, for users in the United States, by Meta Platforms, Inc.
• YouTube (www.youtube.com), operated by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland or, for users in the United States, by Google LLC

If you click on the content of any of these websites, it is activated and a connection is established with the relevant server of that network, as described above. We have no influence over the scope and content of the data transmitted by clicking on the plug-in to the relevant third-party website. In particular, if you are logged in to your profile on the relevant website, these data may be directly linked to your profile. If you do not wish this, you should log out of your profile before using such a link.

If you wish to be informed about the type, scope and purpose of the data collected by the operators of these social networks, we recommend that you read the privacy policies of the relevant social network.

The Site and the Platform may also link to, or run on, services operated by others, such as messaging services (for example WhatsApp), video-conferencing services and the checkout pages of payment and finance providers. Those operators process your data under their own terms and privacy policies.

1. Facebook

You can find the Privacy Policy of Facebook at https://www.facebook.com/privacy/policy/

2. Instagram

You can find the Privacy Policy of Instagram at https://help.instagram.com/519522125107875/?maybe_redirect_pol=0 .

3. YouTube

You can find the Privacy Policy of YouTube at https://www.youtube.com/howyoutubeworks/privacy/

IX. NEWSLETTER

Our online newsletter is sent through MailChimp (www.mailchimp.com). We send the newsletter on the basis of your consent (Art. 6(1)(a) of the GDPR). MailChimp acts as our service provider under a written contract.

You can register to receive our newsletter by providing us with your name and email address. Registrations for the newsletter are recorded (date and time of registration, date and time of confirmation, IP address), so that we can verify the registration process in accordance with the legal requirements and can trace misuse of the registration for the bulletin.

MailChimp or persons related to it may collect and communicate to us statistical data on the recipient's access to the bulletin (opening, time of opening, which links were activated). This information serves to improve our newsletter. The data may be recorded against your contact record in our customer relationship management system.

Please also see the privacy policy of MailChimp, available at https://www.intuit.com/privacy/statement/.

You can unsubscribe from the newsletter at any time through the link provided for that purpose in it.

After you unsubscribe, your email address will be immediately removed from the list for receiving the newsletter and kept only on our suppression list (Section III.4), unless you have given express consent to the further use of your data or we reserve this right in accordance with the applicable legislation, as described above.

X. YOUR RIGHTS

The following rights and powers relating to the processing of data by us are available to you as a data subject under the GDPR and the Personal Data Protection Act, if you live in the United Kingdom or the European Economic Area. If you live in the United States, your rights are set out in Section XVI.

• Right of access and information (Art. 15 of the GDPR)

As a person affected by the data processing described above and other similar processes, you have the right to request information as to whether and, if so, which personal data about you are processed in accordance with Art. 15 of the GDPR. For your own protection - so that no one obtains unauthorised information about your data - we will confirm your identity in an appropriate form before providing this information, e.g. by requesting additional information regarding your identity or an additional check through your telephone number or email address (if we have them).

• Right to rectification (Art. 16 of the GDPR) and erasure (Art. 17 of the GDPR)

You have the right to request the immediate rectification of inaccurate personal data relating to you and - taking into account the purposes of the data processing - the completion of incomplete personal data. In addition, you have the right to obtain the erasure of your personal data, to the extent that the criteria under Art. 17 of the GDPR are met.

• Right to restriction of the processing procedures (Art. 18 of the GDPR)

You have the right, in accordance with the legal prerequisites, to restrict the processing of all personal data collected. These data are processed from the moment of the request for restriction only with your individual consent or for the validation and enforcement of legal claims.

• Right to data portability (Art. 20 of the GDPR)

You may request the prompt and unrestricted transfer to you or to a third party of personal data which you have provided to us, where we process them by automated means on the basis of your consent or a contract.

• Right to object (Art. 21 of the GDPR)

You may object at any time, for reasons arising from your specific situation, to the processing of your personal data which is necessary for the protection of our lawful interests or those of a third party. Your data are no longer processed after the objection, unless there are compelling lawful grounds for the processing procedure which deserve protection and which take precedence over your interests, rights and freedoms, or the processing serves the validation, exercise and defence of our legal claims. You may object at any time to the data processing procedure for the purposes of direct advertising with effect for the future.

• Withdrawal of consent

In the event that you have given separate consent to the processing of your data, you may revoke it at any time. Such withdrawal affects the permissibility of the processing of your personal data after you have declared it to us.

• Right to lodge a complaint (Art. 77 of the GDPR)

You may complain to us and, at any time, to a supervisory authority, as described below and in Section XVII.

If you take a measure to assert the above-mentioned rights under the GDPR, we are obliged to decide on the requested measure without delay, but at the latest within one month after receipt of your request, respectively to act on it. For complex or multiple requests we may extend this period by up to two further months, and we will tell you so, with the reasons, within the first month.

For any questions relating to the processing of your personal data, including for withdrawal of consent given for this, you may contact us at the email address: [email protected], or other contact details provided in the Contact section of our website.

We will respond free of charge and without undue delay to all duly submitted requests in accordance with the applicable legislation. However, where a request is manifestly unfounded or excessive, in particular because it is repetitive, we may charge a reasonable fee based on the administrative costs or refuse to act on it.

Because Investclub EOOD is established in Bulgaria, you may lodge a complaint with the Commission for Personal Data Protection (CPDP), which is responsible in Bulgaria for requests relating to violations of the right to information, violation of the right to privacy, rectification or erasure. If you live in the United Kingdom, you may also complain to the Information Commissioner's Office (Section XVII). The contact details of the Commission for Personal Data Protection are as follows:

Sofia 1592, bul. Prof. Tsvetan Lazarov 2

[email protected]

www.cpdp.bg; Contacts - CPDP

XI. UPDATES TO THE PRIVACY POLICY

We may update our Privacy Policy from time to time. We will notify you of all changes by publishing the updated Privacy Policy on this page. In the event of material changes to the basic principles for the collection, processing and provision of access by third parties to your personal data, we will inform you by email and/or through a prominent notice on our website before the change enters into force.

It is advisable to review this Privacy Policy periodically for possible changes. Changes to this Privacy Policy enter into force when they are published on this page.

XII. RECIPIENTS OF YOUR DATA

We provide access to your personal data only to the following recipients:

The other Investclub group company, as described in Section I.

Service providers, under contracts that limit what they may do with the data, in the following categories: payment processors; video-conferencing and webinar providers; email, SMS and messaging providers; customer-relationship-management, site-chat and support tools; community platforms; advertising and analytics platforms; website hosting, learning-platform and IT providers; call-recording, transcription and AI analysis providers; e-signature providers; payment-plan servicing and finance providers; and banking, accounting and internal productivity tools. The current list of our key providers is available on request (Section XV).

Advertising partners: the operators of the advertising and social-media platforms whose "cookies", pixels, lead-ad forms and advertising audiences we use. They may combine what they receive with other data they hold.

Payment and finance providers: our payment provider and, if you apply for third-party finance, the provider you choose, which is an independent business responsible for its own use of your data.

Professional advisers and authorities: lawyers, accountants, auditors and insurers; and courts, regulators, tax authorities and law enforcement, where the law requires it or to protect our rights or the safety of others.

Business transfers: a buyer, investor or successor, and their advisers, if all or part of our business is sold, merged or reorganised.

Other members and visitors to the Site: what you post in live sessions, the community and reviews (Section III.8).

We do not sell personal data for money. Some US state laws treat certain advertising uses as a "sale" or "sharing". See Section XVI.

XIII. SECURITY

We use appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or misuse. No system is completely secure.

XIV. AGE

The Site, the Platform and the Programme are for adults aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe we have, please contact us.

XV. CONTACT

• Privacy questions, requests and complaints: [email protected]
• General support: [email protected]
• Post, US residents: Investclub International Inc., registered office 1007 N Orange St, 4th Floor, Ste 1382, Wilmington, DE 19801; mailing address 447 Broadway, 2nd Floor, 3398, New York, NY 10013 (mailing address only)
• Post, UK and EEA residents: Investclub EOOD, 34 Alabin St, Sofia 1000, Bulgaria
• UK representative: see Section XVII.1

XVI. ADDITIONAL INFORMATION FOR US RESIDENTS

This Section supplements the rest of this policy for US residents. The business responsible for your personal information is Investclub International Inc.

1. Notice at collection

Categories of personal information we collect, and have collected in the past 12 months. Sources: Section III.5. Purposes: Section III.6. Retention: Section V. Recipients: Section XII.

2. Sale, sharing and targeted advertising

We do not sell personal information for money. We use advertising pixels, cookies and hashed audience lists with advertising partners. Under some state laws this may be a "sale", "sharing" for cross-context behavioral advertising, or "targeted advertising". We treat it that way and let you opt out.

To opt out, click "Your Privacy Choices" in the Site footer, switch on Global Privacy Control (GPC), which we honor, or email us (Section XV). Cookie-based opt-outs are specific to the browser and device. We have no actual knowledge that we sell or share the personal information of anyone under 18.

3. Your rights

We offer these rights to all US residents, whether or not your state's law requires it: to know and access the personal information we hold, with the categories, sources, purposes and recipients, and obtain a portable copy; to delete it, subject to legal exceptions, and correct it; to opt out of sale, sharing, targeted advertising and profiling with legal or similarly significant effects (we do no such profiling); to appeal a refusal; and not to be discriminated against for using a right. We use sensitive personal information (your account log-in) only to provide and secure the service, so there is no further use to limit.

4. Requests, verification and appeals

Requests may be made by email to [email protected].

Verification. We verify requests by matching the details you give against those we hold, and may ask you to confirm the request from the email address on your account. Opt-out requests need no verification. An authorized agent must show your signed written permission or a valid power of attorney.

Response times. We respond within 45 days. We may extend once by a further 45 days where reasonably necessary.

Appeals. If we decline your request, we will say why. You may appeal by emailing us (Section XV) with the subject line "Privacy appeal". We will answer your appeal in writing and, if we reject it, tell you how to contact your state attorney general.

5. Do Not Track, California and Nevada

Do Not Track. There is no common standard for browser "Do Not Track" settings, and the Site does not currently respond to them. We do honor Global Privacy Control. Third parties such as our advertising partners may collect information about your online activity over time and across different websites when you use the Site.

California and Nevada. California residents may ask once a year about personal information disclosed to third parties for their own direct marketing ("Shine the Light"). We make no such disclosures without giving you the ability to opt out. We do not sell covered information as defined in Nevada Revised Statutes chapter 603A. Nevada residents may still email us an opt-out request.

6. SMS and call recording

SMS program. See Section III.4. We do not share mobile opt-in data or consent with third parties for their own marketing.

All-party-consent states. Some states, including California, require everyone's consent before a call is recorded. We apply that standard to every call. We tell you at the start that the call is recorded and may be analyzed, including with AI tools. If you continue after that notice, you consent. If you do not consent, say so and we will follow Section III.7.

XVII. ADDITIONAL INFORMATION FOR UK AND EEA RESIDENTS

This Section supplements the rest of this policy for residents of the United Kingdom and the European Economic Area. The Programme is not offered to EEA residents at launch, but this Section applies to EEA residents who visit the Site or contact us. Investclub EOOD is established in Bulgaria, so the EU GDPR applies to everything it processes. The UK GDPR and the Data Protection Act 2018 also apply to UK residents' data.

1. UK representative

Investclub EOOD has no establishment in the United Kingdom. Our UK representative under Article 27 of the UK GDPR is [UK representative name, postal address and email]. You may contact the representative as well as, or instead of, us.

2. Legal bases, "cookies" and electronic marketing

The table in Section III.6 names each legitimate interest we rely on. We have weighed each against your rights and expectations.

Under the Privacy and Electronic Communications Regulations 2003 (PECR) and the equivalent ePrivacy rules in the EEA, we place non-essential "cookies" and similar technologies only with your consent, never on the basis of legitimate interests.

We send marketing by email or text only with your consent, which you can withdraw at any time.

3. Our data protection complaints procedure

If you think we have handled your data in a way that breaks data protection law, email [email protected] with the subject line "Data protection complaint".

We will acknowledge your complaint within 30 days of receiving it, take appropriate steps to investigate it without undue delay and keep you informed, and tell you the outcome, with reasons, without undue delay, as the UK Data (Use and Access) Act 2025 requires. You may contact a supervisory authority at any time, although the ICO may expect you to raise the matter with us first.

4. Supervisory authorities

United Kingdom: Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Helpline: 0303 123 1113. Website: ico.org.uk/make-a-complaint.

Bulgaria: the Commission for Personal Data Protection (contact details in Section X). EEA residents may instead complain to the authority where they live or work, or where the issue arose.