Investor Privacy Notice

Privacy notice

Version 1.1 — 13 October 2026.

Quantum Light Management Ltd (company number 13878761, registered office 5th Floor, North Side 7/10 Chandos Street, Cavendish Square, London W1G 9DQ) is the controller responsible for your personal data. We collect and process your personal data when you register for, sign in to and use the QuantumLight Portal, and when you read, search or rate the playbooks and other materials made available through it.

This notice provides information on how we collect and process your personal data when you use the QuantumLight Portal. It is a summary.

Our full Website and QuantumLight Portal Privacy Policy contains more detailed information about our data processing (including data security, retention periods, lawful bases, international transfers and your rights) and you should read it in conjunction with this notice. See https://quantumlightcapital.com/privacy-policy. Our Cookie Policy at https://quantumlightcapital.com/cookie-policy explains what is stored on your device.

The data we collect about you

We may collect, use, store and transfer different kinds of personal data about you as follows:

  • Identity Data: your first name, last name, the company you are associated with, and your Portal username.
  • Contact Data: your work email address.
  • Credential Data: your passkey public key if you use one, and the one-time codes used to verify a sign-in. We hold no password for you.
  • Reading Data: which playbooks and materials you open, when you open them, how long the page is open, which sections of a page or report you read and for how long, how far down each page you have read and whether you have finished it, and whether you mark an item helpful.
  • Search Data: the terms you type into the Portal search box, how many results came back, and whether you opened one of them and which page it was. We do not record who searched: no account identifier is stored against a search, and the time is kept only to the nearest hour.
  • Problem Report Data: what you tell us when you report a problem with the Portal, the address of the page you were on, your browser and screen size and, if you leave that option ticked when you send the report, an image of the page as it appeared to you at that moment.
  • Technical Data: your IP address, sign-in times, browser type and version, time zone setting, operating system and platform, and the entries in our web server access log.
  • Preference Data: the interface choices you make, such as dark mode or a collapsed sidebar, and whether you asked to stay signed in.
  • Usage Data: information about how you interact with our public website, collected through Google Analytics where you have consented.
  • Marketing and Communications Data: your preferences in receiving communications from us, where you have asked to receive them. We explain these categories, and the lawful basis for each, in the full Privacy Policy. We keep reading records in a form that identifies you for 90 days, and web server access logs for 30 days; your read marks, reading position and helpful marks are kept for as long as you have an account, because the Portal shows them back to you; search terms are kept for 90 days, after which only a count per term searched at least three times survives, deleted after 24 months; a problem report is kept for as long as we need it to investigate and fix the problem; your account details are kept for as long as you have an account and for 12 months afterwards.

We collect most of this from you directly when you register and use the Portal. Where your name, email address or company is provided to us by your company or by our investment team rather than by you, we will tell you so at the point we provision your account.

How we use your personal data

We will only use your personal data for the purpose for which we collected it, which is:

  • To create and secure your Portal account, and to sign you in.
  • To make the playbooks and other materials available to you.
  • To show you which pages you have read and your own helpful marks, and to reopen a page where you left it.
  • To understand how the Portal is used — which materials are read, which are ignored, and whether the people we onboard reach the material we built for them — so that we can decide what to improve and what to retire.
  • To protect the Portal from abuse, and to keep it secure.
  • To decide whether a member of the Quantum Light team should follow up with you personally about material you have or have not read.
  • To investigate and fix a problem you report with the Portal.
  • To manage our relationship with you, including notifying you of changes to our terms or to this notice, and dealing with your requests, complaints and queries.
  • To analyse how our public website is used so that we can keep it updated and relevant.

Your right to object

Creating and securing your Portal account and signing you in is necessary to perform our contract with you, and we send emails about new playbooks only where you have asked us to. The remaining uses above rely on our legitimate interests, and you have the right to object to them at any time, on grounds relating to your particular situation. You can do that with Stop recording my reading against my name, in Privacy choices, under Privacy in the Portal's account menu, or by emailing dpo@quantumlightcapital.com. When you object we stop recording your reading against your name immediately, and the records we already hold are folded into our anonymous totals so that they no longer identify you. Your own read marks, reading position and helpful marks are kept, so the Portal still works the way you left it; you can clear those yourself at any time from the same place. Objecting costs you nothing, you do not have to give a reason, and it will not affect your access to the Portal or to any material on it. If you object, we will stop unless we can show compelling legitimate grounds that override your interests.

What is stored on your device

The Portal stores a session cookie so that you stay signed in, and the share links you have opened. It keeps the interface choices you make with your account, not on your device, and asks for no cookie consent. The Portal does not use any third-party analytics technology, and nothing is stored on your device to measure your reading. On our public website we use Google Analytics, but we set nothing for analytics until you tell us we may. We do not use any advertising or retargeting technology. You can give or withdraw your consent on our website at any time, free of charge, from the Cookie Settings link in its footer.

Emails about new playbooks

If you ask us to, we will email you when we publish a new playbook. You do not have to agree to this to use the Portal, and refusing makes no difference to your access. You can stop the emails at any time using the unsubscribe link in any of them or by writing to dpo@quantumlightcapital.com, and we will stop sending them.

How we share your personal data

We share your personal data with our hosting and infrastructure provider, Amazon Web Services, which hosts the Portal in the United Kingdom; with the provider that delivers your one-time sign-in codes by email; with our documentation platform provider, where playbook content is synchronised; with Google LLC, in respect of analytics on our public website where you have consented; and with our auditors, insurers and professional advisers. If we sell, transfer or merge parts of our business, the new owners may use your personal data as set out in the full Privacy Policy. We do not sell your personal data and we do not share it for anyone else's marketing.

International transfers

The Portal is hosted in the United Kingdom. Two flows leave the UK: your one-time sign-in codes, which are delivered through a communications provider that may route them outside the UK; and, where you have consented to analytics on our public website, your IP address and a randomly generated identifier, which are sent to Google LLC in the United States. Where personal data does leave the UK we use the UK International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses or, for transfers to the United States, the UK Extension to the EU-US Data Privacy Framework where the recipient is certified. Where personal data of individuals in the European Economic Area leaves the EEA, we use the European Commission's adequacy decision for the EU-US Data Privacy Framework where the recipient is certified, or the Commission's standard contractual clauses. More detail is in the full Privacy Policy.

You have the right to access, correct, erase, restrict and port your personal data, to object to processing based on legitimate interests, and to withdraw any consent you have given. If you are dissatisfied with how we have handled your personal data, please tell us first at dpo@quantumlightcapital.com. You then have a further right to complain to the Information Commissioner's Office, the UK regulator for data protection (www.ico.org.uk). If you are in the EEA, you may instead complain to your local supervisory authority or to our EU representative.

Contact details

If you have any questions about this notice or our data protection practices, or want to complain about how we have handled your personal data, please contact our data protection officer, Kate Chan: Email dpo@quantumlightcapital.com. Post: Data Protection, Quantum Light Management Ltd, 5th Floor, North Side 7/10 Chandos Street, Cavendish Square, London W1G 9DQ. Our representative in the European Union for the purposes of Article 27 of the EU GDPR is Data Protection Representative Limited (trading as DataRep), registered in the Republic of Ireland with registered number 616588, at 77 Camden Street Lower, Dublin, D02 XE80, Ireland.

We are registered with the Information Commissioner's Office under registration reference ZB332737. This notice was last updated on 13 October 2026, version 1.1. Version 1.0, dated 11 September 2026, did not name which sections of a page you read, how far you have read it, your helpful marks or problem reports, and described passwords and sign-in codes by SMS, which the Portal does not use.

Previous versions

Version 1.0 of the Website and QuantumLight Portal Terms of Service, first published on 10 September 2026 and in force until 21 September 2026, is kept at https://quantumlightcapital.com/terms-of-service/2026-09-11.

Version 1.0 of the QuantumLight Portal privacy notice, in force from 11 September 2026 until 13 October 2026, is kept at https://quantumlightcapital.com/investor-privacy-notice/2026-09-11.

Version 1.0 of the Website and QuantumLight Portal Privacy Policy, in force from 11 September 2026 until 13 October 2026, is kept at https://quantumlightcapital.com/privacy-policy/2026-09-11.

The privacy notice published on quantumlightcapital.com before these documents took effect on 11 September 2026 is kept at https://quantumlightcapital.com/privacy-policy/2026-09-10. It governed personal data collected up to that date, and is published so that you can see what you were told when you gave it to us.