This version of our Founder Portal privacy notice was in force from 11 September 2026 until 13 October 2026. The current version is at https://quantumlightcapital.com/investor-privacy-notice.

Version 1.0 — 11 September 2026.

Privacy notice

Quantum Light Management Ltd (company number 13878761, registered office 5th Floor, North Side 7/10 Chandos Street, Cavendish Square, London W1G 9DQ) is the controller responsible for your personal data. We collect and process your personal data when you register for, sign in to and use the Quantum Light Founder Portal, and when you read, search or rate the playbooks and other materials made available through it.

This notice provides information on how we collect and process your personal data when you use the Founder Portal. It is a summary.

Our full Website and Founder Portal Privacy Policy contains more detailed information about our data processing (including data security, retention periods, lawful bases, international transfers and your rights) and you should read it in conjunction with this notice. See https://quantumlightcapital.com/privacy-policy. Our Cookie Policy at https://quantumlightcapital.com/cookie-policy explains what is stored on your device.

The data we collect about you

We may collect, use, store and transfer different kinds of personal data about you as follows:

• Identity Data: your first name, last name, the company you are associated with, and your Portal username.
• Contact Data: your work email address and, if you choose SMS as your sign-in method, your mobile number.
• Credential Data: your password (stored only as a salted hash) or passkey public key, and the one-time codes used to verify a sign-in.
• Reading Data: which playbooks and materials you open, when you open them, how long the page is open, whether you mark an item helpful, and the terms you type into the Portal search box.
• Technical Data: your IP address, sign-in times, browser type and version, time zone setting, operating system and platform, and the entries in our web server access log.
• Preference Data: the interface choices you make, such as dark mode or a collapsed sidebar, and whether you asked to stay signed in.
• Usage Data: information about how you interact with our public website, collected through Google Analytics where you have consented.
• Marketing and Communications Data: your preferences in receiving communications from us, where you have asked to receive them. We explain these categories, and the lawful basis for each, in the full Privacy Policy. We keep reading records in a form that identifies you for 90 days, and web server access logs for 30 days; your account details are kept for as long as you have an account and for 12 months afterwards.

We collect most of this from you directly when you register and use the Portal. Where your name, email address or company is provided to us by your company or by our investment team rather than by you, we will tell you so at the point we provision your account.

How we use your personal data

We will only use your personal data for the purpose for which we collected it, which is:

• To create and secure your Portal account, and to sign you in.
• To make the playbooks and other materials available to you.
• To understand how the Portal is used — which materials are read, which are ignored, and whether the people we onboard reach the material we built for them — so that we can decide what to improve and what to retire.
• To protect the Portal from abuse, and to keep it secure.
• To decide whether a member of the Quantum Light team should follow up with you personally about material you have or have not read.
• To manage our relationship with you, including notifying you of changes to our terms or to this notice, and dealing with your requests, complaints and queries.
• To analyse how our public website is used so that we can keep it updated and relevant.

Your right to object

Creating and securing your Portal account and signing you in is necessary to perform our contract with you, and we send emails about new playbooks only where you have asked us to. The remaining uses above rely on our legitimate interests, and you have the right to object to them at any time, on grounds relating to your particular situation. You can do that by emailing dpo@quantumlightcapital.com or through the Portal settings page. Objecting costs you nothing and will not affect your access to the Portal or to any material on it. If you object, we will stop unless we can show compelling legitimate grounds that override your interests.

What is stored on your device

The Portal stores a session cookie so that you stay signed in, and remembers the interface choices you make. The Portal does not use any third-party analytics technology, and nothing is stored on your device to measure your reading. On our public website we use Google Analytics, but we set nothing for analytics until you tell us we may, and you can change or withdraw that choice at any time from the Cookie Settings link. We do not use any advertising or retargeting technology. You can object to us remembering your interface choices, free of charge, from the Portal settings page.

Emails about new playbooks

If you ask us to, we will email you when we publish a new playbook. You do not have to agree to this to use the Portal, and refusing makes no difference to your access. You can stop the emails at any time using the unsubscribe link in any of them, from the Portal settings page, or by writing to dpo@quantumlightcapital.com, and we will stop sending them.

How we share your personal data

We share your personal data with our hosting and infrastructure provider, Amazon Web Services, which hosts the Portal in the United Kingdom; with the provider that delivers your one-time sign-in codes by email or SMS; with our documentation platform provider, where playbook content is synchronised; with Google LLC, in respect of analytics on our public website where you have consented; and with our auditors, insurers and professional advisers. If we sell, transfer or merge parts of our business, the new owners may use your personal data as set out in the full Privacy Policy. We do not sell your personal data and we do not share it for anyone else's marketing.

International transfers

The Portal is hosted in the United Kingdom. Two flows leave the UK: your one-time sign-in codes, which are delivered through a communications provider that may route them outside the UK; and, where you have consented to analytics on our public website, your IP address and a randomly generated identifier, which are sent to Google LLC in the United States. Where personal data does leave the UK we use the UK International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses or, for transfers to the United States, the UK Extension to the EU-US Data Privacy Framework where the recipient is certified. More detail is in the full Privacy Policy.

Your legal rights

You have the right to access, correct, erase, restrict and port your personal data, to object to processing based on legitimate interests, and to withdraw any consent you have given. If you are dissatisfied with how we have handled your personal data, please tell us first at dpo@quantumlightcapital.com. You then have a further right to complain to the Information Commissioner's Office, the UK regulator for data protection (www.ico.org.uk). If you are in the EEA, you may instead complain to your local supervisory authority or to our EU representative.

Contact details

If you have any questions about this notice or our data protection practices, or want to complain about how we have handled your personal data, please contact our data protection officer, Kate Chan: Email dpo@quantumlightcapital.com. Post: Data Protection, Quantum Light Management Ltd, 5th Floor, North Side 7/10 Chandos Street, Cavendish Square, London W1G 9DQ. Our representative in the European Union for the purposes of Article 27 of the EU GDPR is Data Protection Representative Limited (trading as DataRep), registered in the Republic of Ireland with registered number 616588, at 77 Camden Street Lower, Dublin, D02 XE80, Ireland.

We are registered with the Information Commissioner's Office under registration reference ZB332737. This notice was last updated on 11 September 2026, version 1.0.