Privacy Policy

Who We Are

Catapult Labs Limited (trading as "Catapult") is the provider of an AI assistant that unifies work context across third party technologies for search, drafting, brainstorming and decision making. We respect your privacy and are committed to protecting your Personal Data when you visit our Website, download our App and use our products and Services (as defined below) as set out in this privacy policy (“Policy”).

By visiting https://www.catapult.xyz/, downloading our App, using our Services and/or engaging with us you accept and consent to the practices described in this Policy, as amended from time to time by updating this page.

How to contact us: Any queries related to this Policy should be directed to help@catapultlabs.xyz or 241 Southwark Bridge Road, London, England, SE1 6FP.

This Privacy Policy describes how we collect, use and share your Personal Data and Personal Information as defined under applicable data privacy laws (referred to herein as collectively as “Personal Data”), including (1) the types of personal data we collect, (2) from whom we collect Personal Data including our prospects, customers, partners, job applicants, users, and visitors as further described below (“you,” “your,” or “users”), (3) the purposes for which we collect it, including in connection with your use of our website(s), for marketing, sales, job application, or other purposes as well as your use of our services offerings using our proprietary Services and providing support services (collectively, the “Service(s)”), (4) how we use your Personal Data, (5) with whom we may share your Personal Data, (6) what choices are available to you with respect to the use of your Personal Data, and (7) our compliance efforts to protect your Personal Data.

Catapult is the Controller or Business for Account Data and other direct user data, and acts as Processor or Service Provider for Workspace Data processed on your instructions. Where Catapult acts as a Processor or Service Provider of Workspace Data, you or our customer with whom we have contracted remains the Controller or Business of that Workspace Data and is responsible for determining the purposes and means of processing such data.

You represent that you are at least 18 years-old. Your use of the website and Services is voluntary.

Defined Terms

Unless defined in this Policy, defined terms shall have the meaning given to them in the Data Protection Legislation.

Account Data

means Personal Data relating to the creation and administration of a Catapult user account, including authentication details and permissions.

App

means the app made available by Catapult in connection with the Website and Services.

Aggregated Data

has the meaning given in the Collected Information section.

Catapult, we, our or us

means Catapult Labs Limited (trading as "Catapult").

Business, Controller, Processor, Personal Data, Personal data, Processing, Service Provider and Supervisory Authority

have the meanings given in Data Protection Legislation.

Data Protection Legislation

means all applicable data protection and privacy legislation, including but not limited to the UK General Data Protection Regulation (“UK GDPR”), UK Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and, where applicable, the EU General Data Protection Regulation (EU GDPR) (together “Data Protection Legislation”) any and all applicable state or federal laws or regulations within the United States relating to data privacy or data protection including any amendment, update, modification to, or re-enactment of such laws including without limitation the California Consumer Privacy Act, Cal. Civ. Code §§ 1798.100 et seq. (“CCPA”), which went into force on January 1, 2020 and the final CCPA Regulations and the California Privacy Rights Act (“CPRA”).

Services

means the services made available by Catapult from time to time including the Website and App (as defined and further described in the Terms at www.catapult.xyz/terms).

Website

means the website available at www.catapult.xyz.

Workspace Data

means data made available to Catapult from third-party services connected by a customer, as described in this Policy.

Collected Information

Personal Data, or Personal Information, means any information about an individual from which that person can be identified. It does not include anonymous data, where an individual’s identity has been removed and cannot be re-identified.

We may collect, use, store and transfer different kinds of Personal Data about you depending on how you interact with our Services, such as:

• Identity Data – including company details (if applicable), first name, maiden name, last name, username or similar identifier, marital status, title, date of birth, gender and job title
• Contact Data – including billing address, delivery address, email address and telephone numbers
• Profile Data – including your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses
• Registration Data – including newsletter requests, event/seminar registrations, dietary preferences (excluding special categories of data), subscriptions, and downloads
• Customer Service Data – including Personal Data received from customers in respect of employees, your customers or other individuals known to customers, invoicing details and payment history, and customer feedback
• Technical Data – including internet protocol (IP) address, device type and model, geo-data, your login data, browser type, version and language, the operating system of your device applications, time zone setting and location, the date and time you are accessing our websites, network provider and network provider user ID, browser plug-in types and versions, interactions with our website such as log ins, pages viewed, search terms entered, the content of any undeleted cookies that your browser previously accepted from us, digital fingerprinting, unique device identification number, International Mobile Equipment Identity, unique cookie identifiers, operating system and platform and other technology on the devices you use to access this website
• Financial Data – including bank account and payment card details
• Transaction Data – including details about payments to and from you and other details of services or products you have purchased from us
• Account Identifiers – including social media accounts and user account information
• Compliance Data – Government identifiers, passports or other identification documents, dates of birth, beneficial ownership data and due diligence data
• Usage Data – including information about how you use our website, products and services as time spent on site, your general location, device type and browser information; and
• Marketing and Communications Data – including your preferences in receiving marketing from us and our third parties and your communication preferences.
• Professional or Employment Related Information (US only): employment information that you may share for job openings, such as your job title, department (such as finance, operations, etc.), and position, prior job experiences, educational background information, general location, and we collect any other job-related information that you choose to share.
• Information You Choose to Share: including video clips, images, photographs, and documents.

Aggregated, Anonymous, or De-identified Statistical Data: Where permitted by applicable law, we may collect, create, process and use aggregated, anonymous, pseudonymous, or de-identified statistical data (including reports, insights, analysis, benchmarking, comparative data and other information derived from your personal data) to provide, modify and improve our Services. Aggregated anonymized information does not contain any personal data, and its use and disclosure are not subject to the terms of this Privacy Policy. We may also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your Personal Data so that it can directly or indirectly identify you, we treat the combined data as Personal Data which will be used in accordance with this Policy.

We do not intentionally collect Special Categories of Personal Data. We do collect Sensitive Personal Data in the form of geo-data, account log-in data and financial data as set forth in the Section titled “Collected Information.” In addition, Workspace Data may include Special Categories of Personal Data or Sensitive Personal Information depending on the content made available to the Services by you as an individual user or on behalf of our customer with whom we have a direct contract including for example, content of emails and content from other electronic communications and financial information. You as an individual user of the Services or the customer as the business entity with whom we have a direct contract is responsible for ensuring that it has a lawful basis for processing such data and for making it available to Catapult. This website is not intended for children under the age of 18, and we do not knowingly collect data relating to children.

Workspace and Ingested Data

Workspace Data is ingested via application programming interfaces (APIs), event listeners or similar technical means and is stored and processed within our systems. Workspace Data from connected third-party services (e.g., Gmail, Slack, Google Calendar, documents, call transcripts) may incidentally include special categories of personal data or sensitive personal information under Data Protection Legislation, such as data revealing racial or ethnic origin, data concerning health (including medical appointments, conditions, or treatments), financial account information, geo-location, contents of emails or other electronic communications or other sensitive information as defined in applicable laws. Catapult does not request, require, or intentionally collect such data in the context of Workspace Data to provide the Services, and the Services are not designed for processing health or medical data. As a Processor or Service Provider, we process Workspace Data solely on your instructions in your role as Controller or a Business. You must ensure you have a valid lawful basis under Data Protection Legislation and, where applicable, for any special category data (e.g. explicit consent) or sensitive personal information included in Workspace Data before connecting services. We implement technical and organizational measures to limit access and processing to what is necessary for the Services, but cannot prevent ingestion of all such data due to the nature of connected APIs.

As part of providing the Services, Workspace Data may be:

• indexed and organised
• converted into alternative formats (such as text or markdown)
• broken into smaller segments or "chunks"
• analysed to generate vector embeddings
• processed to extract factual information or relationships; and
• used to generate statistical insights to improve search and retrieval.

These processes are automated and are necessary to provide the core functionality of the Services.

If at any point you choose to provide us with a third party’s Personal Data (such as name, email, and phone number), you represent that you have the third party’s permission to do so and are responsible for such disclosure of that Personal Data. Examples include forwarding reference or marketing material or sending job referrals. Third parties may unsubscribe at any time from any future communication by emailing help@catapultlabs.xyz.

Catapult’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Catapult does not use any Personal Data for advertising purposes and does not sell Personal Data to third parties or share your Personal Data for cross context behavioral advertising.

Using Aggregated Data and Anonymised Data

We do not use identifiable Workspace Data to train or fine-tune general-purpose AI models unless you have explicitly opted in via your account settings.

However, we may create, use, disclose and retain Aggregated Data, anonymised data, de-identified data, statistical data, usage insights, telemetry data, model outputs, embeddings, derived data and other data that does not identify any individual (De-Identified Data) for our own business purposes.

These purposes may include:

• training, testing, improving and validating artificial intelligence and machine-learning models (including foundation models and internal or third-party hosted models)
• improving search, retrieval, ranking, drafting and reasoning capabilities
• developing new products, features and services for the Services
• benchmarking and analytics; and
• security monitoring and fraud prevention.

De-Identified Data will not identify you or any individual and will not be re-identified by Catapult except as required to validate anonymisation processes or comply with law.

Failure to Provide Personal Data

If you fail to provide Personal Data to us that is required by law or under the terms of contract between us and you, we may not be able to perform the contract we have or are trying to enter into with you.

Authentication and Access Credentials

When you connect to third-party services, we store authentication credentials such as OAuth access tokens, refresh tokens and permissions metadata to enable ongoing access to those services. These credentials are stored securely and used solely to provide the Services in accordance with your instructions. You may revoke access at any time via the relevant third-party service or within the Services or you may contact us at our contact information stated at the top of this Privacy Policy.

Method of Data Collection

Data may be collected through any of the below channels:

• Direct interactions – you may give us your Identity, Contact and Financial Data by filling in forms or by corresponding with us by post, phone, email or otherwise. This includes Personal Data you provide when you apply for our Services, fill out a new enquiry form on our website, subscribe to our service or publications, request marketing to be sent to you, enter a competition, promotion or survey and/or give us some feedback.
• Personalised feedback you may give us different types of Personal Data as you interact with the Services, for example in the context of communicating with the AI tools built into the App.
• Automated technologies or interactions – as you interact with our Website or download our App, we may automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this Personal Data by using cookies, server logs and other similar technologies. We use tracking tools like browser “cookies,” pixels, and web beacons to automatically collect information about you, your device, and your usage when you interact with our Services, websites, online content, ads, or emails. A cookie is a small text file containing information that we can read later for our own business purposes. For the Services and associated websites, we use strictly necessary and statistical cookies to facilitate your access to our websites, improve your user experience, and analyze website traffic including to count visits and monitor traffic sources so we can measure and improve the performance of our site. These cookies help us to know which pages are the most and least popular and see how you move around the site. If you do not allow these cookies, we will not know when you have visited our site, and we will not be able to monitor its performance. We may share your site usage data with our analytics partners and service providers. In addition to strictly necessary and statistical cookies, we also use marketing and preference cookies to personalize your experience, track your preferences (such as language), customize your experience, and track your online activity to help advertisers deliver more relevant advertising or to limit how many times you see an ad. These cookies can share that information with other organizations or advertisers. These cookies are used to measure the overall effectiveness of our online content, advertising campaigns, and products and services we offer. If you choose to decline cookies, you may not be able to sign in or use some of the interactive features offered on the website. We also use standard Internet technologies, such as embedded links on web pages and other similar technologies to track usage across the application. We use web beacons in e-mail messages or newsletters to track whether you open the messages.
• Third parties or publicly available sources – we may receive Personal Data about you from various third parties and public sources such as:
• Technical Data – from analytics providers such as Google based outside the EU and/or search information providers based inside or outside of the EU
• Contact, Financial and Transactional Data – from providers of technical, payment and delivery services based inside the UK/EU; and
• Identity and Contact Data – from publicly available sources such as Companies House and the Electoral Register based inside the UK/EU and third party enrichment databases such as Apollo and Clay.
• Third Party Service Providers We Hire to Work on our Behalf. For example, vendors or service providers that manage, maintain, analyze, translate, or provide other services for our services server platform, infrastructure, or website or send promotional emails for us may collect and provide personal data about you for the aforementioned purposes. Our marketing agencies, advertising technology vendors, and analytics providers may also provide us with personal data about you including demographic, geo-location, behavioral, consumer preferences and internet activity related data. Our employment and recruiting vendors also provide personal data about you. Our marketing agencies, advertising technology vendors, and analytics providers may also provide us with personal data about you.

How We Use Your Data

We, or the third parties described in this Privacy Policy use the above-referenced categories of Personal Data for the purposes listed below. If you are located in the EEA, UK or Switzerland we have to have a legal basis to process your personal data. For each purpose, we explain the lawful basis for collecting and using your Personal Data.

We rely on one or more of the following legal bases:

• Performance of a contract with you, where processing is necessary to provide the Services, including creating accounts, authenticating users and ingesting Workspace Data
• Legitimate interests, where processing is necessary to operate, secure and improve the Services, provided those interests are not overridden by your rights and freedoms
• Legal obligation, where processing is necessary for compliance with applicable laws; and
• Consent, where we have obtained your active agreement to specific processing activities (for example, optional marketing communications).

US only: We will collect and use your Contact Information and Identifiers, and Professional or Employment Related Information to consider your application for a job with us.

We may process your Personal Data for more than one lawful ground depending on the specific purpose for which we are using your data. We will only use your Personal Data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your Personal Data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Automated Processing and AI

Catapult uses automated systems, including artificial intelligence and machine-learning techniques, to analyse and organise Workspace Data in order to provide the Services.

We process Personal Data for automated processing and profiling only to the extent necessary to deliver the Services (e.g., personalised responses or drafting suggestions). Catapult does not make solely automated decisions that produce legal effects or similarly significant effects concerning individuals.

Third Party Transfer

We do not sell your Personal Data or share your Personal Data with third parties for cross context behavioral advertising; however, we may share your Personal Data with third parties such as:

• IT and system administration service providers acting as processors
• Service providers who assist and support Catapult with running our Website, App or other IT services
• Analytics service providers acting as processors relating to usage patterns, device information, and interaction with our Website or App
• Payment services providers
• Professional advisors including lawyers, bankers, auditors and insurers assisting with legitimate business matters
• HMRC, regulators and other authorities who require information to protect our legal rights and those of our customers; and
• Third parties in connection with, or during negotiations of, any merger, sale of company assets, consolidation or restructuring, financing, or acquisition of all or a portion of our business by or to another company. If a change happens to our business, then the new owners may use your Personal Data in the same way as set out in this Policy.

For Safety, Security, or Legal Compliance Purposes: We might share information in response to subpoenas, court orders, or other legal process (including for national security and law enforcement purposes); to establish or exercise our legal rights or the legal rights of a third party service provider, sponsor, customer, or other research provider (for example to enforce confidentiality or intellectual property rights); to defend against legal claims; or as otherwise required by law; to comply with applicable laws; to protect rights, safety and property of us, our customers, or others; and to respond to lawful requests from public authorities. We might also share personal data to prevent, detect, or investigate suspected fraud, violations of our terms of service, harassment, or illegal conduct.

Other Disclosures: We may also share personal data for other reasons we may describe to you from time to time as permitted by law, including as disclosed in any conversation-specific disclosures.

Service providers: We engage third party service providers (“service providers”) to process personal data on our behalf and help us pursue our business purposes, such as analytics, user support, billing, sales activities, data analysis, translation services, customer service engagement, email delivery, cloud hosting services, platform services, and marketing assistance. Such service providers may use such data for their own business purposes to enhance, improve, and deliver their services and in such case their use is governed by their privacy policy.

Business partners and marketing companies: We might share personal data with third party service providers that help us with our marketing efforts, including social media platforms, advertising networks, and ad tech companies. For example, we may share email addresses or other identifiers or contact information with social media platforms so they can serve our advertising to you on their platform. Personal data received by our third party service providers, partners, and other third parties may also be subject to their privacy policies.

In addition, where applicable, you will be requested to check a box if you consent to us transferring some of your Personal Data to third party service providers. This is not compulsory and if you do not check the box, we will not transfer your Personal Data to such third parties. If you do check the box, you are consenting to the transfer of your Personal Data to such third parties in accordance with this Policy so that those third parties may share information with you about their products or services. You can subsequently unsubscribe from mailing lists by clicking the ‘unsubscribe’ link on the relevant email.

You have the right to know whether your personal data is being sold or shared for cross contextual behavioral advertising. For example, under the CCPA, your personal data is "sold" when it is provided to a third party for monetary or other valuable consideration for a purpose. Please note a "sale" does not include when we disclose your personal data that has been de-identified prior to sharing with a third party or is shared, at your direction, to a third party service provider for a specific business purpose or when otherwise permitted under law. We do not sell your Personal Data or share your Personal Data with third parties for cross context behavioral advertising

International Transfers

Your Personal Data may be transferred to, stored or processed in countries outside the United States, United Kingdom or the European Economic Area (EEA). Where this occurs, we ensure that appropriate safeguards are in place to protect your Personal Data in accordance with Data Protection Legislation.

These safeguards may include one or more of the following:

• transferring your Personal Data to countries that have been deemed to provide an adequate level of protection for Personal Data under Data Protection Legislation, including pursuant to adequacy decisions recognised under Data Protection Legislation
• using standard contractual clauses or other approved transfer mechanisms recognised under Data Protection Legislation, which require the recipient to protect your Personal Data to the same standard required under Data Protection Legislation for example the International Data Transfer Agreement; and
• implementing additional technical and organisational measures where required to ensure an essentially equivalent level of protection.

You may contact us for further information about the specific safeguards we use when transferring your Personal Data outside the UK or EEA.

Data transfers from the EU/EEA to the UK are currently covered by the European Commission’s adequacy decision.

In exceptional circumstances, where no other transfer mechanism is available under Data Protection Legislation, we may rely on your explicit consent to transfer your Personal Data outside the UK or EEA. Where this occurs, we will inform you of the possible risks of such transfers.

We operate the websites and Services platform in the United States and, depending on your country of residence, the submission of personal data to our websites or Services platform may involve the collection of such personal data in the United States for our processing. Your personal data may be processed by personnel operating in the United States who work for us or one of our third party service providers or by our personnel and personnel of our third party service providers who may access your personal data remotely globally. As a result, your personal data may be subject to access by and disclosed to the U.S. government and law enforcement agencies according to U.S. laws. If we collect your personal data as a service provider on behalf of a third party, the third party may access and transfer your personal data to locations and countries as described in the third party’s privacy policy.

Data Retention

Personal Data will be retained for as long as we need to in order to use it as described above, and/or for as long as we have your permission to keep it. The purposes include satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your Personal Data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for Personal Data, we consider the amount, nature and sensitivity of the Personal Data, the potential risk of harm from unauthorised use or disclosure of your Personal Data, the purposes for which we collect or process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Workspace Data is retained in accordance with the customer’s instructions and may be deleted or disconnected by the customer at any time, subject to reasonable technical limitations and legal obligations.

If you disconnect third-party integrations, delete the App, or cease active use of the Services but continue to maintain a paid subscription for the App, we will retain Workspace Data and Account Data for the duration of the active subscription period unless you instruct us to delete such data.

Data will only be deleted following:

• expiry or termination of the subscription; or
• a verified deletion request made in accordance with this Policy,

subject in each case to applicable legal, regulatory and backup retention requirements.

In some circumstances we may irreversibly anonymise or de-identify Personal Data and Workspace Data so that it can no longer reasonably be associated with an identified or identifiable individual.

Once anonymised, such data may be used, retained, transferred and disclosed indefinitely for lawful business purposes including product improvement, AI model training, analytics, research, benchmarking, service optimisation and security.

Data Security

We have implemented appropriate physical, administrative, and technical security measures designed to protect your Personal Data from unauthorised access, use, or disclosure. Notwithstanding the measures Catapult takes to protect your Personal Data, it does not guarantee the security of any Personal Data you provide to us or third parties. No data transmission over the Internet can be guaranteed to be entirely secure, and we cannot and do not guarantee or warrant the security of any information that you transmit on or through our websites or Services.

We try to restrict access to information to only those employees, contractors, third party service providers and agents who need to know that information in order to help us provide the websites and Services, and consistent with the level of sensitivity of such data.

Please note that the security of your personal data collected via the Services, in part, on ensuring that any of your IDs and passwords are kept confidential and secure and that you adhere to the restrictions on password and ID-sharing set forth in our Terms of Service.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Third Party Websites

If you access a third party website via our Website we are no longer responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this Policy. We encourage you to review the privacy statements posted on those websites (and all websites) you visit.

Your Choices About How We Use Your Personal Data; Marketing; Opting Out

We may use your Identity, Contact, Technical, Usage and Profile Data to establish relevant marketing that may be of interest to you. You will receive marketing communications from us if you have requested information from us, purchased goods or services from us, signed up to our newsletters or blogs, provided us with your details when you entered a competition or registered for a promotion and, in each case, you have not opted out of receiving that marketing. You have the right to withdraw consent to marketing at any time by contacting us or clicking the unsubscribe link. Where you opt out of receiving these marketing messages, this will not apply to Personal Data provided to us as a result of a service purchase, service experience or other transactions.

We believe it is important to give you choices about the use of your personal data. We will use your personal data as described in this Privacy Policy or as disclosed in any other terms of service or data protection agreements entered into between us. In the event of a conflict, the terms of service or data protection agreement will govern. If we want to use your personal data for a purpose not authorized in this Privacy Policy, we will first obtain your consent to do so.

You Can Opt Out of Receiving our Marketing emails. We will respect your wishes not to receive, or stop receiving, marketing communications. You can opt out at any time by using the unsubscribe links or instructions at the bottom of our emails. Please note that we will continue to send you Services-related communications regardless of any such marketing-related request.

Opt-Outs. The Services may include other options to select the “decline” or “opt-out” option for specified functionality or features, where available. Where we obtain your personal data from a third party services provider or our customer, we only process personal data you provide as directed by the third party.

You May be able to Block or Remove Cookies through your Browser Settings. We use cookies and other tracking tools to help customize the Services and website and improve your experience, as well as analyze our performance and marketing activities. You may be able to block or delete cookies by going to the preferences, tools, or options menus of your Internet browser. If you choose to do so, some features of the Services may not function properly. Selections you make are device-specific and browser-specific, meaning that you may need to make your selections on each browser and on each device you use to access the Services or website.

You can Opt Out of having your Online Behavior Recorded and Used for Interest-based Advertising Purposes. Some content or links, including advertisements, are served by third parties, including advertisers, ad networks and servers, content providers, and application providers. These third parties may use cookies, alone or in conjunction with web beacons or other tracking technologies, to collect information about you when you use our websites or Services. The information they collect may be associated with your personal data or they may collect personal data about your online activities over time and across different websites and other online services. They may use this information to provide you with interest-based (behavioral) advertising or other targeted content. We do not control these third-party tracking technologies or how they may be used. If you have any questions about an advertisement or other targeted content, you should contact the responsible provider directly. To opt out from receiving interest-based advertising from participating companies, visit the opt-out mechanisms of the Digital Advertising Alliance (United States), the Network Advertising Initiative (United States), and the European Interactive Digital Advertising Alliance (European Union). The choices you make are both browser- and device-specific, meaning that you should exercise your preference on each browser and each device you use. If you clear cookies from your browser, you may need to exercise these choices again.

Our Do-Not-Track Policy. Most web browsers and some mobile operating systems include a Do-Not-Track (“DNT”) feature or setting that you can activate. This signals your privacy preference not to have data about your online browsing activities monitored and collected. No uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will do so accordingly.

California Opt Out. For information about additional opt out rights under California law, please see the California Privacy Rights section of this Privacy Policy.

In addition to the options stated above, you may contact us or send us notices to our contact info set forth at the top of this Privacy Policy.

Your Rights under EEA, UK & Swiss Data Protection Legislation

As a data subject, you have the following rights under the EEA, UK & Swiss Data Protection Legislation, which this Policy and our use of Personal Data have been designed to uphold:

• the right to be informed about our collection and use of Personal Data
• the right of access to the Personal Data we hold about you
• the right to rectification if any Personal Data we hold about you is inaccurate or incomplete
• the right to be forgotten – i.e. the right to ask us to delete any Personal Data we hold about you
• the right to restrict the processing of your Personal Data
• the right to data portability – i.e. obtaining a copy of your Personal Data to re-use with another service or organisation
• the right to object to us using your Personal Data for particular purposes (including direct marketing and processing based on legitimate interests); and
• rights with respect to automated decision making and profiling including the right not to be subject to solely automated decisions with legal or similarly significant effects, subject to exceptions).

If you wish to exercise any of these rights, please contact us. Please note that we may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Data or to exercise any of your other rights. This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

By using our Website, App, engaging in our Services or otherwise providing Personal Data to us, you agree that we may communicate with you electronically regarding security, privacy, and administrative issues relating to your use.

You will not have to pay a fee to access your Personal Data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Your California Privacy Rights; Choices and Opting Out

The California Consumer Privacy Act, Cal. Civ. Code §§ 1798.100 et seq. (“CCPA”) is a U.S. law enacted in the State of California, which went into force on January 1, 2020. It expands upon the privacy rights available to certain California consumers, and requires certain companies to comply with various data protection requirements. Please also visit the final CCPA Regulations and the California Privacy Rights Act (“CPRA”). The CPRA provisions went into effect on December 16, 2020, with the remaining provisions of the CPRA operative on January 1, 2023.

Pursuant to the California data protection laws, California residents have the right to be provided with the information and to exercise the rights as set forth in this Section.

We handle Personal Data on behalf of our third parties (such as third party service providers, customers, etc.) as described at the outset of this Privacy Policy: The privacy policies of those third parties control their use of your personal data, and you should contact them with any questions about that personal data.

Categories of personal data: We and our service providers may collect your personal data for our business or commercial purposes (as those terms are defined in the Applicable Data Protection Legislation) and a detailed list of the categories of personal data which we collect can be found above in our Privacy Policy. Some of the personal data that we process may include sensitive information as defined by CCPA including government identifiers, financial account numbers together with access credentials, geo-location, racial or ethnic origin, immigration status, religious or philosophical beliefs, or union membership, political information, sexual orientation, and health or medical information.

Purposes of Collection: We collect your personal data for business and commercial purposes.

How personal data is Collected: We collect the above categories of personal data from the sources described in this Privacy Policy.

Who we Share personal data with: We may disclose each of the above categories of personal data for the business and commercial purposes described in this Privacy Policy to the extent permitted by applicable law to the categories of third parties as described in this Privacy Policy.

Sale of personal data: We do not “sell” your personal data or share your Personal Data with third parties for cross context behavioral advertising.

You have the right to know whether your personal data is being sold. For example, under the CCPA, your personal data is "sold" when it is provided to a third party for monetary or other valuable consideration for a purpose. Please note a "sale" does not include when we disclose your Personal data that has been de-identified prior to sharing with a third party or is shared, at your direction, to a third party service provider for a specific business purpose or when otherwise permitted under law.

We may share your personal data for adverting or marketing purposes as set forth above.

Notice and Right to Request: You have the right to request access to your personal data that is within our possession.

Shine the Light Notice: California Civil Code Section 1798.83 permits California residents to request certain information regarding our disclosure of “personal data” (as defined by this law) to third parties for their direct marketing purposes. To make such a request, please send an email to our contact found at the top of this Privacy Policy. Indicate in your email that you are a California resident making a “Shine the Light” inquiry.

Privacy Rights for Californians

If you are a resident of California, you can also make the following more specific requests with respect to your personal data:

• Right to Know and Access – You can request that we disclose to you the categories of personal data we collected about you, the categories of sources from which we collected the personal data, the categories of personal data we sold or disclosed, our business or commercial purpose for collecting and selling the personal data, the categories of third parties with whom we shared the personal data, and the specific pieces of personal data we collected about you over the past 12 months.
• Deletion – You can request that we delete your personal data that we maintain about you, subject to certain exceptions.
• Do Not Sell My Personal data or Opt-Out Rights – We do not “sell” your personal data or share your Personal Data with third parties for cross context behavioral advertising. For purposes of this Privacy Policy, “sell” means the sale of your personal data to an outside party for monetary or other valuable consideration, subject to certain exceptions. Please note that if you would like to opt out of cookie-based tracking for advertising purposes (which might be considered a “sale” or constitute sharing), you will need to separately visit www.aboutads.info/choices and https://optout.privacyrights.info to opt out of certain uses of cookies for advertising purposes. Your selections are specific to the device, website, and browser you are using. Your selections are also deleted (lost) whenever you clear your browser’s cache.
• Right to Correct – You have the right to request correction or changes of your personal data if it is found to be inaccurate or out of date.
• Right to Limit Use of Sensitive personal data – You can request that we use your ‘sensitive personal information’ as defined under California data protection laws (such as precise geo-location) for limited purposes, such as providing you with the Services.

Notice of No Discrimination: We will not discriminate against you because you made any of these requests.

Process and Contact Information to Send Notices to Us

Where to Send Notice: If you would like to exercise any of these rights, please submit a request by email to us at our contact information described at the top of this Privacy Policy.

How we Handle Requests: We may deny certain requests, or fulfil a request only in part, based on our legal rights and obligations. For example, we may retain personal data as permitted by law, such as for tax or other record keeping purposes, to maintain an active account, and to process transactions and facilitate customer requests.

Verification of Identity: We will take reasonable steps to verify your identity prior to responding to your requests. The verification steps may vary depending on the sensitivity of the personal data and whether you have an account with us.

Authorized Agent: California residents may designate an authorized agent to make a request on their behalf. When submitting the request, please ensure the authorized agent is identified as an authorized agent.

Other US Data Protection Laws

As used herein, “US data protection laws” means any applicable United States data privacy or data protection laws, including but not limited to (i) California Consumer Privacy Act (the “CCPA”), including the California Privacy Rights Act (“CPRA”); (ii) the Colorado Privacy Act (“CPA”); (iii) the Virginia Consumer Data Protection Act (“VCDPA”); (iv) the Connecticut Data Privacy Act (“CDPA”); (v) the Utah Consumer Privacy Act (“UCPA”); and any corresponding or similar United States state or federal laws or regulations relating to the use or protection of data including any amendment, update, modification to or re-enactment of such laws.

Please note that the rules implementing some of these laws have not yet been finalized and additional states are in the process of enacting similar laws. We are continuously working to remain current with these laws, and we will update our processes, disclosures, and this notice as necessary to address new laws as they are finalized.

In addition to the privacy rights of California residents as described in the Section titled ‘Your California Privacy Rights’, US residents of other states may have the right to be provided with the information and to exercise the rights as set forth above in the California Privacy section to the extent specifically set forth in the applicable US data protection laws. Such rights include the following:

• Right to Access Your Data. You have the right to request that we disclose certain information to you about our collection, use, and disclosure of your personal data. You can make this request by contacting us at our contact information set forth at the top of this Privacy Policy.
• Right to Know. You have the right to know what personal data we process and how we process your personal data as set forth in greater detail above in this Privacy Policy.
• Opt Out. You may have the right to opt out of the processing of personal data. You can make this request by contacting us at our contact information set forth at the top of this Privacy Policy.
• Right to Data Portability. You may have the right to a "portable" copy of your personal data that you have submitted to us. Generally, this means you have a right to request that we move, copy, or transmit your personal data stored on our servers or information technology environment to another service provider's servers or information technology environment. You can make this request by contacting us at our contact information set forth at the top of this Privacy Policy.
• Right of correction. You have the right to request correction or changes of your personal data if it is found to be inaccurate or out of date. You can make this request by contacting us at our contact information set forth at the top of this Privacy Policy.
• Right to Delete Your Data. You have the right to request that we delete any of your personal data that we collected from you and retained, subject to certain exceptions. You can make this request by contacting us at our contact information set forth at the top of this Privacy Policy.

Cookies

We use cookies and similar technologies on our Website and App. These tools enable the website and App to function properly, provide analytics insights, help us improve the usability, performance, and effectiveness of our Services, and tailor your experience. For full details, including the specific cookies we use, their purposes, durations, and how to manage your preferences, please see our separate Cookie Policy at www.catapult.xyz/cookies.

Not For Children

Our websites and Services contain business-related content and are specifically aimed at and designed for use by adults who are at least 18 years of age. In addition, we do not knowingly solicit or collect personal data (as defined by the Children’s Online Privacy Protection Act, COPPA) from or about individuals under the age of 13 years. If we become aware that a visitor is under the age of 13 and has registered without prior verifiable parental consent, we will remove their personally identifiable registration information from our files. If you are the parent or guardian of a person under the age of 13 who has provided personally identifiable information to us without your approval, please inform us by contacting us, and we will remove such information from our database.

Feedback

If you have any questions, feedback or complaints about our use of your Personal Data, please contact us and we will do our best to solve the problem for you. If we are unable to help, you also have the right to lodge a complaint with the relevant supervisory authority: in the UK the Information Commissioner’s Office (www.ico.org.uk) or for the EU/EEA your national data protection authority in the EU/EEA (list available at edpb.europa.eu).