Aviso de Privacidad

The Controller of your personal data is Golden State Capital Management, with address at 401 B Street, Suite 1850, San Diego, CA 92101, United States. Email: investors@goldenstatecap.com. Phone: +1 (619) 769-4155.

The Controller is established in the United States. Processing includes international transfers, as described below.

We collect the following categories of personal data, depending on the relationship:

• Identification and contact data: name, email, phone, country code, language preference, and account identifiers.
• Registration and sign-in data, including data Google shares if you choose "Continue with Google."
• Investor-profile data: country or location, planned investment range, goals, project-type interests, experience, referral source, and notes you provide.
• Indication of interest in an investor visa (only to understand your goals; it is not an immigration filing).
• Operations data: investment requests, contact channel (for example WhatsApp), amounts, bank references, deposit dates, receipts, cash-out or reinvestment requests, and holdings.
• Communications data: form, email, phone, or messaging content, and response records.
• Candidate data: name, email, phone, role interest, and message if you use "Work with us."
• Browsing data: IP address, browser type, pages visited, approximate location derived from IP, and cookies, as described in the Cookie Policy.

To verify identity, accredited-investor (or equivalent) eligibility, and bank transfers, we may collect sensitive personal data, in particular:

• Government ID (passport, driver's license, or national ID) and data contained in it.
• Proof of income, net worth, or other financial documents you upload for accreditation.
• Deposit or transfer receipts that may reveal financial information.

Processing of sensitive data is necessary for onboarding, fraud prevention, and compliance. By uploading those documents or continuing verification, you consent to that processing under this Notice. You may revoke consent under Section 9, understanding that revocation may prevent continuing the relationship or completing an investment.

Primary purposes—those necessary for the relationship you request—are:

• Creating, authenticating, and administering your account, including Google sign-in if you choose it.
• Completing the investor profile and reviewing accreditation and identity documents.
• Communicating about your account, meetings, deposits, project documents, distributions, and status.
• Recording and confirming transfers you report, and maintaining the operational portfolio.
• Handling contact, support, and career submissions.
• Preventing fraud, unauthorized access, and misuse of the platform.
• Complying with legal duties (securities, tax, AML, sanctions, and others) and establishing or defending claims.
• Remembering your language preference and operating the site securely.

If you do not want us to process your data for these primary purposes, you will not be able to use an investor account or complete processes that depend on that data.

Secondary purposes—not strictly necessary for the relationship, but used to improve the service—are:

• Sending informational communications about new opportunities or institutional content, where permitted by law.
• Measuring site usage through analytics (for example Google Analytics, when enabled), as described in the Cookie Policy.
• Understanding, internally or in aggregate, general interests of prospects (including investor-visa interest) to prepare conversations; not to provide immigration services.

You may object to secondary purposes by emailing investors@goldenstatecap.com with the subject "Objection to secondary purposes." Refusal will not be a reason to withhold primary-purpose services.

We may transfer personal data, as needed, to:

• Providers of hosting, storage (including private cloud for documents), email, authentication, and analytics, who process data on the Controller's behalf.
• Legal, accounting, tax, and audit advisers.
• Financial institutions, when needed to identify a transfer you made.
• Competent authorities, when legally required.
• Third parties in a merger, spin-off, acquisition, or asset sale, with appropriate safeguards.

When you open WhatsApp or another third-party service, those parties process information under their own policies. That transmission is at your request.

Transfers to processors acting for the Controller, and transfers necessary for the legal relationship or required by law, do not require additional consent under the Data Rules. Any transfer that does require consent will be made only with prior consent, except as the law allows.

Your data will be transferred to and processed in the United States, where the Controller is established, and in other countries where service providers operate. Those countries may offer a different level of protection than Mexico.

By using the platform, creating an account, or submitting information, you consent to that international transfer for the purposes in this Notice.

You have the right to:

• Access: know what personal data we hold and the Notice that governs its processing.
• Rectification: request correction of inaccurate or incomplete data.
• Cancellation: request deletion when you believe data is not processed in accordance with the Data Rules, without prejudice to legal retention.
• Opposition: object to processing for specific purposes, in the cases the law allows.

You may also limit use or disclosure of your data and revoke consent, as described below.

To exercise ARCO rights, limit use or disclosure, or revoke consent, email investors@goldenstatecap.com with the subject "ARCO request" or "Revocation of consent," and include:

1. Full name and a means to send our response (email).
2. Documents proving your identity (and, if applicable, representation).
3. A clear description of the data and the right you wish to exercise.
4. Any element that helps locate the data.

We will handle the request within the timeframes in the Data Rules. We may request additional information to verify identity. Revocation or cancellation may mean we cannot continue providing the account service or complete an investment. Certain KYC, securities, tax, and accounting records may be retained even if cancellation is requested, where the law requires it.

You may ask us to limit use or disclosure of your data for secondary purposes using the same email in Section 9. We will record your request in our internal exclusion records for those purposes.

We use cookies necessary to operate the site (session, authentication, and language preference). We may use analytics cookies when measurement tools are enabled. Details, periods, and controls are described in the Cookie Policy.

We may modify this Notice. Changes will be available on this page, with an updated date. If a change is material, we may also notify you by email or a visible site notice. Later use constitutes acceptance to the extent the Data Rules allow.

By creating an account, checking the acceptance box, uploading documents, submitting a form, or continuing to use the platform, you acknowledge that you have read this Notice and consent to the processing and transfers described, including international transfers and, where applicable, processing of sensitive data needed for verification.

The U.S.-style Privacy Policy supplements this Notice for users in other jurisdictions. For data subjects in Mexico, this Aviso de Privacidad controls with respect to personal-data protection rights.