Effective date: October 13, 2023
California residents: Please see the important information in our Notice for California Residents
Individuals in the European Economic Area, UK or Switzerland: Please see our Notice for European Users
We get information about you in a range of ways:
Information You Give Us
We may collect your name, postal address, email address, phone number, username, password, demographic information (such as your occupation), social security number, tax ID number, bank account information, as well as other information you directly give us on our Services, which may include marketing, promotions and when communicating to you about new features.
For customers who have paid software services, we collect your billing details such as credit card information, banking information, and/or billing address.
Information We Get From Others
We may get information about you from other sources, such as your employer when they issue you options or shares. We may add this to information you provide us through our Services.
Information Automatically Collected
We may collect information about the devices accessing our Services. Some examples are: type of device, operating system used, application information, unique device identifiers and crash data. The type of information we collect depends on the type of device used and its settings.
Transactional and Usage Information
We may automatically log information about you and your computer, subject to your consent where required by law. For example, like most services when using our Services, we log your computer operating system type, browser type, browser language, pages or screens you viewed, how long you spent on a page or screen, location (your IP address), access times and information about your use of and actions on our Services. This is information we collect from every user of the Services, whether they have an account or not. This information may include personal information.
Cookies and Similar Technologies Information
We may use, process and/or disclose personal information for the following purposes:
We may also use and disclose personal information as follows:
We may create, use and share aggregated or anonymized data for any lawful purpose, such as marketing, analytics or research purposes permitted by law.
We may share personal information with acquirers and other relevant participants in business transactions (or negotiations for such transactions) involving a corporate divestiture, merger, consolidation, acquisition, reorganization, sale or other disposition of all or any portion of the business or assets of, or equity interests in, Carta (including, in connection with a bankruptcy or similar proceedings).
We may share personal information with third party companies or individuals that we engage as service providers to process information and support our business and services. Examples include providers of cloud hosting and storage services, analytics, services, email delivery services and customer support services.
We may share personal information with our lawyers, accountants and other professional advisors in the course of the services they render to us.
We generally retain personal information to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements, to establish or defend legal claims, or for fraud prevention purposes. To determine the appropriate retention period for personal information, we may consider factors such as the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.
When we no longer require the personal information we have collected about you, we will either delete or anonymize it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible. If we anonymize your personal information (so that it can no longer be associated with you), we may use this information indefinitely without further notice to you.
Carta does not allow the use of our Services by anyone younger than 18 years old. If you learn that anyone younger than 18 has unlawfully provided us with personal data through the Services, please contact us and we will take steps to delete such information.
Our marketing emails tell you how to “opt out.” If you opt out, we may still send you non-marketing emails. Non-marketing emails include emails about your accounts and our business dealings with you. If at any time you would like to change your communication preferences, we provide unsubscribe links and an opt-out mechanism in those communications for your convenience.
You may send requests about personal information to our Contact Information below. You can request to change contact choices, opt out of our sharing with others, and update your personal information.
You can update or correct certain personal information in your Carta account. If you are unable to do so on your own, the information is likely controlled by the security issuer and you should contact the security issuer directly to update your information.
Some Internet browsers may be configured to send “Do Not Track” signals to the online services that you visit. We currently do not respond to “Do Not Track” or similar signals. To find out more about “Do Not Track,” please visit https://www.allaboutdnt.com.
Scope. This section applies only to California residents. It describes how we collect, use, and share Personal Information of California residents in our capacity as a “business” under the California Consumer Privacy Act (“CCPA”) and their rights with respect to that Personal Information. For purposes of this section, “Personal Information” has the meaning given in the CCPA. However, this section does not apply to:
Carta does not sell (as such term is defined in the CCPA) the Personal Information we collect (and will not sell it without providing a right to opt out).
Your California privacy rights. You have the following rights under the CCPA:
How to exercise your rights. You may submit requests to exercise your right to information, access or deletion by submitting your request here or via email to firstname.lastname@example.org or toll-free at +1-855-921-2859. We will need to verify your identity to process your information, access and deletion requests and we reserve the right to confirm your California residency. You may be required to provide government identification, give a declaration as to your identity under penalty of perjury and/or provide additional information. If you wish to designate an authorized agent to make a request on your behalf, we will need to verify both your and your agent’s identities and your agent must provide a valid power of attorney pursuant to California Probate Code Sections 4000-4465. If you have not provided your agent with such a power of attorney, you must provide your agent signed permission to exercise your CCPA rights on your behalf, provide the information we request to verify your identity, and provide us with written confirmation that you have given the authorized agent permission to submit the request. We cannot process your request if you do not provide us with sufficient detail to allow us to understand and respond to it. In certain cases, we may be required or permitted by law to deny your request.
|Examples of Personal Information Collected||CCPA Categories||Source|
|You give us||Name, postal address, email address, phone number, username, password, demographic information, social security number, tax ID number, billing information||California Customer Records (as defined in California Civil Code section 1798.80); financial information; identifiers; inferences; online identifiers||You|
|We get from others||Information from your employer when they issue you options or shares||California Customer Records (as defined in California Civil Code section 1798.80); commercial information; identifiers||Third parties|
|Automatically collected: device information||Type of device, operating system used, application information, unique device identifiers and crash data||Commercial information; internet or network information; online identifiers||Automatic collection|
|Automatically collected: transactional and usage information||Your computer operating system type, browser type, browser language, pages you viewed, how long you spent on a page, location, access times and information about your use of and actions on our website||Commercial information; geolocation data; internet or network information||Automatic collection|
|Automatically collected: cookies and similar technologies information||Cookie ID and settings||Commercial information; internet or network information; online identifiers||Automatic collection|
The business/commercial purposes for which we use these categories of Personal Information, and the types of third parties to which we disclose these categories of Personal Information for business purposes are described in the section above entitled “Use and disclosure of personal information.”
The information provided in this section applies only to individuals in the European Economic Area, United Kingdom and Switzerland (collectively, “Europe”) and explains our practices regarding personal information that we collect from you or which we have obtained about you from a third party and the legal basis for processing for your personal information. It also sets out your rights in respect of our processing of your personal information.
Personal information. References to “personal information” in this Notice to European Users are equivalent to “personal data” governed by the General Data Protection Regulation (GDPR).
EU representative. Our EU representative, DataRep’s details can be obtained at https://www.datarep.com/data-request.
Data protection officer. Our data protection officer can be contacted at: Data Protection Officer, email@example.com, eShares, Inc. DBA Carta, Inc. 333 Bush St., Floor 23, Suite 2300 San Francisco, CA 941014
Details regarding each processing purpose listed below are provided in the section above titled “Use and disclosure of personal information”.
||Processing is necessary to perform the contract governing our provision of our Services or to take steps that you request prior to signing up for the Services. If we have not entered into a contract with you, we process your personal information based on our legitimate interest in providing the Services you access and request.|
||These activities constitute our legitimate interests. We do not use your personal information for these activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).|
||Processing is necessary to comply with our legal obligations.|
||Processing is based on your consent. Where we rely on your consent, you have the right to withdraw it any time in the manner indicated when you consent or in the Services.|
Sensitive personal information. We ask that you not provide us with any sensitive personal information (e.g., information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometrics or genetic characteristics, criminal background or trade union membership) on or through the Services, or otherwise to us.
Your rights. You have the following rights in relation to the personal information we hold about you:
You may submit these requests here or email firstname.lastname@example.org or to our postal address provided above. We may request specific information from you to help us confirm your identity and process your request. Applicable law may require or permit us to decline your request. If we decline your request, we will tell you why, subject to legal restrictions.
Cross-border data transfer. If we transfer your personal information out of Europe to a country not deemed to provide an adequate level of personal information protection for purposes of applicable data protection laws such that additional safeguards are required, the transfer will be performed:
You may contact us if you want further information on the specific mechanism used by us when transferring your personal information out of Europe.
EU-U.S. Data Privacy Framework Principles
The following Carta subsidiaries also adhere to the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) and to the rights of EU and UK individuals and Swiss individuals, as your organization’s DPF submission covers all of the following: the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF): Carta Valuations LLC, Carta Investor Services, Inc., Carta Financial Technologies, LLC, Carta Capital Markets LLC, Capdesk ApS and Vauban Technologies Limited.
Carta is responsible for the processing of personal data we receive, and subsequently transfers to a third party acting as an agent on our behalf.
Carta commits to cooperate with EU data protection authorities and the Swiss Federal Data Protection and Information Commissioner and comply with the advice given by such authorities with regard to human resources data transferred from the EU and Switzerland in the context of the employment relationship.
Carta is subject to the regulatory enforcement powers of the U.S. Federal Trade Commission. In certain situations, Carta may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.
In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Carta commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU and UK individuals and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF should first contact Carta at: email@example.com. Please allow a reasonable amount of time to respond to your request. If you do not receive timely acknowledgement of your complaint, if your complaint is not satisfactorily addressed by Carta, or if you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third party dispute resolution provider (free of charge) at https://feedback-form.truste.com/watchdog/request.
If these processes do not result in a resolution, you may then contact your local data protection authority, the U.S. Department of Commerce, and/or the Federal Trade Commission for assistance.
Under certain circumstances an binding arbitration option is available to you to determine, for residual claims, whether Carta has violated its obligations to you under the Privacy Shield Principles, and whether any such violation remains fully or partially unremedied. This option is available only for these purposes. Please be advised that the arbitrator(s) may only impose individual-specific, non-monetary, equitable relief necessary to remedy any violation of the Privacy Shield Principles with respect to the resident.
Carta may transfer your Personal Data to countries other than the one in which you live.
Data Protection Officer
eShares, Inc. DBA Carta, Inc. 333 Bush St., Floor 23, Suite 2300 San Francisco, CA 94104
Products from Carta