Privacy Notice

1 Introduction

Cahootz recognises that investors value their data and privacy, so we treat personal data with great care. This policy sets out how and when we collect, use and share the personal information that you, or others, provide to us.

This privacy notice was last updated on 31st August 2026.

2 Who are “we”: Cahootz Group Limited

This privacy notice applies to CAHOOTZ GROUP LIMITED (Company Number 14413674) trading as Cahootz with registered office at 7 Bell Yard, London, England, WC2A 2JR. Cahootz is registered with the ICO to process your personal data and our registration number is ZB516127.

Your data will be processed on our behalf by Share In Ltd, a company registered in Scotland (number SC408803) with registered office at Suite 2, Ground Floor Orchard Brae House, 30 Queensferry Road, Edinburgh, United Kingdom, EH3 2HS (“ShareIn”) hosts the Cahootz website and operates certain pages on the website. ShareIn is registered with the ICO to process personal data and their registration number is ZA029742. ShareIn hosts Cahootz’s website and will be the data processor for the purposes of the Data Protection Act 2018 as amended by The Data Protection, Privacy and Electronic Communications (Amendments) Regulations 2019; Cahootz will be the data controller.

Cahootz and ShareIn act as joint controllers in respect of the processing of personal data for the purposes of complying with, and making decisions in relation to, know your customer (KYC) and anti-money laundering (AML) requirements.

Any payment transactions you make through our website will be made through ShareIn, encrypted through Secure Sockets Layer (SSL), which is a communication protocol that encrypts data sent between a browser and a website or server.

3 Why we may collect data about you

There are many reasons why we may collect and process your personal information and data, including:

  • to provide and manage products and services you have requested
  • to verify your identity, ensure you meet eligibility requirements, protect against fraud and manage risk
  • to comply with legal or regulatory requirements
  • to notify you about other investment opportunities listed on our website that are similar to those in which you have invested, or otherwise viewed or enquired about; and/or
  • to re-organise or make changes to our business.

4 Legal reasons for collecting and using your data

When we collect your personal data, we will do so in line with the following legal reasons.

  1. Consent. When you register to become a member of the Cahootz website we will use your personal information to complete your registration and to allow you to view Cahootz’s available products. We rely on your consent to handle your personal information in this way. You may withdraw your consent at any time but please remember that this could mean we may have to stop providing certain services to you.
  2. Contractual obligations. We may process your information where it is necessary to either enter into a contract with you for the provision of our products or services or to perform our obligations under that contract or to provide you with advice or guidance in relation to accessing our products or services that are offered by us, or otherwise to comply with contractual obligations.
  3. Legal compliance. If the law or any regulator in any competent jurisdiction requires us to, we may need to collect, process or share your data.
  4. Legitimate business interest. We may process your information in the day to day running of our business, to manage our business and financial affairs and to protect our customers, employees and property. It is in our interests to ensure that our processes and systems operate effectively and that we can continue operating as a business. In specific situations, we require your data to pursue our legitimate interests in a way which might reasonably be expected as part of running our business and which does not materially impact your rights, freedom or interests.
  5. Please remember that if you do not agree to provide us with the requested information, it may not be possible for us to continue to operate your account and/or provide products and services to you.

5 How we collect and use your data

We may obtain information in several ways which may include:

  1. Information which you give to us, including when you contact us or register your interest in Cahootz;
  2. Information that we receive from third parties and other companies who provide services to you or us (including via fraud prevention agencies or government agencies);
  3. Information that we learn about you through our relationship with you;
  4. Information that we gather from the technology which you use to access our services (for example an IP address or telephone number);
  5. Information that we gather from publicly available sources, such as the press, the electoral register, company registers and online search engines.

We collect and process personal information and data about you at the start of, and for the duration of, your relationship with us – in each case where we have a reason for doing so and only where that reason is permitted under data protection law. The section below sets out how we collect and use your data in specific circumstances.

It’s important that you keep your personal information with us up to date, so please let us know if anything changes.

When you contact us

When you contact us (including by phone, email, through social media or through a website contact form) in relation to Cahootz, we may process your personal information (including your name, address, contact details, the name of the organisation you work for and other personal information you’ve given us) in order to respond to your query and provide the customer services you have asked us to (if any; for example providing assistance with the Cahootz platform).

We rely on your consent to handle your personal information in this way. If you do not provide us with the data we request from you for customer services purposes, we may not be able to fully answer your queries. We may log and record the interactions you have with us, such as phone calls, email opens and click throughs to help us better service your requests.

When you register your interest in Cahootz , we will use your personal information to complete your registration and evaluate whether you qualify to invest based on applicable regulation.

The details we (or our relevant service providers) collect from you may include your name, address, date of birth, email address, phone number, nationality, investor categorisation, information about your financial circumstances, anti-crime and fraud information (to verify that you are neither suspected nor a victim of fraud or other offences and that your details do not appear on politically exposed persons and sanctions lists), education (including experience of and understanding of investing), visual images (such as copies of passports or drivers licence to verify identity) and payment or bank account details..

If provided to Cahootz by you, we may also collect vulnerability data, such as your age, any disabilities or health conditions or any financial circumstances of you or a member of your household. It’s important that you keep your personal information up to date, so please let us know if anything changes. We process this data either with your consent, or if you have not consented, where it is necessary for our legitimate interests including to comply with financial regulations.

When you register on the Cahootz website, we may share your personal information with third parties involved in the process, such as white label partners, payment providers and credit reference agencies, who we use to assess fraud, credit and/or security risks and also investee companies in connection with your investment. We need to process your personal information in this way to comply with applicable legislation.

Marketing communications

We use your personal data to send you direct marketing emails from Cahootz about Cahootz projects. Cahootz do this only where you have signed up for an account on Cahootz, are eligible to receive such information and have consented to receive marketing communications.

Where we have your express consent, or have a legitimate interest in doing so, we may send you direct marketing where it is in your interest to make you aware of new investments launching and other related product news. We only rely on our legitimate interests where these are not outweighed by your interests or fundamental rights and freedoms. We have done a balancing test and determined that you would expect to receive this information as it is in your interests to receive the latest information about our products and services and about any special offers and promotions.

We will only send you emails about Cahootz projects and will never share your information with any third parties for their direct marketing purposes. You can opt out of receiving direct marketing at any time through clicking the unsubscribe link in our emails, or by contacting us.

To make our website better and more secure

We will use your personal information for the purposes of administering our website and making it more secure, including troubleshooting, data analysis, testing, research, statistical and survey purposes. We process your data for this reason because we have a legitimate interest to provide you with the best experience we can, and to ensure that our website is kept secure.

You can ask us to stop using your personal information in this way by using the “do not track” functionality in your internet browser. If you enable “do not track” functionality, our website may be less tailored to your needs and preferences.

Technical information and analytics

When you visit our website, we will automatically collect the following information:

  • technical information, including the IP address used to connect your computer to the internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, screen resolution, operating system and platform; and
  • information about your visit, including the full Uniform Resource Locators, clickstream to, through and from our website (including date and time), page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs) and methods used to browse away from the page.

We may also collect information on your location on our websites, such as your location data when accessing the website in line with the location settings on your phone or internet browser. This can be disabled or amended via the relevant iOS/Android device setting or in your internet browser settings.

We may work with various third parties, including advertising networks, analytics providers, hosting providers and search information providers from whom we may also receive general aggregated anonymous information about you.

6 How we use your information

We will only use or disclose your personal data for the purposes it was collected for and as disclosed in this notice.

7 Sharing your information

To the extent permitted by applicable law, we may share your information, including locations outside of the UK and European Economic Area (“EEA”), for legal and regulatory purposes, to manage risk, to ensure correct information about and to better manage your account and provide customer service.

Where we share your information with any third parties, we always do so in line with this privacy notice and in compliance with data protection laws and regulatory requirements. Those third parties may process your information as either a data controller or as our data processor (this will depend on the purposes of our sharing your personal data with such third party) but we ensure that these third parties only use your data in line with our instructions.

In addition to the above, some of the organisations we may share your information with include:

  • Anyone who is named and authorised on your Cahootz account
  • Our affiliates and partners, including our white-label partners, to the extent necessary to enable us to deliver our services to you.
  • Banks and payment providers, to fund Accounts, safeguard client money and process investment-related payments and withdrawals.
  • Fraud prevention agencies, anti-money laundering and terrorist financing tools, both when you first sign up and routinely whilst you have an account with us to help us (i) check your identity, (ii) manage your account, (iii) assess any fraud, credit or security risks, and (iv) prevent criminal activity.

We may also share your information for the following reasons.

If our business is sold

We will transfer your personal information to a third party as follows:

  • if we sell or buy any business or assets, we will provide your personal information to the seller or buyer (but only to the extent we need to, and always in accordance with data protection legislation); and
  • if Cahootz, or the majority of its assets, is acquired by somebody else, in which case the personal information held by Cahootz will be transferred to the buyer.

We process your personal information in this way because we have a legitimate interest to ensure our business can be continued by the buyer.

Where we have a legal or regulatory obligation

In some circumstances we may need to share your personal information:

  • if we are under a duty to disclose or share it to comply with a legal obligation (for example, to investigate something like theft or fraud); or
  • to protect the rights, property or safety of our website. This includes (but is not limited to) exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

In difficult circumstances

Occasionally Cahootz investors will share information which indicates that they, or a member of their household, are in imminent danger or at serious risk, and in line with guidance from the Information Commissioner, in such circumstances we may refer the situation to relevant authorities or sources of assistance. In such cases we will consider first and foremost the interests of the person at risk..

For statistical and research purposes

We may share some broader statistics and customer profiling information with third parties, but the information or data will be anonymised, so you will not be identifiable from it.

8 Cookies

What is a cookie?

A cookie is a small file of letters and numbers that we store on your device. Functions usually performed by a cookie can be achieved by using similar technologies such as web beacons or pixels, but in this privacy notice we’ll refer to all of these as ‘cookies’ for simplicity. Cookies are widely used, and they enable our services to function properly and efficiently, as well as providing us with helpful information about how people use our services.

How do we use cookies?

Our services use cookies to distinguish you from other users of our services. This helps us to provide you with a good user experience when you browse our website and keeps your visit secure from cross-site forgery. It also allows us to improve our services, comply with our legal obligations, pursue our legitimate interests and do helpful things.

What options do I have?

Some necessary cookies can't be turned off - stuff breaks without them or sometimes we have a legal obligation or legitimate interest in using them. You have the choice to accept or reject cookies in two additional categories - "Analytics and Performance" and "Marketing and Communications". This option appears when you first visit our website, and at any time when you use the "Change cookie settings" link in the website footer.

Name Purpose Category Cookie
Google Analytics Analytics for improvement, optimisation and advertising performance Necessary CONSENT
Google Analytics Analytics for improvement, optimisation and advertising performance Analytics and Performance _ga
_gcl_au
_gid
AEC
HSID
SIDCC
ShareIn Enhances user experience by remembering session history. Necessary ASP.Net_SessionId
ShareIn Records users authentication session Necessary ASPXAUTH
ShareIn Assists recognising user’s nationality and language preferences, login, token, username recognition and encoding. Necessary _culture
ShareIn Part of a mechanism to protect against cross site scripting attacks Necessary RequestVerificationToken
ShareIn Tracks presentation of the cookie information advice Necessary cookie-policy

The cookie names provided in this table are not exhaustive and can vary as we and our vendors update our systems, or where session identifiers are included in the cookie name.

Cookie preferences

You can manage your cookie preference on our website at any time from the cookie settings page https://www.cahootz.com/cookies page. This allows you to turn preferences on or off as you choose. We have grouped our cookies into three categories:

Necessary: These cookies are essential for the proper functioning of our website. They are necessary for maintaining the website's performance and fulfilling regulatory requirements, such as remembering your progress through a form (e.g., when completing an investment application) and allowing access to secure areas of the website. These cookies always need to be on and can't be switched off.

Analytics and Performance: We use Azure Application Insights to help us continuously improve performance and usability. We also use Google Analytics to measure how you use the website so we can improve it based on user needs. Google Analytics sets cookies that store anonymised information about:

  • how you got to the site
  • the pages you visit on www.cahootz.com and how long you spend on each page
  • what you click on while you're visiting the site

Marketing and communications: subject to your consent where required, these cookies and similar technologies may be set by us or advertising partners to measure engagement, personalise content and assess campaign effectiveness. You can withdraw consent at any time.

Turning cookies off: You can block cookies by activating the setting on your browser that allows you to refuse the setting of some or all cookies. However, if you use your browser settings to block all cookies you may not be able to access all or parts of our services, some features may not work as intended, and your personal information may be less secure. If you don’t want us, or anyone else, to use cookies in your browser you can:

  • Remove cookies from your hard drive;
  • Set your browser to block cookies; and
  • Set your browser to send you a warning notice before a cookie is stored on your computer.
  • For more information on cookies, this website may help allaboutcookies.org. This website is not owned or run by us, but we think it’s helpful.

You might not be able to make the most out of our services without cookies, as some functions need cookies to work. Should you change your mind, simply turn cookies back on.

9 Where is my data processed

Your data will be held by ShareIn on their secure servers located in the Republic of Ireland, but will be processed by staff who work in the UK.

The data and information that we collect and process may be transferred to, processed in and stored at, a destination outside of the UK.

Whenever we transfer, process or store your personal information outside of the UK, we will ensure it is protected as required by applicable data protection laws. This might mean only transferring your personal information to a country that has been deemed by the European Commission, or the UK Information Commissioner, to provide an adequate level of protection, or by using specific contractual protections. You can contact us at the relevant email addresses provided at the end of this notice for details of how we protect specific transfers of your data. All information that you provide us with is stored on our secure servers, or those of our third parties’ data storage providers.

10 Security

We will take all steps reasonably necessary to ensure that your information and/or data is treated securely and in accordance with this privacy notice.

When we have received your information and/or data, we will use strict procedures and security features to prevent unauthorised access. Unfortunately, the transmission of information via the internet is not completely secure and although we will do our best to protect your information and/or personal data, we cannot guarantee its security completely. Accordingly, in the case of a security breach we do not accept any liability for the direct or indirect loss, theft or misuse of any information and/or data that you have provided to us.

11 How long do we retain your data for?

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, accounting or administrative requirements.

To determine the appropriate retention period for the personal information we hold, we consider the amount, nature and sensitivity of the personal information, the risk of harm from unauthorised use or disclosure of your personal information, the reasons why we handle your personal information (including the nature of the activity, product or service), the applicable legal requirements and whether we can achieve those purposes through other means. Retention periods may be changed from time to time based on business or legal and regulatory requirements.

12 What are my rights under data protection laws?

You have various rights under the data protection laws, which you can exercise by contacting us. The easiest way to do this is by email to the relevant email addresses set out at the end of this policy.

12.1 Right to object

The right to object to us handling your personal information where we are handling your personal information based on our legitimate interests. If you ask us to stop handling your personal information in this way, we will stop unless we can show you that we have compelling grounds as to why we should continue to use your personal information. Please note that if you ask us to stop handling your data in the ways set out in this privacy policy it may impact our ability to deliver, and your ability to receive, any services we provide. You can also ask us to stop handling your personal information for marketing purposes at any time.

12.2 Right of access

The right to access your personal information which we are handling, and you are entitled to receive confirmation and details about whether your personal information is being processed by us.

12.3 Right to rectification

The right to require us to rectify any inaccurate personal information we hold about you. You also have the right to ask us to complete personal information which you think is incomplete.

12.4 Right to restriction

The right to restrict our processing of your personal information in certain circumstances.

12.5 Right to data portability

This right only applies to your personal information we are handling because you consented to us using it or because there is a contract in place between us.In this case, you have the right to receive your personal information in a structured, standard machine-readable format, and the right to ask us to send your personal information to another organisation or to give it to you.

12.6 Right to erasure

The right to require us to erase your personal information in certain circumstances.

12.7 Right to complain

If you have any queries or concerns, please contact us using the details below. If you are still unsatisfied, you have the right to lodge a complaint with your local data protection authority.

13 What about websites we link to?

The website may include links to third-party websites, advertisers, affiliates, plug-ins and applications. If you click on a link to any of these websites or enable those connections, you will leave our websites and this may allow third parties to collect or share data about you. We have no control over these third-party websites and are not responsible or liable for (i) their privacy statements, notices or policies or (ii) any contents or materials on third-party websites. We encourage you to check the privacy notice of every third-party website before you submit any personal data to these websites.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

14 Updates, additional notices and contact

Changes to our privacy notice

We keep our privacy notice under regular review. Any changes we make to our privacy notice in the future will be posted on the Cahootz website and, where appropriate, notified to you by email. Please check back frequently to see any updates or changes to our privacy notice. Please note that by continuing to use the website, you are agreeing to any updated versions of the Cahootz privacy notice.

Additional notices or policies

It is important that you read this notice together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This notice supplements any other privacy notices or policies and is not intended to override them.

UK Information Commissioner

We would always rather you speak to us first if you have any questions about our handling of your personal data, so we can resolve any problems as quickly as possible. However, if you are not happy with the way we have handled your data, or would like more information about your rights, you can contact the Information Commissioner’s Office, the UK’s independent authority on data privacy at www.ico.org.uk.

Contact us

Cahootz will usually be the data controller in respect of your personal data and can answer any questions you may have about our privacy practices or the use of your personal data. You can email our data protection officer at [email protected].