Privacy Policy

SOUSTEX, Inc., a Delaware corporation, (“SOUSTEX”, “we,” “us,” or “our”), operates the technology platform described below. We respect your privacy and are committed to protecting it through our compliance with this privacy policy (this “Privacy Policy”).

This Privacy Policy explains how we collect, use, share, retain and protect personal information about you when you visit, access, use the Platform, or create an account, evaluate or subscribe for an offering at SOUSTEX at soustex.com and any related mobile application, investor portal, data room, communication tool, application programming interface or other online service that links to this Privacy Policy (the “Platform”).

By accessing or using the Platform you confirm that you have read this Privacy Policy. If you do not agree with this Privacy Policy, do not use the Platform. This Privacy Policy may change from time to time. Your continued use of this the Platform after we make changes is deemed to be acceptance of those changes, so please check the Privacy Policy periodically for updates.

This Privacy Policy covers account holders, prospective and current investors, prospective and current property owners, beneficial owners and control persons of entity investors, managers, representatives of Issuers, persons who communicate with us and all visitors to the Platform.

The Platform hosts multiple offerings from different Issuers. Some Issuers are entities affiliated with SOUSTEX (“Affiliated Issuers”), and others are independent third parties (“Unaffiliated Issuers”).

Where an Issuer is an Unaffiliated Issuer, that Issuer may provide its own privacy notice, and that notice will apply to its independent processing of your Personal Data.

Data Controllers

The “data controller” is the entity which determines the purposes and means of the data processing taking place. The “data processor” is an entity acting on behalf and under the instructions of a controller in processing Personal Data.

SOUSTEX operates the Platform, is the merchant of record for card payments and determines the purposes and means of processing for Platform administration, account management, authentication, security, support, platform analytics, platform communication, and marketing.

The applicable Issuer is the entity identified in the relevant offering materials. For offering specific data processing, SOUSTEX and the applicable Issuer may act as independent controllers, joint controllers, or controller/processor, depending on the processing activity, the offering structure and the applicable law.

SOUSTEX is generally responsible for Platform requests. The Issuer is generally responsible for offering specific investor records, distributions, tax reporting, and issuer communications. Where we act jointly, users may contact either party and we will coordinate the response.

Third Party Contractors

We use third party contractors who also function as data processors and data controllers including:

DIGTL: https://digtl.co/privacy
Stripe: https://stripe.com/privacy
AuthenticDoc: https://authenticdoc.online/privacidad

DIGTL provides onboarding, identity verification, investor eligibility, sanctions/PEP screening, and related verification services. DIGTL may act as our/Issuer’s processor/service provider, with its own independent legal obligations as a data controller.

Stripe provides payment processing and processes payment data as a processor/service provider with its own independent legal obligations as a data controller.

AuthenticDoc provides encrypted storage of identity and offering documents. It processes personal information as our processor/service provider.

We require third party contractors to process personal information only under written agreements containing confidentiality, security, data use, deletion/return and breach notification obligations appropriate to the applicable law.

Information We collect

We collect the categories of personal information below. Some of it is collected because securities and anti-money laundering laws require us to identify you, confirm your eligibility, and keep records. The remainder is needed to run the Platform.

Identity and verification data for natural persons: Full Name, Date of Birth, Nationality and Country of Residence, Government-Issued Identification (passport, driver’s licence, or other national ID), a Photograph Or “Selfie,” Residential Address and Tax Identification Number. For entity investors, formation documents and beneficial ownership information.
Eligibility and financial data: your investor category and the evidence supporting it (accredited investor verification, investor representations, tax status and certifications, income, net worth, source of funds, bank or brokerage statements, transaction history and investor profile information.
Identity and verification for entity investors: formation documents, organization charts, registers, operating agreements, authorized signatories, directors, officers, managers, trustees, settlors, protectors, beneficiaries, beneficial owners, control persons, and representatives.
Subscription, holdings, and tax data: the offering you subscribe to, subscription amount, payment records, the tokens you hold and their lock-up status, distributions, and tax reporting data.
Payment data: when you subscribe you complete a Stripe checkout. Stripe collects and processes your card or bank details and returns limited transaction data to us (such as confirmation, the last four digits, and the result). We do not receive or store full card numbers as we receive payment confirmation and related transaction metadata.
Wallet and on chain data: your blockchain wallet address and the on-chain transaction records associated with your tokens such as public key, wallet type, wallet verification status, whitelisting status, transfer history, token balance, blockchain network, smart contract interactions and transaction hashes. Note that wallet addresses and transaction hashes may be personal information where they are linked or reasonably linkable to you
Account data: your login credentials, multi-factor authentication data, user permissions, the offering documents and financial statements you view or download, and records of the agreements and consents you accept including the date, time, IP address, and document version of each click-to-agree acceptance.
Device and usage data: IP address, device (device information including, but not limited to, identifier, device name and type, operating system, location, mobile network information, and standard web log information) and browser type, log data, and the pages or features you use, collected through cookies and similar technologies.
Communications: information you give when you contact us, DIGTL, the applicable Issuer or relevant service provider, including during the onboarding telephone call, which may be recorded for verification, quality, and compliance, as well as emails, texts, chat messages, support tickets and meeting noted.
Issuer: Issuer name, offering details and documentation, subscription status, allocation, transfer restrictions, secondary transfer requests, redemption requests, consent records, distribution elections, tax forms, and communications about the offering.
Property and offering asset data: property address, title information, appraisal, leases, occupancy, insurance, tax, photographs, inspection reports, environmental information, development documents, permits, seller/developer information and diligence materials.

How We Collect Information

We collect personal information:

directly from you, when you sign up and sign in, subscribe, upload documents, complete questionnaires, joining a waitlist, book a call, interact with offering pages and/or communicate with us including by sending your queries or requests for contact or information;
from DIGTL, where used for the relevant offering and which carries out the complete onboarding and verification process, whether you complete it by self-service or by telephone;
from Stripe, banks or any other payment providers; and
d similar technologies.

How We Use Your Information

We use your personal information to:

open, maintain or close your account and operate the Platform. This includes the verification of your account, authentication of users, and the maintenance of its functionalities to provide proper access as well as to process any operation and/or request made by you, based on your consent and the Agreement existing between you and SOUSTEX;
administer your investment such as processing your subscription, issue and release your tokens, record your holdings, and pay your distributions.
Process your payment, settlement, any chargeback response, reconciliation and monitor fraud through Stripe or any other third-party contractor;
meet our legal and regulatory obligations, including reporting anti-money laundering and related activities as required by the applicable law or other agencies or governments with jurisdiction over us, the Issuer, service providers or relevant transaction parties, by authenticating identity, securities law eligibility checks (accredited verification, investor representations and residency), sanctions screening, lawful requests, recordkeeping and tax reporting and withholding, as well as reporting possible criminal acts or threats to public security to a competent authority. Sanctions, PEP, fraud, and eligibility screening may occur even where no investment is completed;
make offering documents and financial statements available to you and keep a record of what we provided;
secure the Platform, prevent fraud and chargeback abuse as well as investigate cyber incidents and bot activity;
resolve disputes and respond to inquiries and technical support requests, as necessary for customer support, legal claims, legitimate interests, and legal compliance, and based on consent where required; 8.Meet the contractual obligations we have to you and/or facilitate the continuation and/or termination of the contractual relationship between you and us; and
communicate with you and, where you have not opted out (or have opted in where required), send you marketing about SOUSTEX and future offerings, services and collaborations that are based on our legitimate interest in keeping you informed about our Platform and matters that may be of interest to you; where the law requires consent for such messages, we rely on your consent instead, and you can opt out at any time as described below.

We share personal information only as described below. We do not sell your personal information.

Service providers and the offering’s professional parties: DIGTL and/or any other identity verification providers, Stripe and/or any other payment processing providers, auditors, the fund and tax administrators, legal and other professional advisors, property managers, IT, cloud, communication and analytics providers, each only as needed for its function and under confidentiality and data protection obligations. Each provider may process information for us, for the applicable Issuer, or as an independent controller depending on the service.
The applicable Issuer and its affiliates as needed for the administration of the offering and reporting. We do not consent to Issuers using your personal information for their own unrelated marketing unless you have requested it, consented to it or the law otherwise permits it.
Regulators, self-regulatory organisations, courts, and law enforcement, where required or permitted by law, or in response to lawful requests, including the U.S. Securities and Exchange Commission (“SEC”), the Financial Crimes Enforcement Network (“FinCEN”), and the Office of Foreign Assets Control (“OFAC”). A successor in a merger, acquisition, financing, or sale of assets, subject to this Privacy Policy.
The blockchain: your wallet address and token transactions are recorded on a public or permissioned ledger and are visible to its participants.
To protect rights and prevent harm. We may disclose information where we believe in good faith that it is necessary or appropriate to protect the rights, property, or safety of SOUSTEX, Issuers, our Investors and users or others. This includes exchanging information with other companies and organisations for fraud protection, anti-money laundering, and credit and transaction risk reduction, where permitted by applicable law.

GLBA Financial Privacy Notice

This Section is our privacy notice under the U.S. Gramm-Leach-Bliley Act (“GLBA”) for the non-public personal financial information we handle. SOUSTEX is not a broker-dealer, transfer agent, funding portal or investment adviser registered with the SEC. If our regulatory status or offering structure changes, we will update our privacy and compliance notices as required.

What we collect: the financial and identifying information described in Section: ‘Personal Information We Collect’.
What we disclose, and to whom: we disclose non-public personal information only as described in Section: ‘How We Share Your Information’ to our service providers and the offering’s professional parties, to complete the transactions you request, to comply with legal and regulatory requirements and to protect against fraud.
Marketing and opt-out: we do not disclose your non-public personal information to non- affiliated third parties for their own marketing, so no opt-out is required for that purpose.
Safeguards and delivery: we maintain the safeguards described in Section: Data Security and Breach Notification, and we provide this notice when you become a customer and as required afterwards.

International Data Transfers

This section applies where personal information is transferred from a jurisdiction with cross- border transfer restrictions.

If you are in the EEA or the UK, or another jurisdiction with data transfer restrictions, your personal data may be transferred to, stored in, and accessed from the United States and other countries that the European Commission or your jurisdiction has not found to provide an adequate level of protection.

Where we transfer your personal data outside the EEA or the UK to administer the investment you have requested, we rely on Article 49(1)(b) of the GDPR, which permits a transfer that is necessary to perform a contract with you. For other transfers we are putting in place the Standard Contractual Clauses with the UK Addendum or relying on the EU-US Data Privacy Framework where the recipient is certified. You may contact us for details of the mechanism that applies.

This Section applies only where GDPR/UK GDPR applies to the relevant processing.

It adds to the rest of this Privacy Policy and, for these users, prevails over it to the extent of any conflict. In this Section, the “GDPR” means the General Data Protection Regulation (EU) 2016/679 as it applies in the EEA and, for the UK, the United Kingdom GDPR together with the UK Data Protection Act 2018.

We rely on the following lawful bases under Article 6(1) of the GDPR:

Performance of a contract such as Platform services, account administration, process your subscription, issue and release your tokens and pay your distributions where applicable.
Compliance with a legal obligation to verify your identity, carry out anti-money laundering and sanctions screening, confirm your eligibility and the securities law conditions of an offering, keep records and meet tax reporting and withholding requirements. Where biometric data (such as a selfie), sanctions data, PEP status or other sensitive information is processed, we will rely on an appropriate Article 9 condition where required.
Our legitimate interests which are to secure, troubleshoot, and improve the Platform, prevent fraud and abuse, and keep you informed about the Platform and our offerings, except where your interests or fundamental rights override those interests.
Your consent is required for certain marketing, non-essential cookies and for the voluntary communications. You may withdraw consent at any time, without affecting processing carried out before you withdrew it.

Where we ask for information to meet a legal or contractual requirement, not providing it may mean we cannot open your account or complete your investment.

Subject to the conditions and exceptions in the GDPR, you have the right to:

access the personal data we hold about you and receive a copy of it;
correct inaccurate or incomplete data;
erase your data, subject to the blockchain limits in Section: ‘Blockchain Records and Limits on Deletion’, and subject to data we are required to keep by law;
restrict our processing of your data in certain circumstances;
receive the personal data you provided to us, which we process by automated means on the basis of your consent or for the performance of a contract, in a structured, commonly used and machine-readable format, and have it transmitted to another controller where technically feasible. This right does not apply to data we process to comply with a legal obligation, such as anti-money laundering, sanctions, eligibility and tax records, or to information about other persons;
object to processing based on our legitimate interests, and to object at any time to processing for direct marketing;
withdraw consent you have previously given; and
complain to your data protection supervisory authority in the EEA where you live or work, your local authority; in the UK, the Information Commissioner’s Office.

Where the request concerns offering-specific processing by an Issuer, we may coordinate with or refer the request to the applicable Issuer.

To exercise any of these rights, contact us using the details herein. We will respond within the period the law allows (generally one month), and we may need to verify your identity before we do.

Your U.S. Privacy Rights

California Residents

The rights in this section apply only where the relevant state privacy law applies to us and the relevant information is not exempt.

This section of the Privacy Policy provides information to California residents whose personal information is processed pursuant to the California Consumer Privacy Act of 2018 (“CCPA”), whether through the Platform or offline. It describes the categories of personal information that we collect, and the purposes for which that information is collected.

This section does not apply to personal information that is protected under federal financial privacy laws. Personal information does not include information that is publicly available or that has been de-identified or aggregated.

Certain personal information may be collected under the GLBA and is exempt from the CCPA/CPRA, except the data breach right of action under California Civil Code § 1798.150, which is preserved. The rights below apply to the information that is not GLBA-exempt. If you are a California resident, you have the right to:

know and access the personal information we hold, and receive a copy;
correct inaccurate information;
delete your information, subject to herein and to legal exceptions;
opt out of the sale or “sharing” of your information (We do not offer an opt-out of sale link on our homepage for the purposes of the CCPA. We may share personal information with our service providers, with third parties with whom we jointly offer products or services, with third parties from whom you request a product or service through us, in the context of a merger, acquisition, bankruptcy, or other corporate transaction, or as otherwise permitted by the CCPA).
limit the use of your sensitive personal information; and
not be discriminated against for exercising any of these rights.

Depending on your state of residence, you may also have rights to access, correct, delete, obtain a copy, opt out of targeted advertising/sale/profiling, appeal a denied request, and use an authorized agent.

To make a request, contact us at email@sousta.fund. We may verify your identity before responding. If we deny your request, you may appeal by contacting the said email address.

If our use of cookies, analytics, advertising, retargeting, issuer marketing, or similar technologies constitutes a ‘sale,’ ‘sharing,’ or targeted advertising under applicable law, we will provide required notices and opt-out rights.

Data Security And Breach Notification

We maintain a written information security program with administrative, technical, and physical safeguards appropriate to the sensitivity of the information. The program includes a qualified individual who oversees it, periodic risk assessments, access controls, encryption of sensitive data in transit and at rest where appropriate, oversight of our service providers, and a written incident response plan. We require our service providers to protect the information we share and where applicable to notify us promptly of a breach of their systems.

Where the Federal Trade Commission (“FTC”) Safeguards Rule applies to us, we will notify the FTC of a qualifying notification event as required by that Rule. We will also notify affected individuals, applicable regulators, Issuers and contractual counterparties, where, and as promptly as, applicable state breach notification law requires. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

The security of your information also depends on you. Where you have a password for access to parts of the Platform, you are responsible for keeping it confidential, and we ask you not to share it with anyone. No method is completely secure. The transmission of information over the internet is not completely secure. Although we work to protect your personal information, we cannot guarantee the security of information you transmit to the Platform, and any transmission is at your own risk. We are not responsible for any circumvention of the privacy settings or security measures on the Platform, except as we agree with you in writing.

Blockchain Records And Limits On Deletion

Your tokens are recorded on a blockchain. By design, certain on-chain data, your wallet address and the transactions associated with your tokens are immutable and cannot be changed or deleted by anyone, including us. We minimise on-chain data: we keep your identifying and financial information off-chain and record only your wallet address and encrypted references on-chain. When you exercise a deletion right, we will take reasonable steps to delete or de-identify the off-chain personal information we control including, where feasible, by destroying the encryption keys that link an on-chain reference to your identity but we cannot remove data already written to the blockchain. By using the Platform you acknowledge this technical limitation, and that Issuer specific records may also be retained by the applicable Issuer where legally required.

You control your own whitelisted wallet and the private keys to it. We do not hold or control your wallet or your keys. We cannot recover a lost key and we cannot reverse a transaction once it is recorded on the blockchain.

How Long We Keep Your Information

To set the right retention period for personal information, we consider the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it and whether we can achieve those purposes by other means, and the applicable legal, regulatory, tax, accounting, and other requirements.

For information processed through the Platform, we retain your personal information as follows:

Account access and use for as long as you maintain your account, and then for a period after closure as required by law.
Legal and regulatory compliance for the periods applicable law requires, including at least five years for anti-money laundering, Know Your Customer, and transaction records , and the periods required for tax, audit, legal claims and other compliance purposes.
Queries and requests for as long as necessary to handle your query or manage your request.
Communications until you ask us to erase the information, or one year after you last engaged with our Communications, whichever is earlier.
Analytics where we rely on your consent, until you withdraw it; where we rely on our legitimate interest, only for as long as needed to compile the information for each analysis. In any case, we periodically delete web traffic information so that we retain only anonymous statistical usage data.

When information is no longer needed for the purpose for which we hold it, we archive, restrict, anonymize or de-identify it rather than keep it in active use, and retain it only to deal with any liability or obligation that may arise from the processing described above, after which we delete it subject to the provisions herein.

Marketing And Your Choices

You can opt out of marketing emails at any time using the unsubscribe link or by contacting us; we will still send you transactional and legally required messages. If you give us your number and consent, we may call or text you about the Platform and your investment, and you can withdraw that consent at any time. Message and data rates may apply.

Children’s Privacy

The Platform is for adults. You must be at least 18 to use it, and we do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it unless retention is required by law or necessary to protect rights, security and/or legal claims.

Changes To This Policy

We may update this Policy from time to time. We will post the updated version with a new effective date and, for material changes, give you additional notice. Your continued use of the Platform after the changes takes effect means you accept the updated Policy, so please review it periodically.

Contact Us

You may contact us by:

Email Address: email@soustex.fund
Office Address: [Enter Address]
Telephone: Enter Phone #

Definitions

“Affiliated Issuer” means an Issuer that is affiliated with, managed by, sponsored by, or under common control with SOUSTEX, SOUSTA, or any SOUSTA Entity.

“Agreement” means any agreement, terms of use, subscription agreement, investor agreement, platform agreement, offering document, consent, acknowledgment, or other binding arrangement between you and SOUSTEX, an Issuer, or another relevant party.

“Applicable Law” means any applicable federal, state, local, foreign, or international law, statute, regulation, rule, order, directive, guidance, regulatory requirement, court order, or governmental requirement that applies to the relevant processing activity, offering, Issuer, User, or Platform function.

“Blockchain” means a distributed ledger, blockchain network, smart-contract protocol, or similar technology used to record, verify, transfer, restrict, or administer Tokens, Wallet Addresses, transactions, or related On-Chain Data.

“Communications” means emails, calls, text messages, chat messages, support tickets, meeting notes, recorded onboarding calls, notices, inquiries, requests, and other communications between you and SOUSTEX, an Issuer, DIGTL, Stripe, or any relevant Service Provider.

“Controller” means the person or entity that determines the purposes and means of processing Personal Data or Personal Information. For U.S. state privacy laws, similar roles may be described as a “business,” “controller,” or similar term.

“DIGTL” means DIGTL Ltd. and its affiliates.

“EEA” means the European Economic Area, consisting of the member states of the European Union together with Iceland, Liechtenstein, and Norway.

“Issuer” means the individual or legal entity that issues, offers, sells, sponsors, or otherwise makes available Tokens, securities, interests, investment instruments, or other assets through or in connection with the Platform. The applicable Issuer for each Offering will be identified in the relevant offering page, subscription materials, Offering Documents, Issuer- Specific Privacy Supplement, or other applicable materials.

“Offering” means any offer, sale, issuance, subscription, investment opportunity, tokenized asset, securities offering, property related offering, or other transaction made available through or in connection with the Platform by an Issuer.

“Offering Documents” means the documents, disclosures, agreements, risk factors, subscription materials, private placement memorandum, offering memorandum, operating agreement, limited partnership agreement, token terms, investor questionnaire, investor representations, issuer disclosures and other materials relating to an Offering.

“On-Chain Data” means information recorded on, submitted to, derived from, or visible through a Blockchain, including Wallet Addresses, transaction hashes, token balances, transfer records, smart-contract interactions, whitelisting status, and related blockchain records.

“Personal Data” means any information relating to an identified or identifiable individual, as defined under the GDPR, UK GDPR, or other Applicable Law. “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an individual, User, investor, beneficial owner, control person, representative, or other person, as defined under Applicable Law. Personal Information includes Personal Data where applicable.

“Platform” means the SOUSTEX website located at www.soustex.com, together with any related website, mobile application, investor portal, issuer dashboard, data room, communication tool, API, account system, payment workflow, onboarding workflow, or other online service that links to this Privacy Policy.

“Processor” means a person or entity that processes Personal Data or Personal Information on behalf of, and under the instructions of, a Controller. For U.S. state privacy laws, similar roles may be described as a “service provider,” “processor,” “contractor,” or similar term.

“Service Provider” means any vendor, contractor, processor, professional adviser, technology provider, identity verification provider, payment processor, fund administrator, tax adviser, auditor, legal adviser, cloud provider, analytics provider, communication provider, blockchain analytics provider, custodian, wallet provider, transfer agent, escrow agent, property manager, or other third party that provides services to SOUSTEX, an Issuer, or another relevant party.

“SOUSTEX” means SOUSTEX Inc., a Delaware corporation, in its capacity as the operator of the Platform, unless an applicable notice states otherwise.

“Stripe” means the Stripe, LLC the US parent company, or Stripe Technology Company, Limited, Irish Company or any other such affiliate company which provides third- party payment processing.

“Token” means any digital token, blockchain based record, digital representation, security token, interest, unit, instrument, entitlement, or other digital asset issued, administered, transferred, restricted, or recorded through or in connection with an Offering.

“Unaffiliated Issuer” means an Issuer that is not affiliated with, managed by, sponsored by, or under common control with SOUSTEX, SOUSTA, or any affiliated entity.

“User” means any person who visits, accesses, or uses the Platform, creates an account, reviews an Offering, subscribes for an Offering, provides information to SOUSTEX, an Issuer, DIGTL, Stripe, or a Service Provider, or otherwise interacts with the Platform. A User may include a visitor, prospective investor, current investor, property owner, seller, developer, sponsor, issuer representative, beneficial owner, control person, authorized signatory, or other transaction participant.