Privacy Policy

Overview

Agora Labs Ltd., a British Virgin Islands business company (“Legion”, the “Company”, “we”, “us”, or “our”), is the controller of your personal data and describes in this Privacy Policy how we collect, use, share, store, and safeguard your personal information across our website at uselegion.com, the Legion platform, related events, and any associated services (collectively, the “Services”).

You must agree to this Privacy Policy, our Terms of Use, and any other policies referenced here to access the Services. If you do not agree, you must not use the Services. This Policy applies to all users and to any third-party service providers engaged by Legion to support the Services.

Key Definitions

Data Processing. Any operation performed on personal data including obtaining, recording, collecting, organizing, storing, altering, retrieving, disclosing, or destroying information.

Personal Data. Any information relating to an identified or identifiable individual, including name, contact details, government identifiers, social media usernames, IP addresses, wallet addresses, and transaction data.

User. Any individual, business, or project accessing the Services.

Data Collection

Direct collection. We collect information you provide to us, including identity and contact details (name, email, phone, address), government-issued identification and accreditation documents submitted for Know-Your-Customer (KYC) and investor verification, wallet addresses, financial and professional background, responses to eligibility questions, feedback, support inquiries, and marketing preferences.

Automatic collection. When you use the Services, we automatically collect technical information including browser type and version, operating system, device identifiers, pages viewed, referring URLs, session duration, and IP address, through cookies and similar tracking technologies.

Third-party analytics and error monitoring. We use Amplitude to understand how the Services are used, including which pages and sections you view and how long you spend on them, and Sentry to detect and diagnose technical errors. These providers receive a pseudonymous identifier rather than your name or contact details. We do not sell your personal information to these providers.

Blockchain data. Where an SPV’s interests are tokenized, Legion or its administrator records information on a public blockchain. This includes a pseudonymous identifier associated with your wallet and attestations (“badges”) confirming that you have completed KYC and sanctions screening, your investor status, and your jurisdiction. These attestations are designed not to reveal your identity or the underlying documents, but they are derived from your personal data and are publicly visible. Any transactions or interactions you conduct on public blockchains are likewise publicly accessible.

Information written to a public blockchain is immutable. It cannot be altered, deleted, or erased by us or by you. This permanently limits our ability to give effect to a deletion, rectification, or erasure request in respect of that information, and you should take this into account before participating in a tokenized offering.

Legal Bases for Processing

We process personal data on one or more of the following bases: your consent; the performance of a contract with you or to take steps at your request prior to entering a contract; compliance with our legal obligations; and our legitimate interests in operating, improving, and securing the Services, provided those interests are not overridden by your rights.

How We Use Personal Data

• To verify your identity and eligibility, including KYC, AML, sanctions, and accredited-investor checks;
• To operate, maintain, and improve the Services and develop new features;
• To match qualified investors with private-market opportunities and facilitate your participation in transactions;
• To communicate with you about your account, transactions, service announcements, and support requests;
• To personalize content and the user experience;
• To detect, prevent, and investigate fraud, security incidents, and other unlawful activity;
• To comply with legal, regulatory, tax, and accounting obligations and to enforce our agreements;
• To send marketing communications where permitted; and
• To assess job applicants and administer employment relationships.

How We Share Personal Data

Affiliates. We share personal data with the Legion group entities that perform functions necessary to the Services: Primus Pilus Ltd., as investment adviser to the SPVs; Programmatic GP, LLC, as general partner of the U.S. SPVs; and Programmatic Admin, LLC, as administrator, which maintains the register of investors, processes capital calls and distributions, prepares tax reporting including Schedules K-1, and issues the on-chain attestations described under “Blockchain data”. Each entity receives only the personal data required for its function.

Service providers. We share information with vendors and contractors who help us deliver the Services, including identity verification providers, custodians, banking and payment partners, cloud hosting, analytics, communications, and professional advisors. These providers are bound by confidentiality and data-protection obligations.

Deal counterparties. With your authorization and only to the extent necessary, we may share information relevant to a transaction with issuers, sponsors, other investors, or special-purpose vehicles in which you choose to participate.

Legal and compliance. We may disclose information when required by law, subpoena, or other legal process, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

Business transfers. In connection with a merger, acquisition, financing, reorganization, sale of assets, or bankruptcy, personal data may be transferred as part of the transaction.

Data Security

We implement commercially reasonable technical and organizational measures designed to protect personal data against loss, misuse, unauthorized access, disclosure, alteration, and destruction, including encryption, access controls, logging, and periodic security reviews. No system is perfectly secure, and we cannot guarantee absolute security.

Data Retention

We retain personal data only for as long as necessary to provide the Services, comply with our legal and regulatory obligations, resolve disputes, and enforce our agreements. In particular, we retain KYC, sanctions-screening, accreditation, and transaction records for at least seven years following the later of the closure of your account and the final liquidation of any SPV in which you invested, in order to satisfy anti-money-laundering, tax, and fund record-keeping obligations. Other personal data is deleted or anonymized once it is no longer needed for the purposes described in this Policy. Information recorded on a public blockchain cannot be deleted — see “Blockchain data” above.

Your Rights

Depending on your jurisdiction, you may have the right to access, copy, rectify, port, restrict, or delete your personal data, object to processing, and withdraw consent. To exercise these rights, contact us at [email protected]. We may need to verify your identity before responding and may retain information where we are legally required or permitted to do so.

California residents (CCPA/CPRA)

California residents may request disclosure of the categories and specific pieces of personal information we have collected, request deletion, correction of inaccurate information, and opt out of certain sharing. We do not sell or share personal information as those terms are defined in the CCPA/CPRA. You may exercise these rights by contacting [email protected].

In the preceding 12 months we have collected the following categories of personal information: identifiers (name, email, postal address, telephone number, IP address, wallet address, government identification numbers); personal information categories listed in the California Customer Records statute (name, address, telephone number, financial information); commercial information (transaction and investment history); internet or network activity (browsing and interaction with the Services); geolocation data (derived from IP address); professional or employment-related information; and inferences drawn from the above. We collect this information from you directly, from your use of the Services, and from identity-verification, sanctions-screening, and analytics providers.

We collect and use this information for the business purposes described under “How We Use Personal Data”. In the preceding 12 months we have disclosed each of the above categories for business purposes to the categories of recipients described under “How We Share Personal Data”. You may exercise your rights, or use an authorized agent to do so on your behalf, by contacting [email protected].

Additional privacy rights — residents of the EEA and the United Kingdom

Legion is established in the British Virgin Islands and has no establishment in the European Economic Area or the United Kingdom. We do not market, promote, or otherwise direct the Services to persons in the EEA or the UK. We therefore do not consider the EU General Data Protection Regulation or the UK GDPR to govern our processing of personal data. Without conceding that either regulation applies to us, we extend the following rights as a matter of policy to any individual resident in the EEA or the United Kingdom whose personal data we hold:

• Access to the personal data we hold about you;
• Rectification of inaccurate or incomplete data;
• Erasure of your personal data;
• Restriction of processing;
• Objection to processing;
• Data portability; and
• Withdrawal of consent at any time.

To exercise any of these rights, or to raise any concern about our processing of your personal data, contact [email protected]. We aim to respond within one month of receiving your request.

Marketing Preferences

You may opt out of promotional communications at any time by following the unsubscribe link in our emails or by contacting us. Operational messages about your account, transactions, or the Services cannot be declined while you are a user.

International Data Transfers

The Services are operated from the British Virgin Islands. Your personal data may be transferred to, stored, and processed in countries other than the one in which you reside, including the United States, the European Union, and other jurisdictions in which our service providers operate. By using the Services and providing your personal data, you consent to its transfer to and storage in those jurisdictions, the laws of which may not be as protective as those of your own.

Children’s Privacy

The Services are not intended for, and we do not knowingly collect personal data from, children under the age of 18. If you believe we have collected information from a child, please contact [email protected] and we will take appropriate action.

Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page reflects the date of the most recent changes. Your continued use of the Services after an update constitutes acceptance of the revised Policy.

Contact

Agora Labs Ltd. (BVI), operator of Legion.
Privacy inquiries: [email protected]