Dataroom privacy notice

This notice applies only to the private C3 investor dataroom at dataroom.cthree.cloud. It explains the limited information recorded when invited recipients access and review fundraising materials.

Who is responsible

Cambridge Compute Company Limited (company number 16414418), trading as C3, operates this dataroom and is responsible for the personal information described below. Its registered office is 9 Regent Terrace, Cambridge, England, CB2 1AA. Questions can be sent to team@cthree.cloud.

Information recorded

When you use the dataroom, we may record:

• the email address you enter and whether access succeeds;
• the documents, pages and sections you view, links or buttons you select, and active viewing time;
• timestamps, referrer, browser and device information, viewport size and a random session identifier; and
• a one-way hash derived from the requesting IP address. The raw IP address is not retained in the dataroom analytics record.

We record a short label identifying the access-code cohort, but not the full access code.

Why we use it

We use this information to control and investigate access to confidential materials, understand engagement during the fundraising process, plan appropriate follow-up, and operate and troubleshoot the dataroom. We rely on our legitimate interests in securing the materials and managing a focused investor diligence process.

Session cookie

After a successful login, the dataroom sets an essential signed session cookie so that you can move between authorised documents. It contains your email address, a random session identifier, issue and expiry times, and any document-access scope. It does not contain the access code and expires after 14 days. We do not use advertising or marketing cookies in the dataroom.

Service providers and transfers

Access is limited to authorised C3 personnel and service providers used to host the dataroom and store its access analytics, currently Vercel and Upstash. These providers may process information outside the UK under their applicable contractual safeguards. We do not sell this information or share it for advertising.

How long we keep it

Identifiable access and engagement records are kept while the fundraising and related diligence process is active and are reviewed for deletion or anonymisation when they are no longer needed. They will normally be retained for no more than 12 months after your last dataroom activity, unless a longer period is reasonably required for security, legal claims or another legal obligation. Aggregated or anonymised statistics may be kept for longer.

Your choices and rights

You can choose not to use the dataroom and ask for materials through your C3 contact instead. Depending on the circumstances, you may also ask for access to, correction or deletion of your information, or object to its use. Contact team@cthree.cloud to make a request.

You may also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint.