Privacy Policy

1. Who we are

This website at theplanlabs.com and its subdomains (the “Website”) is published by THE PLAN Labs [REGISTERED ENTITY NAME & ADDRESS — TBC] (“THE PLAN Labs,” “we,” “us,” “our”). For the purposes of the UK and EU General Data Protection Regulation we are the data controller for the personal information described in this policy. For the purposes of the California Consumer Privacy Act we are a business.

THE PLAN is delivered through several separate companies. THEPLAN token is issued by The Plan Capital Group Ltd. (British Virgin Islands); THE PLAN Protocol is intended to be governed by a Cayman Islands foundation; THE PLAN educational courses are sold by BridgeGap Marketing, Inc. Each is a separate legal entity, and each is responsible for its own handling of personal information. This policy tells you what we do.

“Personal information” means information that identifies you or can reasonably be linked to you. Where a law that applies to you defines it more broadly — as the CCPA and the GDPR do — we use the broader meaning.

2. Information we collect

Information you give us

You can read almost all of the Website without telling us anything. You give us information when you choose to fill in a form or contact us. Depending on the form, that may include:

• Identifiers — your first and last name, email address, phone number and country.
• Your enquiry — the topics you tell us you are interested in, any message or question you write, and whether you consent to being called.
• Investor-status information — if you register interest in THEPLAN token, whether you tell us you consider yourself an accredited investor. This is a self-declaration you volunteer; it is not verification. See section 3.
• Event registrations — the details you give when you register for a webinar, roundtable or other event, which are also processed by the platform hosting that event under its own policy.
• Correspondence — anything you include when you email us or use our support desk.

If you would rather we did not hold this information, do not submit it. Participation is always your choice, and it is never required in order to read the Website.

Information collected automatically

When you visit the Website, our hosting and content-delivery providers automatically log basic technical information, including your IP address, the type of browser and device and operating system you use, the date, time and length of your visit, the pages you viewed, the site or link that referred you, and any error the server returned. We use this to run and secure the Website and to understand which pages are useful.

Where you reach us through a link we have created for a campaign, the page you land on records which link you used, so that we know which touchpoint your enquiry came from. This is stored alongside your enquiry as its source.

Our interest and registration pages hosted on our funnel platform at explore.theplanlabs.com use cookies and similar technologies, including for routing visitors by region and for measuring whether a form was completed. See section 12.

Information from other sources

We may receive information about you from event and webinar platforms you register through, from social and advertising platforms where you have interacted with our content, from our group companies, and from public sources such as a company website or a professional profile you have made public.

3. Financial information and accredited-investor verification

We do not ask for, and you should not send us, sensitive financial or identity information through this Website. Our forms never require a government identification number, a passport number, a bank account or payment card number, a wallet private key, or a password.

Any offering of a SAFT relating to THEPLAN token is made by The Plan Capital Group Ltd. as issuer, and under Rule 506(c) of Regulation D it may only be sold to investors whose accredited status has been verified. That verification is carried out by the issuer or its designated agent, not by us, through a separate process with its own privacy notice, and it is the point at which financial documentation would be requested. Registering interest on this Website is not part of that process and involves no obligation or commitment of any kind.

If you tell us you consider yourself an accredited investor, we record that self-declaration so that we know what information is appropriate to send you. We do not treat it as verification and we do not ask you to prove it here.

4. How we use your information

We use the information described above to:

• Respond to your enquiry, question or support request.
• Register your interest in THEPLAN token, and contact you about it — including passing your enquiry to The Plan Capital Group Ltd. where it concerns the proposed offering.
• Register you for, and communicate with you about, an event you signed up for.
• Send you the material you asked for, such as a white paper or an investor document.
• Send you updates and marketing about THE PLAN where you have asked for them or where we are otherwise permitted to (see section 6), and to decide what is relevant to send you.
• Understand how the Website is used, and improve its content, structure and performance.
• Measure which of our campaigns and touchpoints bring people to us.
• Keep records of consents, opt-ins and opt-outs, including the time, page and IP address of a submission, so that we can show we have handled your preferences correctly.
• Operate, secure and troubleshoot the Website, and prevent fraud, abuse and unauthorised access.
• Comply with law and with our regulatory and compliance obligations, and establish, exercise or defend legal claims.

We do not use your personal information to make decisions about you by automated means that produce legal or similarly significant effects.

5. Our legal bases

Where the UK or EU GDPR applies to you, we rely on the following legal bases:

• Your consent — for marketing emails and text messages where consent is required, and for non-essential cookies. You may withdraw consent at any time.
• Steps taken at your request before entering a contract, or performance of a contract — to respond to your enquiry and to send you what you asked for.
• Our legitimate interests — to run, secure and improve the Website, to understand which campaigns work, to communicate with people who have asked to hear from us, and to prevent fraud and abuse. We balance these against your rights and interests.
• Legal obligation — to keep records and to meet securities, anti-money-laundering, tax and other compliance requirements.

6. Marketing, email and text messages

If you have asked to hear from us, or have registered interest, we may send you email about THE PLAN, THEPLAN token, our events and our educational programmes.

You can stop at any time. Every marketing email carries an unsubscribe link and our postal address. You can also email support@contacttheplan.com and ask to be removed. We act on unsubscribe requests promptly; because messages already queued may still arrive, please allow a short period for the change to take effect.

Some messages are transactional rather than marketing — for example, confirming a registration or answering a question you asked. You cannot unsubscribe from those, though you can ask us to close your enquiry.

We send text messages or place calls only where you have given us your number and the consent required by law. To stop text messages, reply STOP. We keep an internal do-not-contact list and record the date, time and method of every opt-out. Where we call, we restrict calls to between 8:00 am and 9:00 pm in your local time.

7. Who we share information with

We share personal information only as described here.

• Service providers. Companies that run parts of the Website and our communications for us: website hosting and content delivery; form capture; customer-relationship and email-marketing platforms; the landing-page and funnel platform behind explore.theplanlabs.com; document-sharing services used to distribute the white paper and investor materials; event and webinar platforms; and our support desk. They may process your information only on our instructions and for the purpose we gave it to them, and they are bound by contract to protect it.
• Group companies. The Plan Capital Group Ltd., THE PLAN Foundation and our other affiliates, where your enquiry concerns something they are responsible for — in particular, where you register interest in THEPLAN token and the issuer needs to respond to you.
• Professional advisers. Our lawyers, accountants, auditors and compliance advisers, where they need it to advise us.
• Legal and regulatory disclosure. Courts, regulators, law-enforcement and other authorities, where we are required or permitted by law to disclose, including in response to a court order or subpoena.
• To prevent harm. Where we reasonably believe disclosure is necessary to protect the rights, property or safety of THE PLAN Labs, our users or anyone else, or to investigate fraud or a breach of our Terms of Use.
• Business transfer. If we, or substantially all of our assets, are involved in a merger, acquisition, reorganisation, financing or sale, personal information may be among the assets transferred. We will require the recipient to honour this policy.

8. We do not sell your personal information

We do not sell your personal information, and we have not sold it in the preceding twelve months. We do not share it for cross-context behavioural advertising, and we do not rent or trade it with data brokers or marketing list vendors.

9. International transfers

We and our service providers operate in more than one country, including the United States and the United Kingdom, and our group includes companies in the Cayman Islands and the British Virgin Islands. Your personal information may therefore be transferred to, stored in, or accessed from a country other than your own, including countries whose data-protection laws differ from those of your own.

Where we transfer personal information out of the UK or the European Economic Area to a country that has not received an adequacy decision, we do so using a transfer mechanism permitted by the GDPR, such as the European Commission’s standard contractual clauses together with the UK addendum, and we assess whether additional safeguards are needed. You can ask us for details using the contact information in section 17.

10. How long we keep it

We keep personal information for as long as we need it for the purpose we collected it, and then delete it or anonymise it.

• Enquiries and support correspondence — for as long as needed to deal with the enquiry and for a reasonable period afterwards for reference.
• Interest registrations and marketing contacts — until you unsubscribe or ask us to delete, and then only what we need to keep you suppressed from future mailings.
• Consent and opt-out records — for as long as we may need to demonstrate compliance.
• Technical logs — for a short period, unless retained longer for security or to investigate an incident.

We may keep information for longer where we are required to by law, or where it is needed to establish, exercise or defend a legal claim.

11. How we protect it

We maintain technical, organisational and administrative measures designed to protect personal information against loss, misuse and unauthorised access, consistent with accepted industry standards and applicable law. We limit access to those who need it, serve the Website over encrypted connections, and require our service providers to notify us promptly if they believe information we gave them has been compromised. We have incident-response procedures that we follow if we become aware of a compromise.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please do not send us sensitive financial or identity information by email or through our forms — see section 3.

12. Cookies and similar technologies

Cookies are small files placed on your device by a website; pixels, tags and web beacons work similarly.

theplanlabs.com is deliberately light. As at the date of this policy it does not run advertising pixels or third-party analytics, and does not set advertising or analytics cookies. It loads fonts from Google Fonts, which means your browser makes a request to Google’s servers when a page loads.

Our interest and registration pages at explore.theplanlabs.com are hosted on a third-party funnel platform which does use cookies and similar technologies — to keep your session, to route visitors by region, and to record whether a form was completed. Forms submitted from theplanlabs.com are delivered to a form-capture service operated by Google, which processes the submission under its own terms.

If we introduce analytics or advertising technologies to this Website, we will update this policy and, where the law requires it, ask for your consent first.

You can block or delete cookies through your browser settings; each browser is a little different, so check its help pages. Blocking cookies may stop some pages working properly. Where you enable a universal opt-out preference signal such as Global Privacy Control (GPC), we treat it as a request to opt out of any sale or sharing of personal information, as applicable law requires. Browsers also offer a “Do Not Track” setting; there is still no common standard for it, and we do not currently respond to it separately from GPC.

13. Your rights

Depending on where you live, you have some or all of the following rights over your personal information. We do not discriminate against anyone for exercising them.

• Access — to be told whether we hold information about you, and to receive a copy of it, together with the categories collected, the sources, the purposes, and the categories of recipient.
• Correction — to have inaccurate information corrected.
• Deletion — to have your information deleted.
• Portability — to receive information you gave us in a portable format, and where technically feasible to have it sent to another controller.
• Objection and restriction — to object to processing based on our legitimate interests, to object at any time to direct marketing, and to ask us to restrict processing in certain circumstances.
• Withdrawal of consent — to withdraw a consent you gave, at any time, without affecting processing already carried out.
• Opt out of sale, sharing and targeted advertising — we do none of these, but the right is yours to exercise and we will confirm our position to you.

How to exercise them

Email support@contacttheplan.com and tell us what you would like us to do. We may ask you to complete a short request form. Because we may only act on a request when we can verify who you are, we may ask you for information that lets us match you to our records; we use anything you give us for verification only. We respond within the time applicable law allows, and will tell you if we need longer or cannot fully comply and why. If we refuse a request, you may appeal by replying to our response, and we will review it.

Authorised agents. You may appoint someone to make a request for you. We will ask them to show your written authorisation or a power of attorney, and we may contact you directly to confirm. An agent may not use your information for any purpose other than making the request.

Additional information for particular regions

California. In the preceding twelve months we have collected the following categories of personal information under the CCPA: identifiers; personal information described in Cal. Civ. Code § 1798.80(e); commercial information; internet or other electronic network activity; geolocation data inferred from IP address at country level; and professional information. We collected it from you, from your device, from event and marketing platforms, and from our affiliates, for the business purposes described in section 4, and disclosed it for business purposes to the categories of recipient in section 7. We have not sold or shared personal information, and we do not knowingly collect or sell the personal information of anyone under 16.

United Kingdom and European Economic Area. If you are not satisfied with how we have handled your information or your request, you have the right to complain to your national data protection authority — in the UK, the Information Commissioner’s Office at ico.org.uk. We would appreciate the chance to address it first.

Other US states. Residents of Virginia, Colorado, Connecticut, Utah and other states with comprehensive privacy laws have broadly the rights listed above, including the right to appeal a refusal. Use the same contact details.

14. Children

The Website is intended for adults and is not directed at children. We do not knowingly collect personal information from anyone under 18. If we learn that someone under 18 has given us personal information, we will delete it and will not use it for any purpose. If you believe a child has submitted information to us, please contact support@contacttheplan.com and we will act on it.

15. Third-party sites and social media

Some links on the Website take you to a website operated by BridgeGap Marketing, Inc. — including the course pages and order pages for THE PLAN educational courses. Once you follow one of those links you are on that company’s website, anything you enter there is collected by it and not by us, and its privacy policy applies instead of this one.

The Website also links to other sites and platforms we do not control, and we maintain a presence on social platforms including LinkedIn, Facebook, YouTube and TikTok. We are not responsible for the content or the privacy practices of those platforms or of any site we link to. Anything you post publicly on a social platform is public and is not covered by this policy. Read their privacy policies, and use their own settings and controls to manage what they collect.

16. Changes to this policy

We may update this policy from time to time. When we do, we will change the “Last updated” date at the top of this page, and where a change is material we will take reasonable steps to bring it to your attention. Information we hold is subject to the policy in force at the time it was collected, unless you agree otherwise. The English-language version of this policy is the controlling version regardless of any translation.

17. Contacting us

For any question about this policy, about how we handle your information, or to exercise a right:

Email support@contacttheplan.com, or use our contact page.

Postal address: [REGISTERED ADDRESS — TBC]

Data protection contact: [DPO / EU-UK REPRESENTATIVE, IF REQUIRED — TBC]