Privacy Policy

This English translation is provided for convenience only. In the event of any discrepancy, the French version prevails.

Last updated: September 16, 2026

Introduction

Protecting your privacy and your personal data is of paramount importance to Katalyz.

This data protection policy (the “Policy”) applies to all users of the website www.katalyz.co/ and of the Katalyz platform (“you”, “your” or “yours”) and aims to inform you clearly and comprehensively about the processing of your personal data carried out by Katalyz, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the “GDPR”) and the French Data Protection Act (Loi Informatique et Libertés) No. 78-17 of 6 January 1978 in its latest version in force (together the “Applicable Regulations”).

For information purposes, personal data (“personal data”) means any information relating to an identified or identifiable natural person: an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

This Policy may be updated at any time, as a result of, among other things, legal, technical or business changes. We will inform you of any material change. We nevertheless recommend that you consult this Policy regularly in order to be aware of its latest version in force.

1. Who is the controller of your personal data?

Pantograph, a société par actions simplifiée (simplified joint-stock company), whose registered office is located at 14 rue Beffroy 92200 Neuilly-sur-Seine, France, registered with the Nanterre Trade and Companies Register (RCS) under number B 912 616 687 (“Katalyz” or “we”, “our”) is the controller of your personal data (that is, the entity that determines the purposes and means of the processing of your personal data) carried out through the website www.katalyz.co/ (the “Site”) and the Katalyz platform, which gives you access to the various solutions offered by Katalyz, including dealrooms (the “Platform”).

2. For what purposes and on what legal basis is personal data collected?

Katalyz ensures that it collects and processes personal data that is relevant, adequate, not excessive and strictly necessary in relation to the purposes pursued.

Below is a table setting out the relevant information on the processing of your personal data, and more specifically:

The various purposes pursued;
The personal data collected;
The legal basis on which we rely to carry out the processing; and
The period for which we retain your personal data.

Purposes of processing	Personal data collected	Legal basis for processing	Retention period
On the Site
Enabling you to access a demonstration of the features of the various services offered by Katalyz and assisting you with any questions you may have in that context.	At a minimum: Last name, first name, email address. Other data that may be collected: phone number, job title, company name, company size.	The performance of (pre-)contractual measures between Katalyz and you if you are negotiating the contract or are already a customer. The legitimate interest of Katalyz in promoting its services to business customers and prospects.	3 years following our last contact with you/the end of the contract entered into.
Storing your consent to the placement of cookies that are not strictly essential to the operation of the Site.	Information about the visitor’s consent, such as the date, their unique anonymous identifier, and whether or not they have already consented, as well as the list of cookies accepted by the visitor.	The legal obligation of Katalyz to respect the user’s choice regarding the placement of cookies.	The cookies placed have a lifetime of 12 months.
Carrying out anonymous statistical analyses of the Site’s performance in order to improve and optimize its features, its content and your browsing. For this purpose we place audience measurement cookies (see our Cookies Policy for more details).	User’s IP address, visitor identifier.	Your consent.	The cookies placed have a lifetime of 6 months.
Processing job applications submitted online on the Site (including where the Site redirects to another site for its recruitment section).	First name, last name, email address, current position, postal address, phone number, profile picture, link to a personal website and/or to professional social network profiles (LinkedIn, X) CV, educational and professional background, cover letter.	The performance of pre-contractual measures between you and Katalyz.	If you are not hired by Katalyz: If you consent, we retain your data for a period of 2 years from our last contact with you. Without your consent, the data is retained only for the duration of the recruitment process. In all cases, however, the data is archived for evidentiary purposes for a maximum period of 6 years. If you are hired by Katalyz : Your data is retained for 5 years from the end of your employment contract. Please refer to Katalyz’s internal policies in this regard.
On the Platform
Creating and managing your account (enabling you to access the Platform) and enabling the dealroom to function properly.	Email address, last name, first name, job title, phone, LinkedIn profile, link to a calendar.	Katalyz’s economic legitimate interest in providing access to the Platform in accordance with the contract signed with its customers.	When you create an account (including when you log in as a guest by receiving a magic link), your account information is retained until you close your account – it may nevertheless be deleted earlier in the event of inactivity (after 2 years). Please note that your identity data will nevertheless be retained even after your account is closed, until the dealroom is deleted, so that other users can properly view your past activities.
Enabling you to use the Platform and its various features.	Last name, first name, email address, job title, your activities and actions in a dealroom, the comments you post in a dealroom, the files you upload within a dealroom.	Katalyz’s economic legitimate interest in enabling use of the Platform in accordance with the contract signed with its customers.	Deletion at the request of the user or once the dealroom is deleted (in that case your data will remain accessible for 30 days so that you can retrieve it if you wish before permanent deletion).
Enabling you to use the Platform’s artificial intelligence features (dealroom content generation, summaries, scoring and recommendations).	The content you submit to these features: brief, attached files, selected meeting notes, content of the dealrooms concerned, as well as your last name, first name and email address as the user making the request.	Katalyz’s economic legitimate interest in enabling use of the Platform in accordance with the contract signed with its customers.	Content submitted to the artificial intelligence features follows the retention period of the dealroom to which it relates. It is not retained by the AI provider beyond the processing of the request and is not used to train its models.
Managing invoicing/accounting with customers.	Last name, first name, position held, contact details, services subscribed to.	Compliance by Katalyz with its legal obligations.	10 years following the end of the financial year.
Carrying out studies and statistics on the use of the Platform by the various users	Connection logs. Data relating to the device used to access and use the Platform: technical information about the characteristics and operating data of the user’s device, the carrier, the operating system, the device model, the IP address.	The legitimate interest of Katalyz in being able to provide its users with statistics and also in better understanding how users use the Platform.	6 months from the connection.
Enabling you to access the Platform (and to authenticate yourself) and to use the Platform’s various features through the placement of strictly necessary cookies.	Email address, email status (verified or not), internal user id, internal username, connection date.	The legitimate interest of Katalyz in being able to provide its users with a functional Platform.	The cookies placed have a lifetime of 12 months.
Other purposes applicable to the Site and the Platform
Sending you commercial information about our offers, events and services: unless you have objected, Katalyz may send you commercial emails at the email address you provided when creating your account or when subscribing to the newsletter.	Last name, first name, email address, position held, company.	The legitimate interest of Katalyz in promoting its services to business customers and prospects.	3 years following our last contact with you/the end of the contract entered into.
Conducting satisfaction surveys, taking your feedback on our services into account and creating commercial statistics/indicators, on the use of our services in order to improve them.	Last name, first name, information relating to the services subscribed to, your remarks and comments.	The legitimate interest of Katalyz, more specifically its commercial and economic interest in understanding customers’ expectations and improving its products and services accordingly.	2 years following the completion of the surveys and statistics.
Answering your questions and complaints (relating to the operation of the Site or the Platform and to the features offered by Katalyz’s various services)	Depending on the subject of your request: last name, first name, email address, phone number, billing address, services you have subscribed to, any other information you provide to us directly and voluntarily in connection with your request.	Depending on the subject of your request, the legal basis is either: - If your request is not related to a service already subscribed to with Katalyz: the legitimate interest of Katalyz, more specifically its economic interest in offering quality customer service/follow-up; - If your request is related to a service already subscribed to with Katalyz: The performance of the contract between you and Katalyz.	- If your request is not related to a product/service already purchased/subscribed to with Katalyz, we will retain your personal data for 5 years after the request is closed (except for very basic requests, for which your personal data will not be retained). - If your request is related to a product/service already purchased/subscribed to with Katalyz, we will retain your personal data for 5 years from the end of the contractual relationship.
Recording conversations in order to (i) train employees and improve service quality and (ii) respond to requests from customers wishing to keep a record of their exchanges.	Voice, image and any personal data communicated during the conversation.	Your consent.	6 months following the recording.
Managing any litigation or pre-litigation.	The nature of the data processed depends on the dispute, but it may potentially include any of the data listed in this table.	The legitimate interest of Katalyz in protecting and defending its rights and interests.	5 years after the end of the contractual relationship and/or until the end of the proceedings in the event of an ongoing dispute. Please note that all the retention periods identified in this table include the need to retain data for litigation management purposes (in which case the data is archived with restricted access as soon as it is no longer useful to Katalyz on a day-to-day basis/for the purpose pursued at the time of its collection).
Managing requests to exercise data subjects’ rights.	First name, last name, contact details, any other personal data covered by your request.	Compliance by Katalyz with its legal obligations.	Regarding proof of identity (if required): deleted once the request has been processed (it may nevertheless be retained for longer, for 6 years from the closing of the request, if there is a high risk of litigation). Regarding the data collected to manage the request: until the handling/closing of the request. Regarding the response provided to you: 6 years from the closing of the request. Please note that if your request concerns the deletion of your data / objection to its processing in connection with our marketing activities, we will retain your data for 5 years in order to keep our objection list up to date.
Managing a merger, acquisition or any other financial transaction involving all or part of Katalyz.	The nature of the data processed depends on the financial transaction envisaged, but it may potentially include any of the data listed in this table.	The legitimate interest of Katalyz, more specifically its commercial and economic interest in carrying out a financial transaction.	Data processed from the performance of the due diligence until the end of the financial transaction envisaged.

3. Is providing your personal data mandatory?

Whether or not providing your personal data to Katalyz is mandatory will be indicated to you at the time of collection (for example by an asterisk). If you do not provide the personal data identified as mandatory, Katalyz will not be able to respond to your request and/or provide you with the services requested.

You may enter third parties’ personal data when using the Platform’s various features (namely the email addresses of those invited to a dealroom and the identifying data contained in documents uploaded to the dealroom). By entering such personal data into the Platform, you acknowledge that you have collected, processed and transferred such data lawfully and that you have properly informed the data subjects of the transmission of their personal data to Katalyz.

4. To whom do we disclose your personal data?

Katalyz undertakes to share your personal data only in certain circumstances and in accordance with the provisions of the Applicable Regulations. Katalyz therefore discloses your personal data only to identified, duly authorized recipients, as described below. All recipients who process your personal data are subject to confidentiality obligations.

Accordingly, Katalyz transmits your personal data:

- To authorized internal personnel who need to process your personal data for the purposes specified in section 2 of this Policy and, more specifically, to:

the marketing, sales and customer service teams

the product and technical teams

- To external recipients of Katalyz, in particular:

To public authorities and bodies to which we must disclose some of your personal data in order to comply with legal obligations, or to protect the rights and/or safety of Katalyz or of an individual;
To Katalyz’s third-party service providers, in particular:

List of processors last updated: September 16, 2026

AWS for hosting personal data and managing user accounts;
Webflow for developing the Site;
Google Analytics for audience measurement on the Site;
Hubspot for CRM management;
Claap for recording interactions with prospects and customers;
Lemlist and Phantombuster for sales prospecting;
Harvestr, Notion and Jira for collecting and managing customer feedback;
Dropcontact and Kaspr for updating and enriching your data;
Slack, Google and WhatsApp for communicating internally and with you;
OpenAI (OpenAI Ireland Ltd) for the Platform’s artificial intelligence features;
Sentry for monitoring and diagnosing technical errors;
Sparkpost EU (Messagebird) for delivering transactional emails;
Nylas – email/calendar integration gateway enabling emails to be sent and events to be created/managed on behalf of your account, according to the permissions you grant.
Google – email and calendar service provider when you connect your Google account to use the email and/or calendar features in Katalyz.

Google integrations (Gmail/Calendar) - Compliance with the “Google API Services – User Data Policy (Limited Use)”
When you connect your Google account to use the email and/or calendar features in Katalyz, we access only the data strictly necessary to: (i) compose and send the emails you initiate from the Platform and handle their technical follow-up (delivery, errors); (ii) create, update and cancel the calendar events you ask us to manage, and synchronize the required fields (title, description, times, participants, status); (iii) authenticate your account via OAuth and manage the corresponding tokens.

We do not use this data for advertising, standalone marketing profiling or resale to third parties. We do not continuously read your entire mailbox. Our use of Google data complies with the Google API Services User Data Policy, including the Limited Use requirements.

You may revoke Katalyz’s access to your Google account at any time from your Google security settings and/or from the Katalyz Platform.

To authorized persons who are members of a dealroom on the Platform: the following persons may have access, depending on their permissions, to the data entered in the dealrooms of which they are members:

The customer account administrator;
The creator of a dealroom;
The users of a dealroom.

In addition, your personal data may be shared with third parties for the following reasons:

In connection with a merger or acquisition of all or part of Katalyz by a third party, or in the event of a sale, transfer or restructuring; or
In response to judicial or administrative proceedings of any kind or to law enforcement measures requested by the competent authorities.

5. How does Katalyz protect your personal data?

Katalyz implements rigorous technical and organizational measures to ensure the security and confidentiality of the personal data it processes, including where such data may be considered sensitive within the meaning of Regulation (EU) 2016/679 (GDPR).

What technical measures are in place?

‍
Data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256).

Servers are hosted on certified infrastructure (AWS – eu-west-3, France) with secure backups and redundancy.
Access is strictly controlled according to the principle of least privilege: only authorized staff may access environments containing personal data.
Access and actions are logged and monitored to detect any anomaly.
Security audits and tests are carried out regularly in order to identify and fix vulnerabilities.

What organizational measures are in place?

All staff are subject to internal security policies and receive regular data protection training.
Katalyz has an incident management plan and a notification procedure in the event of a personal data breach.
Processors are contractually required to apply equivalent security safeguards and may process data only for strictly defined purposes.

Does Katalyz process sensitive data?

Katalyz does not collect special categories of data (political opinions, health data, etc.). However, should any data processed be considered sensitive, it would benefit from the enhanced protections described above.

6. Do we transfer your personal data outside the European Economic Area?

Your personal data may be transferred to countries located outside the European Economic Area that are not covered by an adequacy decision of the European Commission (list available here), and more specifically to the following countries:

- United States of America.

When your personal data is transferred to one of these countries, Katalyz undertakes to ensure an adequate level of protection by means of the following appropriate safeguards and measures:

Participation in the EU–U.S. Data Privacy Framework (DPF); or
execution of the European Commission’s standard contractual clauses
‍

Transfers to the United States of America may include the services of Nylas, Google and OpenAI, L.L.C. Katalyz ensures an adequate level of protection through participation in the EU–U.S. Data Privacy Framework (where applicable) and/or the execution of the European Commission’s Standard Contractual Clauses of 4 June 2021 (Module 2), together with appropriate supplementary measures. With regard to OpenAI, these transfers are governed by a data processing agreement entered into between Katalyz and OpenAI Ireland Ltd on 30 December 2024. You may obtain a copy of these safeguards by contacting us (see Section 7).

You may obtain a copy of these safeguards at any time by contacting Katalyz using the contact details and in the manner set out in section 7 of this Policy.

7. What are your rights over your personal data?

In accordance with the Applicable Regulations, you have the following rights over your personal data:

If your personal data has been processed on the basis of your consent, you are entitled to withdraw your consent at any time, without affecting the processing carried out before the withdrawal (see the table in section 2 of this Policy for the processing operations based on your consent).
You have the right to access the personal data we hold about you (provided that the request is not manifestly unfounded or excessive, in particular because of its repetitive character), and to obtain a copy of it.
You may request the rectification of your personal data if it is inaccurate or out of date and/or request that it be completed (provided that the request is not manifestly unfounded or excessive, in particular because of its repetitive character). If you have an account, it may be easier to change your own data via the “My Account” feature.
You may request that your personal data be erased. This is not, however, an absolute right, insofar as we may be required to retain your personal data for legal or legitimate reasons.

You may exercise your right to erasure in the following cases: if you have validly objected to the processing of your personal data (see the box below) or have withdrawn your consent, where the personal data is not or is no longer necessary in relation to the purposes for which it was originally collected, or where the personal data is being processed unlawfully by us.

You may request the restriction of processing. This right means that the processing of personal data concerning you that we carry out is restricted, so that we may store that data but may not use or process it.

This right applies in specific circumstances, namely (i) if you contest the accuracy of your personal data: processing is then restricted for a period enabling Katalyz to verify the accuracy of the data; (ii) where the processing is unlawful and you oppose the erasure of your personal data and request the restriction of its use instead; (iii) where we no longer need the personal data for the purposes mentioned above in section 2, but it is still required by us for the establishment, exercise or defense of legal claims; and (iv) where you have objected to processing based on the legitimate interests pursued by Katalyz, you may request that processing be restricted for the period necessary to determine whether we can act on your objection.

You have the right to data portability: you have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format. This applies only where the processing of your data is based on your consent or on the performance of a contract with Katalyz (see the table in section 2 of this Policy for the processing operations based on these legal bases).
You also have the right to give us instructions regarding what happens to your personal data after your death.

You may object to the processing of your data.

Where we process your personal data on the basis of Katalyz’s legitimate interests (see the table in section 2 of this Policy for the processing operations based on Katalyz’s legitimate interests), you may at any time object to the processing of your personal data on grounds relating to your particular situation, unless we demonstrate compelling legitimate grounds requiring the continued processing of such data or where such data is necessary for the establishment, exercise or defense of legal claims.

You may also object at any time to receiving our commercial communications (i) by clicking on the link in the footer of those communications or (ii) by sending a message to the contact details set out below.

Finally, you have the right to lodge a complaint with the Commission nationale de l’informatique et des libertés, the French data protection authority (hereinafter the “CNIL”). We nevertheless invite you to contact Katalyz using the contact details set out below before lodging any complaint with the CNIL.

To exercise any of these rights, you may send a request by post to the following address: 14 rue Beffroy, 92200 Neuilly-sur-Seine, France, or by email to: privacy@katalyz.co.

8. How to contact us?

For any questions, complaints or comments concerning this Policy or our personal data protection practices, please contact us by writing to the following postal address: 14 rue Beffroy, 92200 Neuilly-sur-Seine, France, or by sending an email to: privacy@katalyz.co.