:

MAGNATRA CAPITAL LLCPRIVACY POLICY

Effective Date: October 1, 2019 Last Updated: May 11, 2026

1. Overview

Magnatra Capital LLC ("Magnatra," "we," "us," or "our") is a business advisory, private credit, and financial services firm providing payment processing advisory, business funding facilitation, government contract consulting, and related services. We are committed to protecting the privacy and security of all information entrusted to us by our clients and prospective clients.

This Privacy Policy explains what information we collect, how we use and protect it, how it flows through our service delivery process, and your rights regarding that information. It applies to all information submitted through our Business Analysis Form at analysis.magnatracapital.com, our DocuSign application process, and any other Magnatra service engagement.

By submitting information to Magnatra Capital LLC — through our Business Analysis Form, DocuSign applications, or any other channel — you acknowledge that you have read, understood, and agreed to this Privacy Policy.

2. Information We Collect

2.1 Business Analysis Information

When you complete our Business Analysis Form at analysis.magnatracapital.com, you voluntarily provide business performance and operational information including revenue, margins, processing volume, operational systems, compliance status, and growth objectives. This information is used solely to generate your business analysis and service recommendations.

2.2 Application Information — Funding and Payment Processing

When you engage Magnatra to facilitate a funding application or payment processing setup, we collect application information through DocuSign — a federally recognized, encrypted electronic signature platform. Application information may include: legal business name, address, and entity information; business owner names, addresses, and dates of birth; Social Security Numbers (SSNs) of business owners with 25% or greater ownership interest; bank account numbers and routing numbers provided via voided check or bank letter; business financial statements, tax returns, and bank statements; processing history and merchant account information; and government-issued identification documents.

Important — How This Information Is Handled: Sensitive information including SSNs and bank account numbers is collected exclusively through DocuSign's encrypted electronic signature platform. Magnatra reviews completed applications to verify accuracy and completeness, then uploads the application file directly to the applicable underwriting portal (lender or payment processor). Magnatra does not maintain an independent database of SSNs or bank account numbers outside of the DocuSign document and underwriting portal submission.

2.3 What We Do NOT Collect

Through our standard processes, we do not collect credit or debit card numbers, personal health or medical information, passwords or login credentials for any system, or information from minors under the age of 18.

3. How We Use Your Information

3.1 Business Analysis and Advisory

Information submitted through our Business Analysis Form is used exclusively to analyze your business across financial, operational, compliance, growth, and technology dimensions; generate a personalized business performance score and service recommendations; prepare and deliver tailored advisory recommendations from Magnatra's service lines; and contact you with your completed analysis and recommended next steps.

3.2 Funding Application Facilitation

Application information collected through DocuSign for funding purposes is used to prepare and review your funding application for accuracy and completeness, submit your completed application to lenders or capital providers on your behalf, and communicate application status and decisions to you. SSNs are required by lenders for identity verification, credit authorization, and underwriting as mandated by federal lending regulations.

3.3 Payment Processing Application Facilitation

Application information collected through DocuSign for payment processing purposes is used to prepare and review your merchant account application for accuracy and completeness, submit your completed application to acquiring banks and payment processors on your behalf, and communicate application status and approval decisions to you. SSNs are required by processors and acquiring banks for ownership verification and AML compliance as mandated by card network rules and federal regulations.

3.4 Client Communications

We use your contact information to respond to your inquiries, provide service updates, and communicate information relevant to your active engagements with Magnatra.

4. How Your Information Flows — The Process

Step 1 — Business Analysis Form: You complete the Business Analysis Form at analysis.magnatracapital.com. This form collects business performance information only — no SSNs or bank information. Responses are transmitted securely via Netlify to our team at sales@magnatracapital.com.

Step 2 — DocuSign Application: If you proceed with a funding or processing engagement, Magnatra sends you a DocuSign application package. You complete the application — including sensitive fields such as SSN and bank information — directly within DocuSign's encrypted platform. DocuSign encrypts all documents in transit and at rest using AES-256 encryption.

Step 3 — Magnatra Review: Upon completion, Magnatra reviews the signed DocuSign document to verify that all required fields are accurately and completely filled in. This review is conducted by authorized Magnatra personnel only for quality assurance purposes — ensuring your application is complete before submission to avoid delays or rejection.

Step 4 — Underwriting Portal Submission: Once reviewed and verified, Magnatra uploads your completed application file directly to the applicable underwriting portal — the lender's or payment processor's secure submission system. From this point, the underwriting institution takes custody of your application and information. Magnatra does not retain an independent copy of your SSN or bank account numbers outside of the DocuSign document.

Step 5 — Decision and Follow-Up: Magnatra receives the underwriting decision from the lender or processor and communicates that decision to you along with any next steps required to complete the engagement.

5. What We Do NOT Do With Your Information

Magnatra Capital LLC makes the following firm commitments: We do not sell your personal information — including SSNs or bank account numbers — to any third party under any circumstances. We do not rent, lease, or license your personal information to marketers, data brokers, or any other third party. We do not use your SSN or bank information for any purpose other than facilitating the specific application you authorized. We do not share your information with other businesses for their own marketing or solicitation purposes. We do not transmit SSNs or bank information via unsecured channels — all sensitive data moves exclusively through DocuSign or secure underwriting portals. We do not maintain an independent database of client SSNs or bank account numbers. We do not publish, post, or make your sensitive information publicly available in any form.

6. Authorized Information Sharing

6.1 Lenders and Capital Providers

With your authorization, your completed funding application — including SSN and bank information — is submitted to lenders or capital providers for underwriting. These institutions are regulated financial entities subject to federal privacy and security requirements including GLBA, BSA, and applicable banking regulations.

6.2 Payment Processing Partners

With your authorization, your completed merchant account application — including SSN — is submitted to acquiring banks and payment processors for underwriting. These institutions are regulated by card networks and subject to PCI DSS, banking regulations, and applicable federal law.

6.3 DocuSign

DocuSign, Inc. provides the electronic signature and document management platform through which application information is collected and stored. DocuSign processes your information as a data processor on Magnatra's behalf, subject to strict contractual data protection obligations. DocuSign is certified under ISO 27001, SOC 1 Type 2, SOC 2 Type 2, and complies with GDPR and CCPA. DocuSign's privacy policy is available at docusign.com/privacy.

6.4 Netlify (Business Analysis Form Only)

Netlify, Inc. hosts our Business Analysis Form and processes form submissions to deliver responses to our team. Netlify receives business performance information only — no SSNs or bank information pass through Netlify. Netlify's privacy policy is available at netlify.com/privacy.

6.5 Legal Requirements

We may disclose your information if required by applicable law, court order, subpoena, or regulatory requirement. We will notify you of such disclosure to the extent permitted by law. In all other circumstances, your information is not shared with any party without your explicit prior written consent.

7. Data Security

Magnatra Capital LLC implements the following measures to protect your information: All sensitive application data including SSNs and bank information is collected exclusively through DocuSign, which uses AES-256 encryption for documents in transit and at rest. HTTPS encryption (TLS) is used for all data transmitted through our Business Analysis Form and website. Access controls limit who within Magnatra can access sensitive application documents. Completed applications are uploaded to underwriting portals using the portal's own secure submission system. Magnatra personnel authorized to review applications are limited and subject to confidentiality obligations. In the event of a data breach that may affect your personal information, Magnatra Capital LLC will notify affected individuals as required by applicable federal and state breach notification laws.

8. Data Retention

Business Analysis Form responses are retained for up to 3 years from date of submission or for the duration of an active service engagement, whichever is longer. DocuSign application documents are retained within DocuSign's platform for the period required by applicable law and lender or processor requirements, typically 5–7 years. Underwriting portal submissions are retained by the lender or payment processor in accordance with their own retention policies and applicable regulatory requirements. Magnatra does not independently retain copies of SSNs or bank account numbers beyond what is contained in the DocuSign document.

9. Gramm-Leach-Bliley Act (GLBA) — Financial Privacy Notice

Because Magnatra Capital LLC facilitates financial products and services including business funding and payment processing, we provide this notice in compliance with the Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.). We collect information you provide on applications and through our Business Analysis Form, including business financial information, SSNs, and bank information as described in Section 2. We share your information only with lenders, capital providers, and payment processors to facilitate the services you have requested. We do not share your information with any third party for marketing purposes. You have the right to opt out of sharing your personal financial information with non-affiliated third parties for purposes other than completing your requested services. To exercise this right, contact us at sales@magnatracapital.com with the subject line "GLBA Opt-Out Request."

10. California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have the right to know what personal information we have collected and how it has been shared; request deletion of your personal information subject to legal retention obligations; request correction of inaccurate information; limit our use of sensitive personal information including SSNs to the stated purposes described in this Policy; opt out of the sale of your personal information — Magnatra does NOT sell personal information and no opt-out action is required; and be free from discrimination for exercising your privacy rights. To exercise your California rights, contact us at sales@magnatracapital.com with the subject line "CCPA Privacy Request." We will respond within 45 days.

11. European Privacy Rights (GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the right to access a copy of your personal data; request correction of inaccurate data; request erasure of your data where no legal basis exists for continued processing; request restriction of processing; receive your data in a portable, machine-readable format; object to processing based on legitimate interests; and withdraw consent at any time without affecting prior lawful processing. Our legal basis for processing includes your explicit consent obtained via DocuSign signature and our form consent checkbox, and contractual necessity to perform the services you have requested. To exercise your GDPR rights, contact us at sales@magnatracapital.com with the subject line "GDPR Privacy Request." We will respond within 30 days. You also have the right to lodge a complaint with your local data protection supervisory authority.

12. Your Rights and Choices

Regardless of your location, you have the right to request a copy of the personal information Magnatra holds about you; request correction of inaccurate information; request deletion of your Business Analysis Form data subject to legal retention requirements; withdraw consent for processing — note that withdrawal after an application has been submitted to underwriting may not be reversible; and opt out of non-essential communications from Magnatra at any time. To exercise any of these rights, contact: Magnatra Capital LLC, Email: sales@magnatracapital.com, Subject Line: "Privacy Request," Website: magnatracapital.com.

13. Third-Party Platform Privacy Policies

Magnatra uses the following third-party platforms in the course of our services. DocuSign, Inc. provides electronic signature and encrypted document collection — privacy policy available at docusign.com/privacy — certified under ISO 27001, SOC 1 Type 2, SOC 2 Type 2, and compliant with GDPR and CCPA. Netlify, Inc. hosts our Business Analysis Form — privacy policy available at netlify.com/privacy. Each lender and payment processor maintains its own privacy policy governing information submitted through their portals. Magnatra is not responsible for the privacy practices of third-party platforms beyond our contractual agreements with them.

14. Children's Privacy

Our services are intended for business owners and are not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a minor, please contact us immediately at sales@magnatracapital.com.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, technology, or applicable law. Material changes will be indicated by an updated "Last Updated" date at the top of this Policy. Continued use of our services after a change to this Policy constitutes acceptance of the updated terms.

16. Contact Us

For questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us at: Magnatra Capital LLC, Email: sales@magnatracapital.com, Website: magnatracapital.com, Business Analysis Form: analysis.magnatracapital.com. Use the subject line "Privacy Request" for general inquiries, "CCPA Privacy Request" for California residents, "GDPR Privacy Request" for EEA/UK/Switzerland residents, "GLBA Opt-Out Request" for financial information sharing opt-out, or "Data Security Concern" for security-related matters.

This Privacy Policy is intended to address compliance obligations under the Gramm-Leach-Bliley Act (GLBA), FTC Safeguards Rule, California Consumer Privacy Act (CCPA), California Privacy Rights Act (CPRA), General Data Protection Regulation (GDPR), Bank Secrecy Act (BSA), FinCEN beneficial ownership regulations, and applicable state privacy and breach notification laws. This document does not constitute legal advice. Magnatra Capital LLC recommends periodic review with qualified legal counsel.

© 2026 Magnatra Capital LLC. All rights reserved. Without Recourse.