Last updated: October 5, 2026
This Privacy Policy describes how Cocoanut Row Capital Partners, LLC (the "firm") handles personal information collected through the website located at www.cocoanutcapital.com (the "site"). The firm is a Delaware limited liability company with offices at 230 Sunrise Ave, Palm Beach, Florida 33480, United States, and is the controller of personal information collected through the site.
Inquiries regarding this policy may be directed to introductions@cocoanutcapital.com.
The site collects personal information only when a visitor voluntarily submits it. Two collection points exist:
Introduction request form. Submitted through the Request Access page. Information collected consists of the submitter's name, email address, professional context, the name of the referrer, the submitter's stated relationship to the referrer, a self-attestation as to accredited-investor status, a stated range of investment appetite, and a brief free-text note on the submitter's interest.
Non-disclosure agreement execution. Submitted through the NDA page. Information collected consists of the signer's full legal name, email address, title or capacity, firm or entity (if signing on behalf of one), typed signature, and an electronic-signature affirmation. The firm additionally records server-side audit metadata as described below.
Server logs. The site's hosting provider records ordinary server logs (IP address, timestamp, requested URL, referring URL, user agent) for the purposes of security, rate limiting, and operational diagnostics. For NDA submissions specifically, the firm retains these metadata fields as part of the electronic-signature audit record, as required to demonstrate the validity of the signature under the U.S. Electronic Signatures in Global and National Commerce Act (ESIGN) and applicable state law.
Personal information submitted through the introduction request form is used to evaluate the prospective relationship, respond to the submitter, and maintain a record of the firm's pre-existing relationships for purposes of the exemption from registration described in the firm's Regulatory Disclosures. The firm maintains this record in an internal customer-relationship system accessible only to the firm's principals and authorized staff.
Personal information submitted through the NDA page is used to execute the firm's Mutual Non-Disclosure Agreement electronically, to deliver the executed agreement to the signer and retain a copy for the firm, and to maintain an audit record of the execution sufficient to demonstrate validity.
The firm does not use personal information collected through the site for marketing, does not sell or rent personal information to any third party, does not add personal information to any mailing list, and does not use personal information to train any machine-learning or generative model.
Server logs are used for security and operational purposes only, except for NDA audit metadata as described in Section 2.
The site uses a single session-scoped record to remember that the visitor has acknowledged the landing gateway, so that the gateway is not re-displayed on every page load within the same browser session. This record is cleared automatically when the browser session ends.
The site does not use third-party analytics, advertising cookies, or tracking pixels.
The site relies on a select group of third-party service providers, each engaged under its own terms of service and privacy policy. Each is bound by a written agreement with the firm and processes personal information only as necessary to provide the stated service:
Cloudflare, Inc. (San Francisco, California) — provides hosting, content delivery, and serverless compute (Cloudflare Workers) for the site; receives and stores introduction requests submitted through the site (Cloudflare D1); protects the introduction form against automated submissions (Cloudflare Turnstile); and stores the NDA execution audit log (Cloudflare KV).
Resend, Inc. (San Francisco, California) — sends transactional emails from the firm, including the executed NDA delivery email.
Attio Ltd. (London, United Kingdom) — hosts the firm's customer-relationship management system, into which introduction requests are recorded.
Links to each vendor's privacy policy are available on request. The firm does not use any third-party analytics, advertising, social-media, or marketing service.
Introduction requests. Submissions that do not advance into a more substantive relationship are purged from the firm's records, including its customer-relationship system, after one (1) year. Submissions from persons with whom the firm establishes an ongoing relationship are retained for the duration of the relationship and for seven (7) years thereafter, consistent with the firm's record-retention obligations under United States securities law.
Executed Non-Disclosure Agreements. Retained for the term of the Agreement plus seven (7) years thereafter. The audit metadata associated with the execution is retained for the same period.
Server logs. Retained for a rolling period not exceeding ninety (90) days, after which they are automatically purged, except in cases of active investigation of a specific security or operational matter.
The firm honors privacy rights afforded to individuals under applicable law. Depending on the jurisdiction in which you are located, you may have some or all of the following rights in respect of personal information the firm holds about you:
Access. To request confirmation that the firm processes personal information about you, and to receive a copy of that information.
Correction. To request correction of inaccurate or incomplete personal information.
Deletion. To request deletion of personal information the firm holds about you, subject to exceptions where retention is required by law, by contract, or for the establishment or defense of legal claims.
Portability. To receive a copy of personal information you have provided to the firm in a structured, commonly used, machine-readable format.
Objection and restriction. To object to, or request restriction of, certain processing of your personal information.
Withdrawal of consent. Where processing is based on your consent, to withdraw that consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.
Opt-out of sale or sharing. The firm does not sell or share personal information, as those terms are defined under the California Consumer Privacy Act (as amended by the California Privacy Rights Act). No opt-out is therefore necessary, and the firm does not maintain a "Do Not Sell or Share My Personal Information" interface.
Non-discrimination. The firm will not discriminate against you for exercising any of the above rights.
Complaint to a regulator. European Economic Area, United Kingdom, and Swiss residents have the right to lodge a complaint with their national data protection authority. California residents may contact the California Privacy Protection Agency. Florida residents may contact the Florida Department of Legal Affairs.
Requests may be submitted by email to introductions@cocoanutcapital.com with the subject line Privacy request. The firm will acknowledge a request within ten (10) business days and respond substantively within thirty (30) days, or within any longer period required or permitted by applicable law. To protect your information, the firm will verify your identity before responding to a request, typically by confirming details already held about you; additional verification steps may be required for sensitive requests. Requests from authorized agents must include reasonable proof of the agent's authority to act on your behalf.
Controller. The firm (Cocoanut Row Capital Partners, LLC) is the controller of the personal information it collects through the site.
Lawful bases. The firm processes personal information on the following lawful bases under Article 6 of the General Data Protection Regulation and the equivalent provisions of the UK GDPR and the Swiss Federal Act on Data Protection (nFADP): (a) where you have requested the firm take steps at your request prior to entering into a relationship (Art. 6(1)(b)); (b) where processing is necessary for the firm's legitimate interests in evaluating prospective counterparties, maintaining pre-existing relationship records required for exemption from securities registration, and operating the site securely (Art. 6(1)(f)); (c) where processing is necessary for compliance with a legal obligation to which the firm is subject, including record-retention obligations under United States securities law (Art. 6(1)(c)); and (d) where you have given your consent, such as in executing an electronic signature (Art. 6(1)(a)).
Automated decision-making. The firm does not subject personal information collected through the site to automated decision-making that produces legal or similarly significant effects.
The firm's principal place of business, and the locations of its primary service providers (Cloudflare, Resend, Attio), are outside the European Economic Area, United Kingdom, and Switzerland. Where personal information of a resident of any of those regions is transferred to the United States or otherwise processed outside its country of origin, the firm relies on the following safeguards, as applicable:
Adequacy decisions. Where a formal adequacy decision issued by the European Commission, the United Kingdom government, or the Swiss Federal Council applies to the destination country or the specific recipient, the firm relies upon that decision. This includes reliance on the EU–U.S. Data Privacy Framework, the UK Extension to the Data Privacy Framework, and the Swiss–U.S. Data Privacy Framework, to the extent the recipient is certified under the applicable Framework.
Standard Contractual Clauses. Where an adequacy decision does not apply, the firm implements the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), the UK International Data Transfer Addendum, and the Swiss equivalents, as appropriate, with each recipient, together with any supplementary technical and organizational measures required by law.
Derogations. In limited circumstances the firm may rely on the specific derogations set out in Article 49 of the GDPR (and the equivalent provisions of the UK GDPR and nFADP), including where a transfer is necessary for the performance of a contract with you, at your request, or for the establishment, exercise, or defense of legal claims.
A copy of the specific safeguards applied to any transfer of your personal information is available on request to introductions@cocoanutcapital.com.
The firm takes commercially reasonable steps to protect personal information against unauthorized access, disclosure, alteration, or destruction. No system is perfectly secure, however, and the firm cannot guarantee the absolute security of any information transmitted to or stored on the site.
The firm may update this Privacy Policy from time to time. Material changes will be indicated by a revised date at the top of the page. Earlier editions of this policy are retained in the firm's records and available on request.
Questions about this Privacy Policy, or about the firm's handling of personal information, may be directed to introductions@cocoanutcapital.com, or by post to Cocoanut Row Capital Partners, LLC, 230 Sunrise Ave, Palm Beach, FL 33480, United States, marked Privacy.