Capital Dynamics Privacy Policy Effective June 2018 This Privacy Policy describes how we, Capital Dynamics, use the personal data that we collect or generate in the performance of our services. Please read this Privacy Policy carefully. By visiting our website or using any of our services, you indicate your agreement to our use of your personal data as set out in this Privacy Policy. Contact details Capital Dynamics Holding AG, whose registered office is at Bahnhofstrasse 22, 6301 Zug, Switzerland, and all of its subsidiaries, is committed to protecting the data of individuals in line with applicable local regulations, including if you are based in the EEA, the European Union s General Data Protection Regulations (GDPR). 1 Data we collect When we collect data We collect data when you use any of our services, become our client, or contact us whether that be in person, by telephone, by email or by mail. Why we collect data We may collect your personal data in order to provide products and services to you, depending on the product and service provided. What data we may collect and generate Your contact details, such as your name, address, telephone number and email address; Your date of birth, nationality, country of birth, country of residence, employment status and tax identification number; Passport details, driving license and utility bills; Details of the services you request or receive from us; Any records held by financial crime prevention agencies, on electoral registers and rolls, and by providers of utility services; Details of your employment status, income, assets and source of wealth; Information about your investments and your transactions with us; 1 If you are based in the United States, we are providing this notice under Regulation S-P, 17 C.F.R. 248.1-248.30 adopted by the United States Securities and Exchange Commission and Regulation P, 1 2 C.F.R. 1016 administered by the United States Consumer Financial Protection Bureau, pursuant to the privacy rules promulgated under Section 504 of the Gramm-Leach-Bliley Act of 1999. 1
Any personal data that you provide during your use of Capital Dynamics website, data rooms or investor portal, as well as personal data you provide during phone calls, in personal contact, email communications and other correspondence you may have with us; Information that we receive from you through subscription booklets and other documents related to a product or service; and We also collect data from you when you voluntarily complete customer surveys, respond to an event invitation, provide feedback or complete a contact form on our website, data rooms or investor portal. Cookies Our website makes use of cookies. Cookies are files which our server uses to identify your computer. Capital Dynamics uses cookies to understand site usage and to improve the content and offerings on our site. For example, we may use cookies to personalize your experience on our web pages and to provide you with better service. For more information on our use of cookies please see our cookie policy (https://www.capdyn.com/cookie-policy/). How we use your data Unless otherwise stated in this Privacy Policy, the legal basis for our use of your personal data will be one of the following: To allow clients to use and access Capital Dynamics services; To review and assess client/prospective client applications or contracts for Capitals Dynamics services and products; To undertake checks with fraud prevention agencies to enable us to comply with our anti-money laundering obligations and for the purposes of crime prevention and fraud prevention; To comply with our obligations arising from any contracts entered into between you and us and to provide you with the information, products and services that you request from us, or enable relevant service providers to assist us in doing so; To help protect your data and prevent unauthorized access to it; To deal with any queries, complaints or problems reported by you; To keep our records up to date; To maintain information technology (IT) systems in order to uphold service standards; To generate statistics relating to use of our website, such as the popularity of certain features or services. We do not use personally identifiable data for this purpose; To provide you with information about other services we offer that are similar to those that you have already engaged us to provide or enquired about. In such instances Capital Dynamics will only do so where we have received explicit consent from you to do so and for each separate method of communication. You may opt out of receiving this information at any time by contacting us using the contact details below; 2
If required to do so by law and to the extent necessary for the proper operation of our systems, to protect us/our clients, or for the enforcement of any agreement between you and us; To enable us to meet our regulatory obligations; To develop new products and services; To notify you of changes to our products and services; and To help improve the products and services we provide to you. How we protect your data We take appropriate security measures (including physical, electronic and procedural measures) to help protect the confidentiality, integrity and availability of your personal data from unauthorized access and disclosure. Who we disclose your data to We may disclose your personal data to: Businesses that are part of the same group of companies within Capital Dynamics, or that become part of that group; Our brokers, dealers, IT providers, contract counterparties, service providers, financing sources and agents engaged in order to provide and maintain the provision of products or services; Our auditors, accountants, lawyers and other professional advisers (e.g. compliance consultants), to the extent that they require access to the data in order to advise us; Fraud prevention agencies and other organizations to allow us to undertake the checks set out below; Providers of products or services we recommend. We may also be required to share data with auditors appointed by the providers of such products or services; Any relevant regulatory authority where they are entitled to request or require disclosure; Meet applicable law, the order of a court or market rules and codes of practice applicable to the circumstances at the time; Relevant tax, payment and customs authorities, who may pass this on to tax authorities in other jurisdictions. Some tax regulations require us to collect data about each client s tax residency; and Prospective sellers or buyers of businesses or assets in the event that we sell or buy any business or assets, as well as any financing sources utilized as part of the due diligence, in which case we may disclose your personal data. If all or substantially all of Capital Dynamics assets are acquired by a third party, personal data held by it about its clients may be one of the transferred assets. We will not share or sell your data to third parties (except as otherwise stated). 3
Data retention We are committed to keeping your personal data only for as long as we need to in order to fulfil the relevant purpose(s) for which it was collected, as set out in this notice, and for only as long as we are required or permitted to keep it by law or regulatory authority. Transferring data worldwide Capital Dynamics is a global asset manager with clients around the world and with global business operations. Personal data is collected on a global basis. We may store your personal data in any location globally and we may share your personal data with our service providers and this may involve transferring it to countries inside and outside the European Economic Area (EEA). Where we do so, we will ensure that it is protected and transferred in a manner consistent with legal requirements. We will take appropriate measures to ensure that the level of protection which applies to your personal data processed in these countries is equivalent to that which applies within the EEA. Such measures may include only transferring your data to jurisdictions in respect of which there is a European Commission adequacy decision or, where this is not the case, by using model clauses which have been approved by the European Commission. We may transfer your personal data between businesses that are part of the Capital Dynamics group of companies for the purposes of providing our services to you as follows: On the basis that the European Commission has approved that an adequate level of data protection applies to the country to which we send your personal data; On the basis that countries are authorized jurisdictions for the purposes of the relevant data protection legislation; and Between the European Union and the United States of America on the basis of the Privacy Shield. Your rights In all cases where we collect, use or store your personal data you may have the following rights based on your jurisdiction (unless exemptions apply) 2 which can be exercised by contacting us using the details provided below: To obtain information regarding the processing of your personal data and access to the personal data which we hold; To ask us not to process or restrict processing of your personal data in certain circumstances (there may be circumstances where we are required or entitled to refuse that request); 2 Depending on your jurisdiction, you may have some but not all of the rights noted. 4
To withdraw your consent to the processing of your personal data at any time (we may be entitled to process your personal data to comply with/satisfy legal and regulatory and/or internal audit requirements); To request that we rectify your personal data if it is inaccurate or incomplete; To request erasure of your personal data under certain circumstances (there may be circumstances where you have asked us to erase your personal data but we are required or entitled to retain it); In some circumstances, the right to receive your personal data, which you have provided to us, in a structured, commonly-used and machine-readable format and the right to transmit that data to another party without hindrance, or to have that personal data transmitted to another party, where technically feasible; To be informed about any use of your personal data to make automated decisions about you, and to obtain meaningful information about the logic involved, as well as the significance and the envisaged consequences of this processing; and To lodge a complaint with the relevant data privacy regulator if you think that any of your rights have been infringed by us. You may contact us in connection with any of the rights above and we may ask you to provide some additional information in order to verify your identity, such as your name, your address and proof of identity. Capital Dynamics Holding AG Bahnhofstrasse 22, 6301 Zug, Switzerland Privacy@Capdyn.com 5