Privacy Policy

We take your privacy very seriously and treat your personal data with respect, while we process any information collected in relation to our activity sector.

WHO WE ARE

This notice sets out how members of the Centralis group (collectively and individually, "Centralis", "we" or "us") will process personal information as a controller in connection with the:

• provision of its services from within the EEA;

• provision or offering services to you if you are an individual located in the EEA;

• marketing of Centralis services conducted by Centralis;

• regulatory obligations of Centralis, including know-your-customer and anti-money laundering ("KYC/AML");

• management and operation of our businesses and websites; or

• management and operation of our properties and premises.

The entity which shall be deemed controller of your personal data is as per the applicable entity in the final section of this notice "Centralis Entities".

In this notice, "you" means:

• a user of our website Centralis Group or our apps or an individual who applies for a job via Careers | Centralis Group;

• any individual client of Centralis;

• any individual who represents or is employed by any client of Centralis or any investor in a Fund, or who is a shareholder, settlor, beneficiary, director, officer or ultimate beneficial owner of such client or investor;

• any individual who represents or is employed by any promoter, investment manager, fund manager or alternative investment fund manager of a Fund (each a "Manager");

• any individual employed by our service providers and business partners.

If you have any questions about our use of your personal information, please contact us at: data.protection@centralisgroup.com or on (+352) 26 18 61.

We may amend this notice from time to time to keep it up to date with applicable legal requirements and our global operating model. If we make material changes to this notice, we will aim to notify you by way of including notice of change in this notice or as part of our established correspondence with you. We encourage you to check this page from time to time to review the latest version of this notice.

HOW WE OBTAIN YOUR PERSONAL DATA

We collect personal information about you from various sources, such as when you enter into a contractual agreement with us for our services or you complete a form, sign up for marketing or choose to give us personal information as part of KYC/AML servicing applications.

We will also obtain some of your information indirectly from Centralis clients, from funds, from an investor in the fund(s) (each an "Investor"), or from a Manager, where you have been appointed by that client, Investor or Manager to access and use Centralis services or other investor servicing applications, on its behalf. Where you are an investor in a fund, references to Investor in this notice should be read as references to you.

We will receive information about you when Centralis acts as a service provider to its clients and where you represent or are employed by such a client or where you are an underlying investor, shareholder, settlor, beneficiary, director, officer or beneficial owner of such client.

We also obtain information about you from third parties that are authorised to share your information with us, including our service providers, business partners, intermediaries, and from other publicly available sources of information.

We will also collect some information from you when you interact with our websites or visit our premises.

TYPES OF PERSONAL DATA WE COLLECT

The types of personal information collected by Centralis include, without limitation:

Identification data and contact data and financial data

• Name

• Surname

• E-mail address

• Home address

• Personal photo

• Date of birth

• Current salary

• Payment information

• Purchase history

Technical data

• Web browser and screen resolution

• Operating system and device type (computer, mobile, tablet)

• Session statistics

• Navigation feed and clicks

• IP address

Compliance data

• source of wealth

• tax residency

• details of shareholdings and other assets which are legally or beneficially owned by you

• details of people and organisations which may be connected to you

WHY WE PROCESS YOUR PERSONAL DATA AND LEGAL BASIS

Centralis may process your personal information for the following purposes:

• managing our relationship with you or the client you represent, including establishing and managing service delivery, contractual arrangements, reporting and issue resolution;

• day to day administration and management of our businesses;

• providing you with information about services which may be of interest to you or to the client you represent;

• disclosing information to third parties, such as service providers of Centralis, auditors, regulatory authorities and technology providers;

• processing in the event of a merger, reorganisation or disposal of, or a proposed merger, reorganisation or disposal of any member (or the assets of any member) of the Centralis group;

• billing and collection purposes;

• procurement and supply-chain management;

• Centralis will itself (or through a third party e.g. credit reference agency) process certain information about you or your directors, officers and employees and your beneficial owners (if applicable) in order to carry out KYC/AML checks and related actions which Centralis considers appropriate in accordance with Centralis' KYC/AML procedures;

• monitoring and recording calls and electronic communication for (i) processing and verification of instructions, (ii) enforcing and defending Centralis' rights itself or through third parties to whom it delegates such responsibility, (iii) quality, business analysis, training and related purposes;

The legal bases for this processing are:

• contractual obligations;

• legal obligations;

• consent (where required by applicable law);

• the legitimate interests in understanding and developing our relationship with you or the client you represent;

• the legitimate interests in understanding, improving and developing our services, identifying relevant clients or opportunities for our services, making and defending against legal claims, legitimate interests in connection with mergers, reorganisations or disposals;

• the legitimate interests relating to the prevention of fraud, money laundering, terrorist financing, bribery, corruption, tax evasion and to prevent the provision of financial services to persons who may be subject to economic or trade sanctions, on an on-going basis, relating to making or defending against legal claims, or relating to Centralis' ability to support its clients' legitimate interests;

WHEN WE SHARE YOUR DATA WITH OTHERS

Centralis may disclose your personal information as follows:

• to its service providers, including its affiliates, and other third party service providers engaged by Centralis in order to process the data for the above mentioned purposes, examples of services procured from third parties can include: AML processes including screening, money laundering and identity checks and transaction monitoring, relationship management and call recording/surveillance;

• to competent authorities (including tax authorities), courts and bodies as required by law or requested or to affiliates for internal investigations and reporting, as required in line with our internal policies;

• to credit reference agencies in order to carry out money laundering and identity checks and comply with legal obligations;

• in the event of a merger or proposed merger, any (or any proposed) transferee of, or successor in title to, the whole or any part of the Centralis group's business, and their respective officers, employees, agents and advisers, to the extent necessary to give effect to such transaction.

WHEN WE TRANSFER YOUR DATA

Centralis maintains a global operating model which enables delivery of our services to our international client base. The disclosure of personal data to third parties, including Centralis affiliates, set out above may therefore involve the transfer of your personal data to other countries within the European Economic Area ("EEA") and the U.K. Such transfers are made in accordance with locally applicable data protection laws.

Some of the countries to which Centralis transfers personal data to are deemed by the European Commission, or under locally applicable data protection law, to provide an adequate level of data protection. However, you should be aware that data protection laws in other countries to which Centralis transfers personal data may be considered less protective than those in your country of residence.

Where we are required to do so under applicable data protection laws, we take appropriate steps to implement appropriate technical and organisational safeguards, such as the European Commission's Standard Contractual Clauses, or their equivalent applicable in the U.K. to ensure your data continues to be adequately protected and your privacy rights respected.

Our data transfers to Centralis USA Inc. in the United States of America is based on the Data Privacy Framework and you may find more information on this mechanism and how it is implemented by Centralis USA Inc., below.

We also assess the overall level of protection offered in the context of specific transfers and, where necessary, our use of appropriate safeguards is supplemented by additional measures that support an adequate level of data protection. We apply these safeguards to transfers of personal data to third parties as well as to the Centralis affiliates.

Please contact data.protection@centralisgroup.com for copies of appropriate safeguards, including Standard Contractual Clauses, that have been entered into by Centralis. Please be aware that appropriate safeguards may be redacted for reasons of commercial confidentiality.

DATA PRIVACY FRAMEWORK

Centralis USA Inc. complies with the EU-U.S. Data Privacy Framework ("EU-U.S. DPF") and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework ("Swiss-U.S. DPF") as set forth by the U.S. Department of Commerce. Centralis USA Inc. has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles ("EU-U.S. DPF Principles") with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. Centralis USA Inc. has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles ("Swiss-U.S. DPF Principles") with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms of this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework ("DPF") program, and to view our certification, please visit dataprivacyframework.gov.

Centralis USA Inc. collects and processes the following personal data as data controller for the purposes of its own marketing operations (i.e. providing you with information about services which may be of interest to you or to the client you represent):

Identification data and contact data

• Name

• Surname

• E-mail address

• Home address

Your personal information will not be disclosed to any third party by Centralis USA Inc., except when Centralis USA Inc. is required to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. Centralis USA Inc. is in any case responsible for the processing of personal information it receives, under the DPF, and subsequently transfers to a third party acting as an agent on its behalf. Centralis USA Inc. complies with the EU-U.S. DPF Principles and Swiss-U.S. DPF Principles for all onward transfers of personal information from the EEA, UK and Switzerland, including the onward transfer liability provisions.

You have the right to choose (opt out) whether your personal information is (i) to be disclosed to a third party, unless this third party is acting as an agent to perform task(s) on behalf of and under the instructions of Centralis USA Inc. or (ii) to be used for a purpose that is materially different from the purpose for which it was originally collected or subsequently authorised by the individuals.

You have the right to access your personal information that Centralis USA Inc. holds and to correct, amend, or delete that information where it is inaccurate, or has been processed in violation of the EU-U.S. DPF Principles or Swiss-U.S. DPF Principles, except where the burden or expense of providing access would be disproportionate to the risks to your privacy in the case in question, or where the rights of other persons would be violated.

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Centralis USA Inc. commits to resolve DPF Principles-related complaints about its collection and use of your personal information. EU and UK individuals and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF should first contact Centralis USA Inc. at: data.protection@centralisgroup.com.

Centralis USA Inc. further commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner's Office (ICO) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning its handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF. In certain circumstances, the DPF provides the right to invoke binding arbitration to resolve complaints not resolved by other means, as described in Annex I to the DPF Principles.

Centralis USA Inc. is subject to the investigatory and enforcement powers of the US Federal Trade Commission.

SUB-PROCESSORS

Please click here to view our list of sub-processors.

HOW LONG WE KEEP YOUR DATA

Centralis will retain your personal information for as long as required for it to perform the services. In general terms, we will retain your personal information for the length of time we perform the services to you or to the institution you represent. We may maintain different retention periods for different services.

We will also retain your personal information for the period as required by tax and company laws, or other regulations such as anti-money laundering and know-your-customer regulations, to which we or your institution are subject, and as long as necessary for you to be able to bring a claim against us and for us to defend ourselves against any legal claims. This will generally be the length of the relationship plus the length of any applicable statutory limitation period under local laws.

YOUR RIGHTS

You have the following rights, in certain circumstances and subject to certain exceptions, in relation to your personal information:

• Right to access your personal information – You have the right to request access to personal information we collected about you and information regarding the source of that personal information, the purposes for which we collect it, and the third parties and service providers with whom we share it.

• Right to rectify your personal information – You have a right to request that we correct inaccurate personal information.

• Right to restrict the use of your personal information – In certain circumstances you have a right to ask us to restrict the use of your personal information, if you are contesting the accuracy of your personal information; asserting that our processing is unlawful; asserting that we need to keep the information for reasons related to the establishment, exercise, or defense of legal claims, or you object to our processing.

• Right to request that your personal information is erased – In certain circumstances you have a right to ask us to erase your personal information (this is also often called the "right to be forgotten"). This applies to personal information that we no longer need for the purpose for which it was collected, if the processing is based on consent and you withdraw that consent, if you have successfully exercised your right to object, if the personal information has been processed unlawfully, or if we are legally required to erase the data. Depending on the situation we may refuse your request, in particular if we need to process this information to meet our legal obligations or if the information is necessary for legal claims.

• Right to object to processing of your personal information – In certain circumstances you have the right to object to the processing of your personal information. This applies if we process the personal information on the basis of our legitimate interests or if the information is processed for the purpose of direct marketing. We will review this request to establish if we have compelling legitimate interests which override your rights and freedoms.

• Right to data portability – In certain circumstances you have the right to ask us to provide your personal information to you or another controller in a structured, commonly used, machine-readable format. This applies when we process your information by automated means and this processing is based on your consent or performance of a contract with you.

Where you have provided your consent to processing (e.g. to receive information about services which may be of interest to you or the institution you represent), you may withdraw your consent at any time. You can withdraw your consent or exercise your rights by contacting us at: data.protection@centralisgroup.com.

Please note that some of the rights outlined above may be restricted if we have a superior interest or a legal obligation to pursue data processing.

If you want to act upon your rights, please contact us at the contact information listed at the top of this document.

HOW TO CONTACT THE SUPERVISORY AUTHORITIES

You have the right to lodge a complaint in relation to Centralis' processing of your personal data:

• with the supervisory authority in the EU Member State of your habitual residence or place of work or in the place of the alleged infringement. A list of the supervisory authorities within the EU can be found here; or

• where your habitual residence or place of work or the alleged infringement is in Guernsey, with the Office of the Data Protection Commissioner, contactable at St Martin's House, Le Bordage, St Peter Port, Guernsey GY1 1BR, enquiries@odpc.gg or +44 (0)1481 742074; or

• where your habitual residence or place of work or the alleged infringement is in the UK, with the UK Information Commissioner's Office, contactable at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF (or at the relevant regional office for Scotland, Wales or Northern Ireland, details of which are available here), casework@ico.org.uk or +44 (0)303 123 1113; or

• where your habitual residence or place of work or the alleged infringement is in Switzerland, with the Swiss Federal Data Protection and Information Commissioner, contactable at Feldeggweg, CH-3003, Switzerland or +41 (0)58 462 43 95; or

• where your habitual residence or place of work or the alleged infringement is in Uruguay, with the Unidad Reguladora y de Control de Datos Personales contactable at Dirección: Liniers 1324 piso 4, Torre Ejecutiva Sur, Montevideo, infourcdp@datospersonales.gub.uy or +598 2901 0065 option 3.

CENTRALIS ENTITIES