Introduction

Alter Domus offers a comprehensive range of services spanning fund administration, corporate services, agency

services, CLO collateral administration, credit and structured product services,
depositary services, transfer pricing, wealth administration, domiciliation, and management
company services.

Alter Domus is a fully integrated Fund and Corporate services provider dedicated to clients
internationally and is committed to respecting your privacy – wherever you may be in the world.
This Privacy Notice explains who we are, how we collect, share, safeguard and use your personal
data, and how you can exercise your privacy rights.

For more information about Alter Domus and the services which we provide, please see the Alter
Domus website at www.alterdomus.com.

This privacy notice applies to applicants for employment at Alter Domus, but if you are a
current or former Alter Domus employee, please refer to your Employee Privacy Notice for
more information about how we process your personal data as an employee.

Who is Alter Domus?

Alter Domus Participations S.à r.l., Société à responsabilité limitée and its affiliates (hereafter
referred to as ‘Alter Domus’), with our main establishment situated on 15 Boulevard F. W.
Raiffeisen, in Luxembourg, is the data controller where Alter Domus collects and processes
personal data for our own purposes. Alter Domus operates as a unified group and encompasses
all the entities listed herein. This privacy notice applies to all such entities and their processing
activities.

“Alter Domus”, “we”, “us” and “our” means the Alter Domus Group as described herein.

Contact Us

If you have any questions regarding this Privacy Notice, enquiries regarding data protection, or wish to exercise your rights please contact our Group Data Protection Officer as shown:

By email:

[email protected]

By telephone:

+1 800 480 0851

Updates to this Privacy Notice
We may modify or amend this Privacy Notice from time to time at our discretion. When we make
changes to this Privacy Notice, we will amend the revision date at the top of this page and such
modified or amended Privacy Notice shall be effective as to you and your information as of that
revision date. We encourage you to periodically review this Privacy Notice to view any updates.

Third Party Websites
Links to and from other websites, which are independent of Alter Domus, are maintained by third
parties. Alter Domus is not responsible for the content or privacy practices of any third-party
websites and shall not be liable for any damages or harm arising from the content and use of such
websites.

Any links to other websites are provided as a convenience to you as a user, and do not imply our
endorsement of the linked websites or association with their operators.

Privacy Laws
Alter Domus is compliant with data protection legislation within all of the jurisdictions in which it
operates. The jurisdictions in which we operate are listed on the Alter Domus website at
www.alterdomus.com.

Cookies
As a website visitor, Alter Domus collects personal data from you to administer the site, to improve
your browsing experience, and to enable visitors to be better informed of the services available
through Alter Domus. Such data is obtained through the use of cookies and similar technologies.
For further information on our use of cookies please see the Alter Domus Cookie Notice.

How Alter Domus Collects Personal Data from You
Alter Domus collects your personal data when you:

• Complete an online contact form or survey
• Visit our website (see Cookie Notice)
• Register to receive our email newsletter(s) or other communications
• Enter a competition or promotion
• Request, contract and use a service from us
• Register, create a user profile, or login to any application provided by us
• Communicate with us via phone calls, chat, email, web forms, social media and other
  methods of communication
• Submit personal data to us to comply with AML or KYC obligations
• Apply for employment or participate in recruitment events or activities
• Attend our events
• Provide services to us

Personal Data Alter Domus Collects from Others
Alter Domus works with a number of third parties and may receive your personal data from them.
The third parties include, but are not limited to:

• Business partners
• Clients and prospective clients
• Investors and customers of clients
• Suppliers
• Sub-contractors
• Advertisers
• Referrers

Where another party (such as a company or a partnership or any third parties acting on you or
your behalf) provides your personal information to us, they must also comply with their
obligations under the relevant privacy laws and regulations. If you believe that the entity for
whom you work or a third party has not provided you with details of the personal information that
it holds about you and/or has not obtained your authority to provide us with that personal information for processing as described in this Privacy Notice, then please contact such entity
directly.

Types of Data Alter Domus Collects

Other User Profile Data such as feedback and survey response

• Identity Data: this includes but is not limited to first name, last name, date of birth, place
  of birth, nationality, passport details, national identity card number or social security
  number
• Contact Data: this includes email address, telephone number(s) and postal address
• Financial Data: this includes banking details, income details, tax information, source of
  wealth
• Employment Details: this includes job titles, employment history and any information
  provided as part of an employment application
• Technical Data: subject to your cookie settings this may include type of device used,
  internet protocol (IP) address, browser type and version, operating system
• Any personal data about you included in free text boxes; including in relation to enquiries
  or comments submitted to us
• Other User Profile Data such as feedback and survey response

Legal Basis for Alter Domus to Process Personal Data
Data Protection law only permits Alter Domus to process personal data where we have a valid
legal basis to do so.
We have identified one of the following legal basis to process your personal data, except where
local law dictates specific exceptions:

• To enter into, or for the performance of a contract with you, or to prepare to enter into a
  contract with you
• Where Alter Domus has a legal duty or obligation
• Where it is in the public interest
• Where we need to protect your vital interests
• Where it is in our legitimate interest, as determined and documented by us
• Where you consent

Sharing Your Personal Data
Alter Domus only shares your personal data in the performance of our services to you. We do not
sell your personal data. When necessary, Alter Domus shares your personal data with:

• Vendors and administrative support, infrastructure, and other service providers handling
  your information on our behalf, such as AML/KYC providers; in each case, such vendors and
  service providers will be contractually bound by confidentiality and privacy obligations
  consistent with the obligations in this Privacy Statement
• Tax, government and any relevant regulatory authorities
• Prosecuting authorities and courts, and/or other relevant third parties connected with
  legal proceedings or claims
• Fraud prevention and/or law enforcement agencies
• Third parties where Alter Domus is required to do so by law
• Third parties to whom we disclose information in the course of providing services to you or
  to the entity that has engaged us to provide the services

Security of Personal Data
Alter Domus has implemented appropriate technical, administrative and physical security
measures to help protect your personal data from unauthorised access and improper use. Alter
Domus enforces these security technical and procedural measures across its offices and
operations, and has obtained an ISO27001 certification globally.

In addition, Alter Domus employs many organisational safeguards to protect your personal data,
including the maintenance of policies and procedures that comply with applicable privacy
regulation, impact and transfer analysis and controls, incident and breach management and
monitoring, data subject rights management, and the promotion of awareness and compliance
with privacy regulations through employee training. When we contract with our service providers,
we use privacy regulation-compliant contracts and data sharing agreements, and maintain the
highest level of privacy controls across jurisdictions.

Examples of technical and organizational measures employed include:

• Physical security of access to our offices and floors
• Restricted access control to your personal data on our systems, frequently reviewed and
  revised
• Your data is stored on servers in controlled, secure environments
• A range of data flow detection and prevention methods
• Restrictions on connecting non-approved devices to the Alter Domus network
• Restrictions and safeguards related to the transmission of data externally
• Regular training of our employees on data protection and privacy matters

How We Use Personal Data

Where we collect personal data for a statutory or contractual requirement, or a requirement
necessary to enter into a contract, you may be obliged to provide personal data to Alter Domus.
Failure to do so may mean that we are unable to provide our services to you.

Artificial Intelligence may be used to process your personal data.

Listed below you will find the primary purpose categories for which Alter Domus may process
your personal data, along with representative types of data. . Many jurisdictions do not require the
legal bases to be stated, and these may vary according to local law:

Purpose Categories	Type of data	Lawful basis for processing
To perform AML and KYC checks	Identity, Contract, Financial, Employment	– Necessary to comply with a legal obligation – Performance of a contract
To deliver our services	Identity, Contact, Financial, Technical, Employment	– Performance of a contract – Necessary to comply with a legal obligation – Necessary for our legitimate interests
To comply with tax reporting requirements	Identity, Contact Financial, Employment	– Necessary to comply with a legal obligation
To manage our relationship with you	Identity, Contact, Financial, Employment	– Performance of a contract – Necessary to comply with a legal obligation – Necessary for our legitimate interests
To send you marketing information about our services that we think may be of interest to you	Identity, Contact, Technical	– Consent – Necessary for our legitimate interests
To exercise or defend our legal rights	Identity, Contact, Financial, Employment, Technical	– Necessary for our legitimate interests

International Data Transfers
Your personal data may be transferred internationally between the Alter Domus Affiliates listed
below, to trusted service providers, and to other third parties when necessary. When doing so.
Alter Domus complies with applicable privacy laws regarding international transfer of personal
data. For European Alter Domus entities, personal data is transferred in compliance with Articles
46 or 47 Regulation of (EU) 2016/679, using established safeguards such as transfer impact
assessments, Standard Contractual Clauses, and, where compliant with local regulations,
established frameworks such as the EU-US Data Privacy Framework (including UK Extension to
the EU-US DPF and Swiss-US DPF (see below).

EU – US and US – Swiss Data Privacy Framework (including UK Extension to the EU-US DPF and
Swiss-US DPF)

Alter Domus’ US operations participate in the EU-US and US Swiss Data Privacy Framework
Program, the UK Extension to the EU-US DPF, and the Swiss-US Data Privacy Framework
Program.

Adoption of the Data Privacy Framework includes adherence to the EU-US Data Privacy
Framework Principles and the Swiss-US Data Privacy Framework Principles (“DPF Principles”), a
set of requirements governing participating organisations’ use and treatment of personal data
received from the EU, the United Kingdom (UK), and Switzerland.

To view our EU-US Data Privacy Framework (including the UK Extension to the EU-US DPF and
Swiss-US DPF) Notice, please click here. For more information and to check our certification
status please visit www.dataprivacyframework.gov/s/participant-search.

Retaining Personal Data

Alter Domus retains your personal data only for as long as is necessary for purposes of providing
you with a service.

Alter Domus maintains Data Retention Schedules as part of its Data Retention Policy. This policy
and associated schedules comply with the legal retention requirements of all of the jurisdictions
in which we operate.

These documents are reviewed and updated regularly. We keep personal data for as long as it is
required to meet legal or regulatory obligations and for the exercise and/or defence of any legal
claims.

Automated Decision Making

Alter Domus does not use any automated processes to make decisions about you without human
intervention.

What are your Data Subject Rights?

Numerous national and international regulations include measures to safeguard and enforce data
subject rights. Alter Domus supports the rights described below (except where doing so would
contravene the requirements of local law or regulations). Please see the table – Subject Rights by
Jurisdiction – below, to clarify applicable variances.

You have the right to be informed about what, how and why we process your personal data, as
outlined in this Privacy Notice.

Furthermore, you have the following rights (subject to your jurisdiction):

• Right of Information and Access – The right to obtain from the controller confirmation of
  whether personal data is being processed, information in clear and transparent language
  on how it is used and by whom, why, and with what safeguards, and to receive a copy of
  this data
• Rectification – The right to have personal data corrected where it is inaccurate or
  incomplete
• Erasure (right to be forgotten) – The right to have personal data erased
• Data portability – The right to receive personally or have data sent to a third party in a
  common and machine-readable electronic format
• Object – The right to complain and to object to processing to a relevant supervisory
  authority and/or claim compensation for damages or distress
• Restriction of processing (purpose limitation) – The right to limit the extent of the
  processing of personal data
• Automated decision-making and profiling – The right not to be subject to decision
  making without human involvement
• Right to Opt Out of Certain Processing – The right to opt out of the processing of
  personal data
• Right to Redressal of Grievance (Applicable to India Only) – The right to lodge a
  complaint with a data fiduciary first before approaching the Board for redress
• Right to Nominate Another Individual to Exercise Rights (Applicable to India Only) –
  The right to nominate another individual who will exercise the data principal’s rights in
  case the event of the data principal’s death or incapacity

The following table outlines your valid legal rights for jurisdictions which do not follow EU
regulations or adopt similar mechanisms (such as Jersey, Guernsey and Mauritius):