Privacy Notice Pursuant to the Eu’s General Data Protection Regulation (GDPR)

1. Bound by data protection legislation: SFH Jersey Limited, Soditic Asset Management LLP, Soditic Financial Services Ltd, Soditic Fund Services Limited, Soditic Investment Management Limited, Soditic Limited, Soditic Management Services Ltd. and Soditic S.A. and each of their respective “holding bodies” and “subsidiaries” from time to time (as those expressions are defined in the Companies (Jersey) Law 1991, as amended) (together, the “Soditic Group”, “Soditic”, “we”, “us”, “our “ and each a “Soditic Entity”) are bound by the GDPR and various implementing legislation, including the Data Protection (Jersey) Law 2018. Where there is a reference to the GDPR this will apply to each Soditic Entity as appropriate in any applicable jurisdiction.

2. For the avoidance of any doubt, Fineurop Soditic Spa (“Fineurop Soditic”) is not covered by this Statement. Please refer to Fineurop Soditic’s website to view its privacy policy.

3. Committed to protecting your privacy: The Soditic Group are committed to protecting your privacy. This Statement sets out the basis on which the personal data that any Soditic Entity collects from you and how it will be processed.

4. Privacy Notice: This privacy statement is a privacy notice (this “Statement”) for the purposes of the GDPR given by each of the Soditic Group when acting in its capacity as a data controller or data processor in relation to its collection and use of personal data.

5. Data Controller: Where personal data about you is collected and then used by a Soditic Entity under this Statement as a consequence of you engaging with a Soditic Entity, such Soditic Entity is the data controller in respect of that personal data. Where personal data about you is provided by someone else or is collected by a Soditic Entity, this Statement will also apply to its collection and use and the Soditic Entity collecting and using that personal data is the data controller in respect of it.

6. In this Statement, the phrase “those connected with you” refers to (a) your employees or other people who deal with us on your behalf, whether you are a client that is an individual, a corporate body or some other form of entity or organisation, or an investor in, or an owner of, a client and (b) those people who represent other entities or organisations that we might deal with, such as advisers, regulators, suppliers or anyone else that makes any form of enquiry in relation to us or our services.

7. Kindly read this Statement carefully to understand our practices regarding your personal data and how we will treat it. If you have any queries regarding this Statement, please contact our Data Protection Officer, whose contact details can be found at the end of this document.

8. Purpose of Data Protection: The purpose of the GDPR is to protect the rights and privacy of individuals (“Data Subjects”) regarding the processing of personal data concerning them. “Personal Data” is any information relating to an identified or identifiable natural person (known as a “data subject”). A person is “identifiable” if he or she can be identified, directly or indirectly, not only by things such as a name or an identification number, but also by things such as location data or some factor specific to (for example) the physical, physiological or social identity of that person. More common examples of Personal Data include names, identification numbers, contact information, identity documents, medical records and photographic images. “Processing” covers any activity involving Personal Data and includes such things as the collection, recording, storage, adaptation, use, disclosure and destruction of Personal Data (and “Process” bears the corresponding meaning). Each Soditic Entity will Process and control (to the extent necessary) Personal Data in accordance with the GDPR.

9. Our Policies: Our policies and procedures aim to ensure that all our staff, contractors and others that we work with and who Process any Personal Data held by us, or on our behalf, wherever in the world, are aware of, and abide by, their duties under the GDPR. The Soditic Group abide by standards of data protection that are in line with the GDPR in any relevant jurisdiction, which requires among other things that Personal Data must be: – a. processed lawfully, fairly and in a transparent manner; b. collected for lawful purposes that are clearly specified and only further processed for compatible purposes; c. relevant and limited to what is necessary for the purposes of the processing; d. accurate and kept up to date, with inaccurate Personal Data being erased or rectified without delay; e. kept for no longer than is necessary; and f. processed in a secure manner, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage.

10. Whose Personal Data do we process?

a. Clients (and potential clients): We have a variety of clients. Even where our clients are not themselves individuals, they will be represented by individuals and they may be owned by individuals and invested in by individuals. As a result, we will inevitably Process Personal Data in the course of our relationships with those clients too. As a potential client and then (if applicable) as a client, the Personal Data that we Process will include personal and/or professional contact details (names, addresses, telephone numbers, email addresses), copy identity documents and proofs of address, copy professional and educational certificates, details of bank accounts and/or other payment details, details of financial standing and investment objectives. If you are a potential client or a client, the Personal Data that we Process may additionally include details of family wealth, tax status, names, addresses and other personal details concerning family members and/or those employed by families or family members and other information categorised as “special category data”, such as information about an individual’s race; politics; religion; biometrics (used for identification purposes) and health. In addition, if you leave a voicemail message with us, that message may be Processed in a similar manner, and for the same or similar purposes, to email and postal correspondence from or concerning you. We may also collect Personal Data in respect of meetings attended and any other information which you may provide to us.

b. Investors, Legal and Beneficial Owners, Settlors, Protectors and Beneficiaries: We deal with individuals and various types of organisations that are connected with clients, such as owners, investors and beneficiaries. As a person connected with a potential client and (if applicable) then a client that falls under this paragraph, the Personal Data that we Process about you will include personal and/or professional contact details (addresses, telephone numbers, email addresses), copy identity documents and proofs of address, copy professional and educational certificates and data to facilitate tax information exchange. In addition, if you leave a voicemail message with us, that message may be Processed in a similar manner, and for the same or similar purposes, to email and postal correspondence from or concerning you.

c. Other Client-Connected People: Advisers and Regulators: We also deal with those organisations that provide professional advice or services to us or to our clients, those that supervise and regulate us and our clients, those that supply goods and services to us and our past, present and (in the case of job applicants) future staff. As an “Other Client-Connected” person, the Personal Data that we Process about you will include personal and/or professional contact details (names, addresses, telephone numbers, email addresses) and, if you leave a voicemail message with us, that message may be Processed in a similar manner to email and postal correspondence.

d. Suppliers (and potential suppliers): As a potential supplier and then (if applicable) as a supplier, the Personal Data that we Process will include personal and/or professional contact details (names, addresses, telephone numbers, email addresses), documents and other proofs of standing and reputation and details of bank accounts and/or other payment details. In addition, if you leave a voicemail message with us, that message may be Processed in a similar manner, and for the same or similar purposes, to email and postal correspondence from or concerning you.

e. Potential employees: If you are an applicant for a job with us (a potential employee), the Personal Data that we Process about you may include: –

i. your name, address and contact details, including telephone numbers and email addresses;

ii. details of your qualifications, skills, experience and employment history;

iii. information about your current level of remuneration, including entitlement to benefits;

iv. whether or not you have a disability that we may need to make adjustments for during the recruitment process;

v. information about your entitlement to reside and/or work in the place where you have applied for a job; and

vi. equal opportunity monitoring information, including information about your ethnic origin, sexual orientation, health and religion or beliefs.

In addition, if you leave a voicemail message with us, that message may be Processed in a similar manner, and for the same or similar purposes, to email and postal correspondence from or concerning you. If your application for a job with us is unsuccessful, we will retain your Personal Data for nine months after the date on which we inform you (or any recruitment agency through which you have applied to us) that your application was unsuccessful, unless you ask us to retain your details on file for a longer period. We will delete any Personal Data no longer required and will do so in an appropriate and secure manner. If your application for a job with us is successful, our retention of your Personal Data will be governed by our separate policy on staff Personal Data, which will be made available to you by our HR department as part of you becoming a member of staff.

f. Enquirers and visitors to our website: You may give us Personal Data by filling in a contact form on our website or by corresponding with us by email. In each of the above cases, the Personal Data that we Process will include personal and/or professional contact details (names, addresses, telephone numbers, email addresses) and, if you leave a voicemail message with us, that message may be Processed in a similar manner to email and postal correspondence. If you have stated contact preferences for service and/or jurisdiction updates and/or events that we may organise or participate in, we will also Process that information. We will also automatically collect certain information each time you visit our website. This includes: –

i. technical information including the Internet Protocol (IP) address used to connect your computing device to the Internet, your browser type and version, time zone setting, operating system and platform;

ii. information about your visit which may include the pages viewed, page response times; and

iii. your country of location by reference to a look-up of your IP address against public sources.

g. Our website also uses cookies and/or similar technologies to collect and store certain information about your interaction with our website. For more information about how we use cookies see our Cookies Policy.

h. Other: some Soditic Entities (Soditic Limited and Soditic Asset Management LLP) record, and retain for a period of five years, landline telephone calls to comply with applicable legislation and those telephone conversation records may be Processed. Access to these records is limited to specific employees and is password protected.

11. How we use the Personal Data we Process

a. Clients (and potential clients): As a potential client, we will process Personal Data about you and those connected with you, for the purpose of carrying out our business and in order to: –

i. respond in our legitimate interests to your enquiries about our services and/or other requests;

ii. provide financial services, corporate services and / or such other services to you;

iii. carry out due diligence or other “know-your-customer”, anti-money laundering, counter-terrorist financing or anti-bribery checks in accordance with legal obligations to which we are subject or in our legitimate interests to satisfy our regulatory obligations and our own risk management procedures;

iv. conduct checks concerning credit worthiness and standing prior to entering into an agreement with you;

v. take steps in our legitimate interests to prevent, detect or investigate crime, fraud, misconduct or any unlawful action or omission, whether or not relating to your enquiry and whether or not there is any suspicion of any illegality;

vi. enter into an agreement with you regarding the provision of services;

vii. verify and carry out financial transactions in relation to the provision of the services under the agreement with you;

viii. manage our infrastructure and business operations, to comply with policies and procedures that may be required by law or where necessary for our legitimate interest to satisfy other applicable industry regulations, guidelines or notices that may have been put in place by us, including those relating to regulatory review and/or oversight, internal or external auditing, finance and accounting, billing and collections, IT systems, data and website hosting, training, testing and business continuity; and

ix. correspond with you concerning our present and future services, relevant news and service updates, with your consent where required by law or otherwise in our legitimate interests, provided these interests do not override your right to object to such communications.

b. If you become a client, we will continue to process Personal Data about you for such of the purposes described above as continue to be relevant. In addition, we will process Personal Data about you and those connected with you regarding the on-going provision of services, as described below. If you do not become a client, we will only keep Personal Data that you have made available to us if it is necessary for us to keep it for legitimate business purposes and/or as we are required to keep it by law or regulation.

c. If you do become a client, we will need to Process Personal Data in order to: –

i. under the agreement entered into between you and us: –

1. provide you with services and administer and manage our relationship with you;

2. carry out your instructions and respond to enquiries made by you;

3. conduct and verify ongoing credit worthiness and standing checks relevant to the agreement;

4. recover any fees owed to us under our agreement with you;

ii. under our legal obligations: –

1. collect and use certain information, for example with regard to the ownership of assets and for the purpose of the automatic exchange of information concerning tax matters;

2. carry out on-going due diligence or other “know-your-customer”, anti-money laundering, counter-terrorist financing or anti-bribery checks;

3. comply with other applicable law and regulations in the various jurisdictions in which we operate;

iii. or in our legitimate interests: –

1. manage our infrastructure and business and further our business interests;

2. comply with policies and procedures under applicable professional regulation, guidelines or notices and/or that may have been put in place by us, including those relating to regulatory review and/or oversight, risk management, internal or external auditing, finance and accounting, billing and collections, IT systems, data and website hosting, training, testing and business continuity; and

3. other purposes which we may notify you of from time to time, and obtaining your consent where necessary.

d. Investors, Legal and Beneficial Owners, Settlors, Protectors and Beneficiaries: If you are an investor in, or the legal or beneficial owner of, a client that is a corporate body, a partnership or an unincorporated association or body or if you are a settlor, protector or beneficiary of a trust or a founder, council member or a beneficiary of a foundation, you may be a person connected with a potential client and/or client and, as such, we will Process Personal Data about you, and those connected with you, in order to provide services to the client with which you are connected;

i. under our legal obligations: –

1. collect and use certain information, for example with regard to the ownership of assets and for the purpose of the automatic exchange of information concerning tax matters;

2. carry out on-going due diligence or other “know-your-customer”, anti-money laundering, counter-terrorist financing or anti-bribery checks;

ii. or in our legitimate interests: –

1. manage our infrastructure and business and to further our business interests;

iii. other purposes which we may notify you of from time to time and obtaining your consent where necessary.

e. Other Client-Connected People: Advisers and Regulators: If you are a person that is connected with a client or a potential client by reason of being the accountant, lawyer, banker or other adviser to that client (or potential client) or if you are a person that carries out any supervisory or regulatory function in any jurisdiction in connection with any Soditic Entity or a client (or potential client) of any Soditic Entity, we may process Personal Data about you and those connected with you for the purpose of our legitimate interest in carrying out our business including in providing services to the client (or potential client) with which you are connected.

f. Suppliers (and potential suppliers): As a potential supplier, we will Process Personal Data about you and those connected with you, for the purpose of entering into and receiving services under a contract with you relevant to carrying out our business and in order to: –

1. Suppliers

a. respond to your enquiries about supplying goods or services to us;

b. conduct checks concerning standing and reputation;

c. enter into an agreement with you regarding the provision of services; and

d. correspond with you concerning your present and future goods or services.

2. If you do become a supplier, we will need to process Personal Data in order to:

a. administer and manage our relationship with you;

b. respond to enquiries made by you;

c. carry out on-going checks in accordance with legal or regulatory obligations and our own risk management procedures;

d. conduct and verify ongoing standing and reputation checks;

e. pay for goods and services received;

f. comply with legal or regulatory obligations, for example with regard to a regulator’s outsourcing policy; and

g. for other purposes, which we may notify you of from time to time, and obtaining your consent where necessary

g. Potential employees: If you are an applicant for a job with us (a potential employee), we will Process Personal Data about you in our legitimate interests, in order to assess your application and to advance that application through our recruitment processes, including by making details of your application, including Personal Data, to relevant members of our management, and to comply with policies and procedures under applicable professional regulation, guidelines or notices and/or that may have been put in place by us, in relation to staff and recruitment.

h. Business Cards: If you or someone who works for you has given us a business card at a conference or a business meeting, we will use the contact details on the card in connection with the specific purpose it was provided.

12. Who we share Personal Data with We may share Personal Data with:

a. any other Soditic Entity;

b. business partners, suppliers, affiliates, agents and/or sub-contractors for the performance of any agreement we enter into with you. They may assist us in providing the services we offer, processing transactions, fulfilling requests for information, receiving and sending communications, updating marketing lists, analysing data, providing IT and other support services or in other tasks, from time to time. These third parties will only use your information to the extent necessary to perform their functions;

c. credit reference agencies for the purpose of assessing your credit standing where this is a condition of us entering into a contract with you.

d. external networking sites. Our website contains plug-ins to such sites. If you are a member of one of those social networking providers and you are logged in while visiting our website, the relevant social network provider may assign information to your social media account. By interacting with one of the plug-ins on our website, by clicking the interaction button information that you visited, our site may be shared with the relevant social networking provider and held as part of your separate social networking user account. You should read the privacy policies of your social networking provider for further information about their collection and use of your personal data.

13. Security and data retention: We have taken steps to apply appropriate technical and organisational measures to prevent the unauthorised or unlawful processing of Personal Data, and/or the accidental loss or destruction of, or damage to, Personal Data. This includes, but is not limited to, using properly configured and maintained firewalls and anti-virus /malware protection on servers and PCs with emails scanned for viruses and spam. Our staff have an obligation to ensure that appropriate security measures are implemented at all times in accordance with the guidance set out in our GDPR policies and procedures. As a general rule, the Soditic Entity’s IT tools and applications such as the e-mail system and the data/client/document management systems are administered by Soditic Group in Jersey, England and Wales, Switzerland and Italy.

We retain Personal Data for the duration of the services that we provide as necessary to meet our obligations under our contractual obligations to you, to identify issues or to issue and resolve legal proceedings. We also retain Personal Data beyond the duration of the services that we provide as necessary to meet our legal, regulatory and other obligations to retain such information under applicable law and we shall regularly review retention periods on a general and specific basis. Retention periods will by definition vary from matter to matter. For example, Personal Data in connection with matters relating to trusts may be retained indefinitely subject to our internal review and approval in accordance with our GDPR policies and procedures.

Old media (PC and server disks, tapes, etc.) are stored and then destroyed using a reputable specialist organisation. There may be some cases in which we are obliged to delete Personal Data we process, such as the data having been processed in breach of the GDPR or to comply with a legal obligation to delete it. In other cases, there may be no specific time limit applicable to the retention of particular Personal Data and, in determining how long particular Personal Data will be retained for, we will use criteria including whether: (a) the data is no longer necessary for the purpose in relation to which it was collected; or (b) the data can, if required, be collected again without undue delay or difficulty.

We will not, as a general rule, seek or rely on your consent to Process Personal Data about you. However, to the extent that we do on occasion rely on your consent in respect of particular Personal Data, we will cease Processing that Personal Data by deleting it if you withdraw that consent at any time. Likewise, where we rely on your consent to Process “special category” Personal Data, we will cease Processing that “special category” Personal Data by deleting it if you withdraw that consent at any time. You do have the right to object to the Processing of Personal Data by us on the grounds of performance of a task pursuant to an agreement or our legitimate interest, but that objection must be on grounds relating to your particular situation. In such circumstance, we will stop Processing the Personal Data in question unless: (a) we can demonstrate compelling legitimate grounds for the Processing, which override your interests, rights and freedoms of the individual; or (b) the Processing is for the establishment, exercise or defence of legal claims. If you do object to the Processing of your Personal Data by us and, as a result, we stop Processing it, we may not be able to continue to provide services to you in a particular manner or at all and we may, as a result, need to terminate our service agreement with you. Where, for example, we Process your Personal Data with your consent in order to send you promotional update communications about us or our services, if you withdraw that consent, we will not be able to send you such communications. If, as an unsuccessful job applicant you ask us to retain your Personal Data we would normally retain it for a nine-month period, but you may later change your mind and ask us to delete it, we will not be able to refer to your original application should a potentially suitable vacancy subsequently occur. We will delete any Personal Data no longer required and will do so in an appropriate and secure manner.

14. Data Location: The Soditic Group store data in Jersey, England and Wales, Switzerland and Italy, on servers at its physically-secured premises in these jurisdictions and elsewhere in these jurisdictions as the Soditic Group deem appropriate. All premises and data centres used by Soditic for its IT infrastructure are secured by access control systems and only a limited number of staff members and, on occasion, reputable and trusted third party IT suppliers that are subject to appropriate data protection and confidential obligations, have supervised physical or remote access to Soditic’s IT infrastructure and systems. In certain cases, Personal Data may be transferred to other countries where the Soditic Group maintain operations or where its service providers are located. Where these transfers are to be made outside the European Union, we will make sure that the receipt of the Personal Data has provided adequate safeguards, in accordance with the requirements of the GDPR by, for example, entering into appropriate European Commission-approved standard contractual clauses relevant to transfers between data controllers or between a data controller and a data processor.

15. Your rights: You have a number of rights under the GDPR in relation to your Personal Data. You have the right under certain circumstances to:

a. have access to your Personal Data by making a “subject access request”;

b. have your Personal Data corrected if it is wrong or, in certain circumstances, to have it deleted;

c. have the Processing of your Personal Data restricted (while we verify or investigate your concerns with this information for example);

d. object to the further Processing in certain circumstances of your Personal Data including the right to object to marketing;

e. request we move your provided Personal Data elsewhere (data portability);

f. to withdraw any consent that you have given us if we are Processing your Personal Data only because you have given that consent; and

g. not have your Personal Data automatically Processed.

16. Soditic Group’s contact details: If: –

a. you wish to exercise any of your rights in relation to your Personal Data;

b. you have any complaint about the way in which we Process Personal Data; or

c. you require any further information about this Statement or its contents,

please contact us in the first instance at: The Data Protection Officer, Soditic Management Services Ltd., 27 Hill Street, St Helier, Jersey JE2 4UA, Tel: +44 (0)1534 515515 or e-mail: dataprotection@soditic.je.

17. Data protection regulator contact details: If your request or concern is not satisfactorily resolved by us you may approach your local data protection authority in the jurisdiction in which we provide services to you. The contact details for the data protection regulators in Jersey, England and Wales, Switzerland and Italy, in which we operate, are as follows:

(Jersey) Office of the Information Commissioner, Brunel House, Old Street, St Helier, Jersey JE2 3RG. Tel: +44 (0)1534 716530. E-mail: enquiries@dataci.org

(United Kingdom) Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Tel: +44 (0) 303 123 1113 or +44 (0) 1625 545745. E-mail: casework@ico.org.uk

(Switzerland) The Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, CH – 3003 Berne. Tel +41 (0)58 462 43 95. E-mail: info@edoeb.admin.ch or contact the relevant Cantonal or Communal authority.

(Italy) Garante per la protezione dei dati personali, Piazza Venezia 11 – 00187 Roma. Tel: +39 06 696771. Email: protocollo@gpdp.it

18. Updates: We review our policies and procedures regularly and we reserve the right to amend the terms of this Statement from time to time at our absolute discretion. Any amended Statement will be posted on our website and you are encouraged to visit our website from time to time to ensure that you are aware of our latest policies in relation to the protection of Personal Data.

We last reviewed and updated this Statement on 20 May 2020.