# PRIVACY NOTICE AND DATA PROTECTION **Date of Last Revision: January 12, 2024** Sarwa Investment Management Limited is an asset management firm incorporated in Dubai International Financial Centre ("**DIFC**") having license number CL2251, and authorized by Dubai Financial Services Authority ("**DFSA**") as a Category 3C firm with reference number F003607 ("**Sarwa**" "**we**," "**us**," "**our**"). We are a subsidiary of Sarwa Investment Management Limited, a company registered in the Cayman Islands and having its address at Century Yard, Cricket Square, PO Box 1111, Grand Cayman KY1-1102, Cayman Islands. This notice (the "**Privacy Notice**") explains how we use the personal data that we collect, or which is provided to us. We are responsible for ensuring that we use your personal data in compliance with Dubai International Financial Centre Data Protection Law of 2020 ("**DP Law**"). This Privacy Notice sets out the basis on which any personal data about you will be processed by us. We only provide services to individuals and entities who are Professional Clients as classified in accordance with the rules of DFSA. This Privacy Notice is directed to individuals whose personal data we or our third-party processors handle in the course of carrying on our commercial activities, including a current or prospective client of Sarwa, a user of our mobile applications, website and related technology and services, employees of Sarwa, or service providers to Sarwa ("**you**"). Such personal data may be provided to us directly by you as an individual or where you are an entity, you may provide us with personal data on individuals connected to you, this Privacy Notice will be relevant for those individuals and you should transmit this document to such individuals or otherwise advise them of its contents. **Personal data that we collect and process about you** - *Information that you provide to us*: the nature of our relationship with you will determine the kind of personal data we might ask for, though such information may include (by way of a non-exhaustive list) basic personal data such as name, address, email address, phone number and tax identification number.  - *Information that we collect or generate about you*: files that we may produce as a record of our relationship with our clients, prospective clients, users of our website and mobile applications, employees and other parties that we conduct business with, including contact history, and any personal data that you provide during communications with us. - *Information that we obtain from other sources*: this includes information from publicly available sources, our service providers or financial intermediaries, our technology platforms such as our mobile application, professional advisers, references that we obtain, and information obtained from sanctions checking and background screening.  **Purpose of Processing and Legal Basis for Processing** Your personal data may be processed by us (or any of our affiliates, agents, delegates or sub-contractors) for the following purposes which are necessary for performance of our business: - arranging investments for you and providing you with advisory services; - managing and administering your investments, including assessing and processing subscription applications, communicating with you about your investment and account related activities on an on-going basis including communicating with you through our mobile application and/or website; - to update and maintain records and provide net asset value and other calculations (as applicable); - to manage and maintain our relationship with you for ongoing customer service; - to enforce or defend our rights either directly or through third parties to whom we delegate such responsibilities;   - to comply with any legal, tax or regulatory obligations applicable to us, including those that derive from anti-money laundering and counter-terrorism legislation; and - to communicate with clients and prospective clients in order to provide information about us and other products and services. Your personal data may be processed by us (or any of our affiliates, agents, delegates or sub-contractors) for the following purposes in order to enable us to comply with our legal or regulatory obligations:   - in order to carry out anti-money laundering checks and related actions including sharing your personal data with police, law enforcement, tax or regulatory authorities, or other government agencies where we have a legal obligation, including screening transactions, reporting suspicious activity and complying with production and court orders; - to report tax related information to tax authorities, including the automatic exchange of tax information; - to investigate and resolve complaints and manage contentious regulatory matters, investigations and litigation; and - to monitor electronic communications for investigation and fraud prevention purposes, crime detection, prevention and investigation. In pursuance of our legitimate interests, or those of a third party to whom your personal data are disclosed, including: - complying with a legal, tax, accounting or regulatory obligation to which we or the third party are subject; - assessing and processing requests you make; - sending updates, information and notices or otherwise corresponding with you in connection with your investments or interests; - investigating any complaints, or pursuing or defending any claims, proceedings or disputes; - providing you with, and informing you about products and services; - managing our risk and operations;  - complying with audit requirements, if any; - ensuring internal compliance with our policies and procedures; - protecting us against fraud, breach of confidence or theft of proprietary materials; - seeking professional advice, including legal advice; - where applicable, facilitating business asset transactions involving us or our related entities; - monitoring communications to or from us (where permitted by law); and - protecting the security and integrity of our information technology systems. We will only process your personal data in pursuance of our legitimate interests where we have considered that the processing is necessary and, on balance, our legitimate interests are not overridden by your legitimate interests, rights or freedoms. We continue to be a data controller even though we have engaged a service provider and other third parties to perform certain activities on our behalf.  Please ensure that you provide a copy of this Privacy Notice to any third parties whose personal data you provide to us.  We reserve the right, at our sole discretion, to change or modify portions of this Privacy Notice at any time. If we do this, we will post the changes on this page and will indicate at the top of this page the date these terms were last revised. We will also notify you, either through the user interface of our mobile application and website, in an email notification or through other reasonable means. Any such changes will become effective no earlier than fourteen (14) days after they are posted, except that changes made for legal reasons will be effective immediately. Your continued use of our mobile application and/or our website after the date any such changes become effective constitutes your acceptance of the new Privacy Notice. We recommend that you review this Privacy Notice periodically. **Sharing Personal Data.** We may share your personal data with our affiliates, agents, delegates and sub-contractors. In certain circumstances we may be legally obliged to share your personal data and other financial information with respect to your investments with relevant regulatory authorities such as Dubai Financial Services Authority. They, in turn, may exchange this information with foreign authorities, including tax authorities and other applicable regulatory authorities.  Our affiliates, agents, delegates and sub-contractors may process your personal data on our behalf, including with our banks, accountants, auditors and lawyers which may be data controllers in their own right. Additionally, a service provider may use your personal data where this is necessary for compliance with a legal obligation to which it is directly subject (for example, to comply with applicable law in the area of anti-money laundering and counter terrorist financing or where mandated by a court order or regulatory sanction). The service provider, in respect of this specific use of personal data, acts as a data controller.     In exceptional circumstances, we will share your personal data with regulatory, prosecuting and other governmental agencies or departments, and parties to litigation (whether pending or threatened) in any country or territory.  **Recipients of Data and Transfer of Data outside DIFC** We may disclose your personal data as follows:  - to our business partners who will be subject to appropriate data protection obligations; - to our affiliates and third-party service providers engaged in connection with the oversight, safekeeping, administration, distribution or operation of the partnerships and/or funds you invest in, in order to process the data for the above mentioned purposes; and - to competent authorities (including tax authorities), courts and bodies as required by applicable law or requested by such entities or to affiliates for internal investigations and reporting. The disclosure of personal data to the third parties set out above may involve the transfer of data for processing to jurisdictions outside your country of residence and outside Dubai International Financial Centre. Where we transfer your personal data outside DIFC it is required to do so in a manner consistent with the DP Law. Your continued use of our services, including your use of our website and/or mobile application constitutes an acknowledgement that the data protection legislation in jurisdictions outside DIFC where we may transfer your personal data may not offer the same level of protection as that offered by the DP Law. **Personal Data Quality** We rely on the accuracy of the information provided by you and others. We take reasonable efforts to ensure that personal data collected by us or on our behalf is accurate, up to date, and complete, in accordance with applicable law. If any information about you changes or you have any concerns regarding the accuracy of information about you held by us, you should contact us at the address provided in the How to Contact Us section below. **Security of Personal Data** We have physical, electronic and procedural safeguards in place to protect personal data from loss, misuse, unauthorised access, disclosure, alternation and destruction, however no data security measures can guarantee complete security all of the time. **Retention Period** We will retain your personal information for as long as is necessary to provide our services to you, to fulfil the purposes described in this Privacy Notice and/or our business purposes, or as required by the DP Law, other laws, regulation or internal policy. We are obliged to retain certain information to ensure accuracy, to help maintain quality of service, and for legal, regulatory, fraud prevention, and legitimate business purposes. In general, we (or our service providers) will hold personal data for a period of six years from the conclusions of any arrangement or advisory services we provide to you, or from the date of the dissolution of an investment we arranged for you, or for as long as required for us to perform the services or comply with applicable legal/regulatory obligations.  **Consequences of not Providing Required Data** Where we require your personal data to comply with anti-money laundering or other legal requirements, failure to provide this information means we may not be able to: (a) accept you as a client and/or may be unable to arrange investments for you or provide you with advisory or other services; or (b) perform our contractual obligations to you in accordance with the relevant contract entered into between you and the partnerships and/or funds that you invest in. This may result in our termination of our relationship with you. Upon your request, we will tell you when we ask for your information whether it is a statutory or contractual requirement to give us the information and the consequences of not providing the information.   **Data Subject Rights** You have various rights in relation to your personal data held by us, including the right to: - be informed and to request access to your personal data; - correct any mistakes on our records, erase or restrict records where they are no longer required;  - object to use of personal data where that processing is based on our legitimate business interests or for direct marketing; and - request not to be subject to automated decision making if the decision produces legal or other significant effects on you. Your rights in relation to your personal data outlined above are subject to a number of legal conditions and exemptions. We will respond to your request in writing, or orally if requested, as soon as practicable and in any event not more than within one month after receipt of your request. In exceptional cases, we may extend this period by two months and we will tell you why. We may request proof of identification to verify your request.  **How to Contact Us** If you have any questions about the use of your personal information, please contact your relationship manager at Sarwa or use the contact information posted on our website and/or on our mobile application. You may also write to us at mm@sarwainvestment.com or at Sarwa Investment Management Limited, P.O. Box 507127, DIFC, Dubai, United Arab Emirates.