Data Protection
Policy

Personal data

We collect information about you from your interactions with us in the context of providing our services or information requests. Depending on the type of relationship you have with us, the following personal data may be collected and/or processed and/or used:

• Name, date of birth, nationality, gender, family information, KYC documents (including copies of identity documents and/or passports), telephone number and all types of address (including email address);
• Financial information, including payment and transaction records, as well as information relating to banking and non-banking assets, financial statements, debts, taxes, income;
• Tax domicile;
• Professional information, such as title, professional experience, academic background;
• Information relating to your investor profile, such as investment objectives, investment knowledge and experience, and risk appetite;
• Information provided through communication with us by telephone, email or when you attend a meeting organised by Gepolis S.A. or involving our participation;
• Any other relevant and necessary personal data for Gepolis S.A. to provide its services, as well as any information that must be obtained under applicable laws.

Additionally, Gepolis S.A. uses cookies and other similar technologies on its website, notably for site maintenance purposes and collection of technical information about its use, such as the type of operating system used, the number of visits and pages viewed, user preferences, content collection, analytical and usage data.

Third-party sites

Our website may contain links to third-party websites or applications. Where applicable, we are not responsible for the content or data protection compliance of those websites or applications. You should consult those websites or applications to read their privacy statements and the terms applicable to them.

Legal basis and purpose

Depending on the nature of our relationship with you, Gepolis S.A. always processes and uses your personal data where Gepolis S.A. has a valid legal basis or for a specific reason, such as providing or improving our services, or for compliance and marketing purposes. The processing of such personal data will always be carried out in accordance with our contractual obligations relating to our services and in compliance with our internal data protection guidelines and procedures.

Marketing

We reserve the right to use your personal data to communicate marketing-related information and events on different platforms such as email, telephone, text messaging, direct mail and online.

Where required by law, we will ask you to explicitly opt in to receive our marketing correspondence. If we send you a marketing communication, it will contain instructions on how to stop receiving such communications. Respecting your marketing preferences is important to us. You have the right to unsubscribe immediately and permanently.

Transfer and sharing of personal data

Gepolis S.A. may be required to share personal data with our business partners and third-party service providers, or with authorities in accordance with the law.

Gepolis S.A.'s third-party service providers are not authorised to share or use the personal information communicated to them for purposes other than the provision of services on our behalf. In particular, Gepolis S.A. may share personal data with:

• Business partners with whom Gepolis S.A. jointly provides services or content;
• Third parties assisting Gepolis S.A. in providing services or acting on behalf of Gepolis S.A.;
• Third parties to whom Gepolis S.A. is legally required to disclose your personal information (for example, regulatory bodies, government agencies, law enforcement authorities, courts and other public authorities);
• Third parties where reasonably necessary to protect the rights of Gepolis S.A., users, systems and service (for example, legal advisers and information security professionals).

International transfer

Your personal data may be stored and processed outside your country of origin.

Retention period

Gepolis S.A. will only retain personal data for as long as necessary to fulfil the purpose for which it was collected or in accordance with legal, regulatory or contractual requirements.

Your rights

Depending on the jurisdiction in which you are located or where Gepolis S.A. carries out its activities, you may benefit from certain legal rights regarding the collection, use, disclosure and processing of your personal data. For example:

• Right of access: the right to request in writing details of your personal information and a copy thereof;
• Right of rectification: the right to have inaccurate information about you corrected or deleted;
• Right to erasure: the right to erasure of certain personal information about you;
• Right to restriction of processing: the right to request that your personal information only be used for restricted purposes;
• Right to withdraw from marketing: you can manage your marketing preferences by unsubscribing through the appropriate links in Gepolis S.A.'s communications;
• Right to object: the right to object to the processing of your personal information in cases where processing is based on the performance of a task in the public interest;
• Right to data portability: the right to request that the personal information you have provided to Gepolis S.A. be transmitted to you or a third party in an electronically readable format;
• Right to withdraw consent: the right to withdraw any consent you have previously granted to Gepolis S.A. to process your personal information.