Data Privacy Statement - Notice

Introduction

This privacy Notice applies to Pilgrim Global Advisors LLC and its Irish subsidiary, Pilgrim Global Advisors Support Services Limited ("Pilgrim"), where we act as data controller with third parties acting on our behalf in connection with our fund, References within this Notice to "we", "our", or "us" are references to these group entities.

Pilgrim is committed to protecting and respecting your privacy. This Privacy notice describes how we will collect, use, disclose and secure your information both from your use of the Pilgrim portal and the associated webpage which we operate (collectively, the "Pilgrim Portal"), your investment in our fund, through any services that we may provide to you or when otherwise interact with our business (collectively, the "Services").

We shall process personal data awfully, fairly and in a transparent manner. As explained in this Privacy Policy, personal data is collected for specified and explicit purposes and not further processed in a manner that is inconsistent with those purposes. Any personal data which you volunteer to us will be treated strictly in accordance with the General Data Protection Regulation (Regulation 2016/679) (the "GDPR"), the United Kingdom General Data Protection Regulation (the "UK GDPR"), any related data protection and privacy laws of EU member states and the United Kingdom ("UK") (as applicable) (together the "Data Protection Legislation"). We do not sell or distribute your personal data to third parties for purposes of allowing them to market products and services to you. Communicating via the internet and sending data to you by other means necessarily involves your personal data passing through or being handled by third parties.

As discussed below in the section titled "International Transfers", information that we collect may be transferred to and processed in the United States or another jurisdiction outside your country of residence, which may have less stringent data protection laws than in your country of residence.

For purposes of this Privacy Notice, the terms "personal data", "data subject", "processing", and "controller" have the meanings ascribed to them under GDPR/ UK GDPR. Terms defined under GDPR/ UK GDPR may differ in meaning from the common usage of the same terms used elsewhere in this Privacy Notice.

Data Controller

This Privacy Notice applies to individuals whose personal data we process in the course of operating as a data controller. A data controller is defines in the GDPR/ UK GDPR as the entity who determines the 'why' and the 'how' in terms of processing your personal data.

Where we are appointed by clients, we may process personal data as a data processor, acting upon the instructions of our clients, who are the data controllers. This activity is outside the scope of this Notice. The personal data collected, the purpose of collecting, the means of collecting and the retention period are all determined by our clients, the data controllers and outlined in their respective data protection information notices or similar documents.

Information we collect and the sources

Data we gather automatically

Certain statistical data is available to us via our internet service provider. This data may include the IP and logical address of the server you are using, the top level domain name from which you access the internet (for example .i.e., .com, etc.), the type of browser you are using, the date and time you access our site and the internet address linking to our site. We may also use temporary "session" cookies which enable a visitor's web browser to remember which pages on the Pilgrim Portal have already been visited. This data may be used to help us to improve, administer and diagnose problems with our server and the Pilgrim Portal.

Data you provide to us

We may ask for and collect from you personally identifiable and other information at certain points via this Pilgrim Portal and via your relationship and interactions with us (such as communications with us, participation in surveys, etc.). This personal data may involve data about you, about any person or entity on whose behalf you are acting, or that you otherwise provide us. We outline below the categories of personal data we may process, with  common examples. Please note that this is an indicative, non-exhaustive list, and the personal data we use may change over time.

• Personal details: Biographical information, contact details, gender, marital status, official identification documents, national identification numbers, family circumstances and background, behavioural and lifestyle, education and employment details, organisational roles including trusteeships, directorships and partnerships, records of communications and correspondence including phone and video recordings, marketing and communication preferences, opinions, comments and feedback, any other personal information that you choose to share with us during communications e.g., opinions, holiday, and travel plans.
• Financial information: Current financial situation, financial history, financial planning, source of wealth and source of funds, billing and banking, tax, pension, insurance policies and positions, credit status, risk appetite and score, portfolio position and performance, records and logs of activities on your accounts, service, product and account information and history, ethical and investment restrictions and any other financial information that you choose to share with us.
• Special category and sensitive data: Mental and physical health, political or religious views and criminal convictions and judgements and other. Where necessary, we obtain your explicit consent to process this information and the purposes for which it will be used.
• Anti-money laundering, terrorist financing and sanctions data("AML and CFT data"): Official documentation to verify identify (including photographic identification and signatures), official documentation to verify address (including bank statements, utility bills), other official documentation on request, source of wealth and source of funds, details for conducting politically exposed person and sanctions checks against relevant lists, adverse media reports, criminal convictions and judgements relating to, or resulting from, above checks or which you have told us about.
• Anonymised data: In addition to the categories of personal data described above, we produce anonymised and aggregated data and information that is not processed by reference to a specific individual.
• Cookies and technical data: ION Group collect cookies from your device when you access and use our Pilgrim Portal. Form more information, please see ION Group Cookie Policy available on their website.
• Other: Details about authorised signatories, agents, or representatives and any other personal information that you choose to share with us.

Data from third parties

We may collect information about you from third-party sources, including, for example, your firm or employer, financial institutions, government sources, and other individuals. This information may include name and contact information, credit and background reports, and information from government records. By way of a further example, we may carry out electronic verification checks or screening and/or may receive information about you from a public source or a third party in order to verify your identity or check whether you are a politically exposed person, or subject to any financial sanction or as may otherwise be required by law or regulation.

Your Obligations

We may collect information from you regarding other individuals related to you/ your account. Where you disclose information regarding other individuals related to you/ your account (such information on authorised signatories, dependants, relatives, potential beneficiaries, employees, agents or other representatives), you warrant that you will only do so in accordance with applicable data protection laws; that you will ensure that before doing so, the individuals in question are provided with a copy of this Privacy Notice and made aware of the fact that we will hold information relating to them and may use it for any of the purposes set out in this Privacy Notice; and where necessary that you will obtain the other individuals' consent to our collection, use, and disclosure of their information as described in this Privacy Notice. We may, where required under applicable law, notify those individuals that they have been provided with their personal data and provide a copy of this Privacy Notice to them.

Non-provision of information

If you do not wish to provide information to us, we may be unable to provide certain products or services to you.

How we use your information

We use the Personal Data that we collect for the purposes for which it was provided to us, including as described in this Privacy Notice and as required by law. These include those purposes set out in the table below. We will only collect, use, and share your personal data for these purposes where we are satisfies that we have and appropriate legal basis (or "ground") under GDPR/ UK GDPR to do this. We have included our legal basis for each purpose for processing, in the table below. Please note this is an indicative, non-exhaustive list.

Recipients of data

We will disclose your information tot he following parties. Please note that the third parties we engage may change occasionally and this is an indicative, non-exhaustive list.

• to any member of the Pilgrim group of companies for the purposes described in this Privacy Notice
• we disclose personal data to our suppliers and vendors, such as third parties who provide SaaS, IaaS, and/ or PaaS services & support, event management, marketing services, market research, couriers and postal services, website hosting, and cloud-based services to us. They will use it to perform tasks on our behalf.
• our lawyers, advisors, and auditors who provide services to us and are subject to confidentiality obligations.
• credit reporting agencies or AML agencies for the purposes of verifying your identity.
• your agents or representatives (such as business partners, including intermediaries, financial advisers, administrators, trustees, attorneys) for the purposes described in this Privacy Notice.
• government departments, bodies or agencies, any court or tribunal or government, regulatory, law enforcement, fiscal or 

International transfers

From time to time your personal data may be transferred to countries and jurisdictions outside of the European Economic Area ("EEA") and the UK which may not have the same data protection laws in Ireland, including the United States and Ukraine. These countries and jurisdictions may have differing (and potentially less stringent) laws relating to the protection of personal information. They may also have less stringent laws relating to the degree of confidentiality afforded to your information.

Any transmission of personal data by the applicable Pilgrim controller or its delegates, which may be outside the EEA and the UK, in a country that is not recognised by the European Commission as offering an adequate level for the protection of personal data, or by the UK Government as having the appropriate standard of protection required under applicable UK laws, shall be made in accordance with the conditions in the Data Protection Legislation. More specifically, the applicable Pilgrim controller and its duly authorised delegates will:

a) enter into standard contractual clauses approved by the European Commission as well as put in place supplementary measures as recommended by the recommendations of the European Data Protection Board, to the extent required or adopt the UK International Data Transfer Agreement or Addendum, or any other appropriate safeguards available under UK law (as amended from time to time), to the extent required;
b) avail of the EU-US Data Privacy Framework, or the UK's data privacy framework with the US, which is known as the UK-US data bridge, where the importer is a participating US organisation.
c) avail of applicable derogations permitted under article 49 of the GDPR, or another legal basis.

For further information about any such transfers and/ or the relevant safeguards, please contact us as provided in the "Contact Us" section below.

Data retention

We retain personal data for as long as needed or permitter in light of the purpose(s) for which it was obtained and consistent with applicable law. The criteria used to determine our retention periods include:

• The length of time we have an ongoing relationship with you and provide our services to you (for example, for as long as you keep using our services);
  
  
• Whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them); and 
  
  
• Whether retention is advisable in light of our legal position (such as in regard to applicable statute of litigation, or regulatory investigations).

Our group companies may retain the information we share with them for such periods may be required from time to time under relevant laws and regulations, including those related to record keeping and prescription periods. Generally, your personal data will be retained until the end of your client relationship with Pilgrim or after an investment has matured/ encashed plus a reasonable period of time after that (in most cases 7 years) to: a) respond to any client account related enquiries; b) deal with any legal matters (e.g. legal proceedings); or c) comply with applicable Irish or European law.

Security of personal data

We will take all appropriate technical and organisational steps to safeguard your personal data will be restricted to those who need to use it for legitimate legal and business purposes.

We follow several industry good practices to ensure this protection is fully effective and the appropriate technical and organisational measures are in place. All personal data is provided protection in line with security and data protection policies.

All our employees and contractors receive mandatory information security and data protection training on being hired and subsequently on at least a yearly basis to ensure that they are aware of the security policies and their specific information security responsibilities. This also ensures that they are properly equipped to perform their duties in maintaining our security posture.

Consent

We sometimes need your consent to do certain things, as set out in the section above titled "How we process your data". When you consent we will: a) be clear when we are asking for your consent; b) only use your information if you have freely given us your consent to use it; c) not have any pre-ticked boxes on our forms (for example, we will not send you marketing emails unless you consent by ticking the marketing box when you apply for a service); and d) keep a record of your consent and how we got it.

You have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact us in writing (see contact details below). Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

If you choose to withdraw your consent, we may not be able to provide you with certain products and services.

Your rights

GDPR and the Irish Data Protection Acts 1988 to 2018 as amended provide you, the data subject, with a number of rights when it comes to your personal data. On receipt of a valid request to invoke one of your rights, we will do our best to adhere to your request as promptly as reasonably possible.

Access: You have the right to request a copy of the personal data that we hold about you. There are exceptions to this right so that access may be denied if, for example, making the information available to you would reveal personal data about another person or if we are legally prevented from disclosing such information.

Accuracy: We aim to keep your personal data accurate, current, and complete. We encourage you to contact us to let us know if any of your personal data is not accurate or changes, so that we can keep your personal data up to date.

Objection: You have an absolute right to object to the processing of your personal data for direct marketing. Opting out of receiving marketing communications will not affect the processing of personal data for the provision of our services.

In other cases where the right to object applies, the right is not absolute and only applies in certain circumstances.

Restriction: You have the right to ask us to block or restrict the use of your personal data. The right is not absolute and only applies in certain circumstances.

Portability: You have the right to request to move, copy or transfer personal data from one IT environment to another in a safe and secure way, without affecting its usability.

Erasure: You have the right to ask us to erase personal data we hold about you. The right is not absolute and only applies in certain circumstances.

The right to withdraw consent: If you have provided your consent to the collection, processing and transfer of your personal data, you have the right to fully or partly withdraw your consent. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose(s) to which you originally consented unless there is another legal ground for the processing. If you withdraw your consent,  this will not invalidate the lawfulness of any processing carried out on the basis of consent before you withdrew it.

For your protection, we may only implement requests wit respect to the personal data associated with the data subject making the request, or, for example, the particular email address that you use to send us your request, and we may need to verify your identity before implementing your request. We will try to comply with your request as soon as reasonably practicable. Please note that we may need to retain certain information for recordkeeping purposes or to complete any transactions that you begin prior to requesting a change or deletion.

Questions and complaints

If you have any queries or complaints in connection with our processing of your personal data or this Privacy Policy, you can get in touch with us at the following contact details:

Contact: Compliance Team, Pilgrim

Address: 4785 Caughlin Parkway, reno, Nevada 89519, U.S.A.

Email: pgacompliance@pilgrim-global.com

You may lodge a complaint with a data protection authority for your country or region where an alleged infringement of applicable data protection law has occurred. A list of data protection authorities is available at https://ec.europa.eu/newsroom/article29/item-detail.cfm.

Please provide as much detail as possible to help us deal with your request, such as the context in which we may have processed your information and the likely dates when we processed it.

If a request is submitted by a third-party representative (such as a solicitor) on your behalf, we may require additional documentation, such as a signed Letter of Authority.

Changes to this Privacy Notice

This Privacy Notice may be updated from time to time. Please check here for the most recent information on how we process your personal data.