Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). We only collect personal information which we need and that is relevant for the purposes for which we intend to use it.

We may collect information if you are an investor or prospective investor, or connected with a portfolio company or prospective portfolio company or otherwise provide us with your personal information. The information that we may collect and process depend on the data subject, however, the most likely categories are the following:

• Name;
• Date of birth;
• Contact details (residential address, email address, telephone number);
• Identification number (passport number, NI number); and
• Bank account details.

We use your personal information to establish and administer your investment, comply with relevant laws and regulations such as the Anti-Money Laundering and Counter-Terrorism Financing Act and to communicate with you about your investment.

Most commonly we will use your personal data where it is necessary for our legitimate interests and your interests and fundamental rights do not override those interests. For example:

• If you are an investor or prospective investor in one of our funds, we may use your data in connection with that investment, or
• If you are connected with a portfolio company or prospective portfolio company, we may use your data in connection with the monitoring and management of our investment.

Personal information may be used for secondary purposes such as the provision of promotional and marketing material. You can contact us at any time if you do not wish to receive such materials or information.

Where we collect your personal information for a specific purpose (not contemplated in this Privacy Policy), you will be provided with a collection notice which explains the primary purpose (and any related secondary purposes) for which your personal information is being collected.

We do not actively seek to collect sensitive information (for example health information or information about any criminal record), unless it is necessary for business purposes. If we do have to collect sensitive information, we will only collect, use and disclose it in accordance with privacy laws.

We process all data in accordance with the EU General Data Protection Regulation. We may disclose your personal information to:

• Our external service providers that provide investment administration, registry, custody and/or other services;
• Any joint holder of an investment;
• Parties authorised by you such as a licensed financial adviser, dealer group or service provider; and
• Governmental or regulatory bodies and agencies (such as FCA, HMRC, JFSC or a law enforcement agency).

Alicorn uses third party investment administrators and registries to support the administration of our financial products. We have contractual arrangements with these service providers to ensure they comply with privacy laws when dealing with your personal information.

Your personal information may be provided to external service providers in offshore locations such as Jersey.

You have certain rights by law including the right to access your information held by us (for which we may charge a small administrative fee) and to have any inaccurate information corrected.

The law on data protection sets out several different reasons for which a company may collect and process your personal data, including:

• Consent: In specific situations, we can collect and process your data with your consent.
• Contractual obligations: In certain circumstances, we need your personal data to comply with our contractual obligations.
• Legal compliance: If the law requires us to, we may need to collect and process your data.
• Legitimate interest: In specific situations, we require your data to pursue our legitimate interests in a way which might reasonably be expected as part of running our business and which does not materially impact your rights, freedom or interests.

GDPR gives you (as an individual) a number of rights in respect of your data, including:

• Right to access: You have the right to access the information we hold about you. We may request proof of your identity before sharing such information.
• Right to rectify your personal data: If you discover that the information we hold about you is incorrect or out of date.
• Right to be forgotten: You may ask us to delete information we hold about you in certain circumstances. It may not be possible for us to delete all of the information we hold about you where we have an ongoing relationship.
• Other rights: In addition to the above, you may also ask us to stop or restrict processing of the information we have about you. You may also ask us to transfer your personal information to a third party in certain circumstances.

If you require access to, or wish to update your personal information, please contact our Data Protection Officer. A link may be found in the ‘Contact’ Section of the website.

We take all reasonable steps to protect your personal information from misuse, loss, unauthorised access, interference, modification or disclosure.

We have physical, electronic and procedural safeguards to protect your information which is held by us. For example, your personal information is stored in secured office premises and/or in electronic databases requiring logins and passwords for access. Access to information stored electronically is restricted to staff whose job purpose requires access. We also require all staff to maintain the confidentiality of customer information.

We use secure methods to destroy or de-identify any personal information as soon as the law permits, provided the information is no longer required.

Our service providers are required to notify us of any unauthorised access, disclosure or loss of personal information.

In such a circumstance, Alicorn performs an assessment to determine if there has been an ‘eligible data breach’ which means a breach of security leading to the destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. The Firm will have to notify the Information Commissioner’s Office (ICO) of an eligible data breach where it is likely to result in a risk to the rights and freedoms of Data Subjects.

If this is the case, the individuals affected will also be notified as soon as practicable of the details of the breach and the recommended steps to take in response to it.

Alicorn Limited

Floor 1, 16 Albemarle Street, London, England, England, W1S 4HW

Email: [email protected]

We will endeavour to answer any questions, correct any error on our part or resolve any complaint you may have about our information handling practices.