Core Equity Holdings — Data Privacy Policy

Effective date: This Data Privacy Policy was updated on June 30, 2019 and is effective as of that date.

Scope of the Data Privacy Policy
What Personal Data is collected and processed by CEH Global?
Legal Bases for the Processing of Personal Data
For which purposes does CEH Global collect Personal Data?
To whom can CEH Global provide Personal Data?
How does CEH Global protect Personal Data?
What rights do Data Subjects have?
Can this Data Privacy Policy be changed?
How long does CEH Global keep a Data Subject’s Personal Data?
Miscellaneous
Who can Data Subjects contact with questions and requests?

1. Scope of the Data Privacy Policy

This is the data privacy policy (the “Data Privacy Policy”) of Core Equity Holdings and all of the members within its group, including such other companies forming part of the Core Equity Holdings group from time to time (defined collectively as “CEH Global” and individually a member of CEH Global, and represented by Core Equity Holdings SA (“CEH“) as sole data controller. CEH Global is committed to protecting and respecting a Data Subject’s privacy. The Data Privacy Policy sets out the basis on which CEH Global will process any personal information it collects, from companies and individuals in conjunction with its business including any personal information CEH Global may collect about Data Subjects as Visitors (the “Visitors“) to the Website or the Premises (defined below).

The Data Privacy Policy describes, in particular, how CEH, as sole data controller, collects, uses, shares, and otherwise processes Personal Data (defined below) in circumstances where CEH Global interacts with the following categories of individuals, whether online or offline, in connection with its business:

visitors to this website at https://www.coreequityholdings.com (the “Website“), which is administered by CEH Global, as well as visitors to any CEH Global offices (the “Premises”);
contact persons and Representatives (as defined below) of potential companies in which funds managed by CEH Global have made or are considering making an investment (“Investees“);
contact persons and Representatives of business partners who interact with CEH Global in relation to its business activities (“Partners“);
contact persons and Representatives of suppliers of goods and services, third party sellers, investment bankers, consultants, lawyers, accountants, and other providers, (“Suppliers and Service Providers“);
applicants that apply for a position with CEH Global either online or offline (“Applicants“); and
any other individuals about whom CEH Global obtains and processes Personal Data in relation to its business activities,

(together the “Data Subjects” and each such person a “Data Subject“).

In the Data Privacy Policy, “Representatives” refer to directors, officers, managers, employees and proxyholders and other authorized agents of the entity at stake.

The Data Privacy Policy describes the types of information CEH Global collects when it interacts with Data Subjects or Data Subjects interact with CEH Global (whether online or offline), including information relating to identified or identifiable individuals (“Personal Data“); for which purposes CEH Global uses such Personal Data; with whom CEH Global may share Personal Data; and the rights and choices available each Data Subject regarding CEH Global’s use of his/her Personal Data. This Data Privacy Policy also describes how a Data Subject’s Personal Data is secured and how a Data Subject can contact CEH Global about its privacy practices.

Please read this Data Privacy Policy before submitting any Personal Data to any CEH Global entity.

By accessing and using the Website or otherwise providing any CEH Global entity with a Data Subject’s Personal Data, for example when interacting with any CEH Global entity in relation to the business it conducts, Data Subjects confirm that they have read this Data Privacy Policy and that they understand the way CEH Global collects, processes, uses and discloses a Data Subject’s Personal Data.

For specific processing activities, CEH Global may need to obtain a Data Subject’s consent to collect and process his/her Personal Data. When CEH Global needs a Data Subject’s consent, it will ask the Data Subject, before he/she submits Personal Data to it, to confirm (electronically) that he/she consents to the processing activity at stake, as described in this Data Privacy Policy.

CEH Global collects and processes a Data Subject’s Personal Data in accordance with all applicable data protection and privacy laws and regulations it is subject to (the “Data Protection Law“) as described herein.

2. What Personal Data is collected and processed by CEH Global?

Information Data Subjects provide

CEH Global collects Personal Data about Data Subjects when they interact with it, either online or offline, for any of the purposes described under Section 4 below.

This can include the following categories of Personal Data:

Basic Identification and Contact data: including but not limited to: name, gender, title, organization, job responsibilities, phone number, mailing address, email address, contact details, background and interests;
Compliance data: including but not limited to government identifiers, passport information or other information regarding identification, date of birth, individual beneficial ownership data, and other “Know Your Customer” due diligence data as may be required from time to time;
Investee data: information that CEH Global collects, generates and receives from or about contact persons or Representatives of an Investee;
Suppliers and Service Providers data: information that CEH Global collects, generates and receives from or about contact persons or Representatives of Suppliers and Service Providers in relation to products and services CEH Global acquires from them;
Partners data: information that CEH Global collects, generates and receives from or about contact persons or Representatives of Partners in relation to CEH Global business activities;
Applicants data: information provided by Applicants, including but not limited to professional qualifications and experience, skills, preferences, motivation, interests, as well as any information that may typically be found on a curriculum vitae; and
CCTV data: images that CEH Global collects through its CCTV systems installed in its Premises for security and safety purposes (in accordance with applicable local requirements in the countries where its offices are located).

CEH Global collects the above Personal Data from a number of sources, either directly from the Data Subjects, or from Investees, Suppliers and Service Providers, Partners, Applicants and/or their respective Representatives as part of the conduct of its business.

3. Legal Bases for the Processing of Personal Data

CEH Global collects and processes Personal Data about the categories of Data Subjects identified under Section 1 for the purposes described under Section 4 on one or more of the following legal bases:

Contract Performance: the processing of Personal Data is necessary for the performance of a contract – or to take steps prior to entering into a contract – between CEH Global and the relevant Data Subject;
Legal Obligation: the processing of Personal Data is necessary for compliance with a legal obligation to which CEH Global is subject;
Legitimate Interests: the processing of Personal Data is necessary for the purposes of the Legitimate Interests pursued by CEH Global or by a third party and those interests are not overridden by the Data Subject’s interests and fundamental rights and freedoms. Such Legitimate Interests include measures to administer the relationship with Data Subjects; establishing, exercising or defending the legal rights of CEH Global; and promoting and improving CEH Global’s business (Article 6, 1. (f) GDPR “Legitimate interests“); and
Consent: in specific circumstances, the processing of Personal Data can be based on the Data Subject’s freely given consent.

4. For which purposes does CEH Global collect Personal Data?

The purposes for which CEH Global collects and processes Personal Data, and the legal bases for such processing, are as follows:

Purpose of Processing	Legal basis of the Processing
To provide Data Subjects with the services they request from CEH Global, to manage contractual relationships, for payment and invoicing and/or to answer questions about CEH Global activities,CEH Global processes: Basic Identification and Contact data, Compliance data, Investee data, Suppliers and Service Providers data, Partners data and Applicants data.	Contract Performance and Legitimate Interests
To manage CEH Global business operations, carry out CEH Global business activities and administer CEH Global Investee Companies or Portfolio Companies/Suppliers and Service Providers/Partners relationships,CEH Global uses Basic Identification and Contact data, Compliance data, Investee data, Suppliers and Service Providers data, Partners data and CCTV data. This processing is necessary in order to perform CEH Global business activities and the obligations under contracts with Data Subjects.	Contract Performance and Legitimate Interests
To provide relevant marketing such as providing Data Subjects with information about CEH Global business activities that may be of interest to them, by email or other communication means, CEH Global uses Basic Identification and Contact data, Compliance data, Investee data, Suppliers and Service Providers data, Partners data and Applicants data. It is necessary for CEH Global’s Legitimate Interests to process this information in order to provide Data Subjects with tailored and relevant marketing and updates.	Legitimate Interests and Consent
To address compliance and legal obligations, such as checking the identity of Investees/Partners and to prevent money laundering and/or fraud, CEH Global uses Basic Identification and Contact data and Compliance data.	Contract Performance and Legal Obligation
To consider individuals for employment and contractor opportunities and manage recruitment processes,CEH Global uses Basic Identification and Contact data, Compliance data, and Applicants data.	Contract Performance and Legal Obligation
To ensure safety and security at its premises, CEH Global uses CCTV data in accordance with local requirements.	Legitimate Interests
To fulfil other legitimate purposes disclosed to Data Subjects at the time they provide their Personal Data or as otherwise permitted or required to comply with applicable laws and regulation.	Legitimate Interests

CEH Global shall obtain a Data Subject’s prior express consent (opt-in) for the above-listed purposes where required under applicable law.

5. To whom can CEH Global provide Personal Data?

CEH Global does not sell or otherwise disclose Personal Data which Data Subjects provide to it or that it collects about Data Subjects, except as described below or with a Data Subject’s prior express consent.

It may be necessary to share a Data Subject’s Personal Data with:

affiliated companies of CEH Global for the purposes described in this Data Privacy Policy primarily for business and operational purposes;
certain third parties in the event of a merger, acquisition, sale of assets, joint venture, or any other transaction that results in a change in control or ownership of CEH Global, in whole or in part; or in the event of a corporate reorganization, bankruptcy, insolvency proceeding, or similar circumstance, if permitted by and done in accordance with applicable law; or
third party service providers and suppliers acting on behalf of and under instruction of CEH Global, that provide services to it such as web-related services, analytics, IT services, management and administrative services so that it can perform its business activities, administer web servers and to store information on back-up disks. Such third parties can only use the data for the above-mentioned purposes.

Except as described above, CEH Global shall not provide a Data Subject’s Personal Data to other third parties without obtaining their prior permission, unless it is required to do so under a statutory provision or court order. In particular, CEH Global may disclose a Data Subject’s Personal Data in the following circumstances:

to respond to authorized information requests from law enforcement authorities or judiciary or when otherwise required or permitted by law; or
to respond to an emergency; or otherwise to protect the rights, property, safety, or security of third parties, visitors to the Website or the public.

These recipients may be located in countries other than the country in which Personal Data was originally collected, inside or outside the European Economic Area (“EEA“).

Certain recipients may be a CEH Global entity located in Hong Kong or in the Cayman Islands, (which are countries that have not been recognized by the European Commission as providing an adequate level of protection of Personal Data within the meaning of the applicable Data Protection Law).

Any transfer of Personal Data to one of the above recipients located in a country outside the EEA that is not recognized as providing an adequate level of data protection, will be made on the basis of data transfer agreement(s) conforming to the EU Commission Standard Contractual Clauses for the transfer of data to third countries (Article 46, 2., (c) of the GDPR, as of 25 May 2018), or (ii) other appropriate safeguards or derogations in accordance with applicable Data Protection Law. A copy of the relevant data transfer agreements may be obtained by using the contact details below (see Section 11).

In specific situations, transfers of a Data Subject’s Personal Data may be based on their explicit consent, after having been informed of the possible risks of such transfers for Data Subjects.

6. How does CEH Global protect Personal Data?

CEH Global takes, and requires that any service provider and/or third party processor processing Personal Data on behalf and under the instructions of CEH Global takes appropriate technical and organizational measures to protect a Data Subject’s Personal Data against accidental or unlawful destruction or accidental loss, misuse, unauthorized access, disclosure, alteration or destruction, and against any other unlawful form of processing of information as defined by the applicable law.

However, please note that no electronic transmission or storage of information is 100% secure. Therefore, despite the security measures that CEH Global has put in place to protect a Data Subject’s Personal Data, it cannot guarantee that loss, misuse, or alteration of data will never occur.

7. What rights do Data Subjects have?

Under applicable Data Protection Law, Data Subjects have the following rights (under the conditions set out in applicable Data Protection Law): (i) to access Personal Data CEH Global holds about Data Subjects, (ii) to request rectification or erasure of Personal Data about Data Subjects, (iii) to request CEH Global to restrict the collection, processing or use of Personal Data about Data Subjects, (iv) in certain circumstances, to object for legitimate reasons to the processing of a Data Subject’s Personal Data (including the right to object, upon request and free of charge, to the processing of Personal Data for direct marketing purposes), and (v) to request data portability. Data Subjects also have the right to lodge a complaint with the competent supervisory authority.

If a Data Subject wants to exercise his/her rights under applicable law, or for more details and questions relating to CEH Global’s data processing activities, Data Subjects may make contact by sending a signed request, together with a valid identification document, to the address below or via e-mail to the contact address set out in Section 11.

8. Can this Data Privacy Policy be changed?

Except to the extent limited by applicable law, CEH Global may decide at any time, at its discretion, to change, modify, and/or add to all or parts of this Data Privacy Policy in the future as permitted by law. Any change to this Data Privacy Policy will be posted on this page and, notified to Data Subjects by e-mail (where appropriate or required by law and to the extent that we have a Data Subject’s e-mail address). CEH Global will indicate the date on which this Data Privacy Policy was last modified.

9. How long does CEH Global keep a Data Subject’s Personal Data?

Personal Data will not be kept for longer than reasonably necessary for the purposes identified herein, which may be for up to ten years after the end of a Data Subject’s contractual relationship with CEH Global (if any), unless shorter or longer retention periods apply under applicable law.

CEH Global may retain a Data Subject’s personal data relating to a specific job application and selection process to which Data Subjects participated for a period of 5 years following the selection process.

10. Miscellaneous

What are the consequences of not providing Personal Data?

Data Subjects are not required to provide all Personal Data identified in this Data Privacy Policy to use the Website or to interact with CEH Global offline. If Data Subjects do not provide Personal Data, CEH Global may not be able to respond to a Data Subject’s request, provide its services to Data Subjects, or provide them with information that it believes they would find valuable.

Does CEH Global engage in automated decision-making without human intervention?

CEH Global does not use automated decision-making without human intervention, including profiling, in a way that produces legal effects concerning Data Subjects or otherwise significantly affects them.

11. Who can Data Subjects contact with questions and requests?

If Data Subjects have any questions on CEH Global’s Data Privacy Policy, or to exercise a Data Subject’s rights under applicable law, Data Subjects may contact us by email at cehprivacy@coreequityholdings.com or at the contact address below:

Core Equity Holdings SA
326 Avenue Louise
1050 Brussels
Belgium

Core Equity Holding SA is the representative of Core Equity Holding Limited in the EU for the purpose of Data Protection Law.

Data Privacy Policy

Contents