Genstar Supplemental GDPR Privacy Policy

Introduction

To the extent that the EU General Data Protection Regulation, the UK General Data Protection Regulation and other UK and/or EU data protection and privacy legislation (“Data Protection Legislation”) apply to Personal Data (defined below) that Genstar Capital LLC (“Genstar”, “we”, “us”, “our”) collects, processes (defined below) and uses in relation to its current, former and prospective investors (“Investors”), this is the privacy policy (“Policy”) that applies to such collection, processing and use. For the purposes of Data Protection Legislation, Genstar acts as a controller in respect of your Personal Data.

The definitions below shall apply to this Policy:

“Personal Data” means information that relates to an identified or identifiable living individual.

“process” or “processing” means any operation that is carried out in respect of Personal Data, including but not limited to collecting, storing, using, disclosing, transferring or deleting Personal Data.

“you”, “your” means a living individual, who may be an Investor; or an employee, director, officer, trustee, beneficiary, or representative or intermediary of an Investor.

This Policy was last updated on February 7, 2023. This Policy may change from time to time. The most up to date version of this Policy can be found at https://www.gencap.com. Please check this Policy from time to time to review any changes that we might make.

If you have any questions or concerns about Genstar’s handling of your Personal Data, or about this Policy, please contact privacy@gencap.com.

Personal data we collect

Genstar needs to obtain certain Personal Data about you in order to perform the services we offer and provide, and to comply with applicable law. Genstar will collect your Personal Data directly from you; from a third party acting on your behalf, for example an intermediary, lawyer or service provider; from publicly available sources; from other organizations; and when we generate it ourselves.

Such Personal Data may include:

details of your name, age, date of birth, e-mail address, address, telephone number, identification number, online identifier, location, gender, nationality, citizenship and other contact information;
financial information or other information obtained as a result of your investment in any of our funds (such as advisor details, investment details, banking details, and financial details);
for any tax implications related to your financial activities, your tax identification number and details of tax residency;
data provided by you so that we are able to conduct background checks, anti-money laundering, regulatory, tax and know your client checks (such as data included in identification documents, details of criminal records and sanctions);
a file with your contact history;
information relating to the services we provide to our Investors; and
information required as a result of legal, tax and regulatory requirements or internal policies.

If you do not provide certain Personal Data to us when requested (and where relevant, provide your consent), we may not be able to provide you with some or all of our services and products.

How we use your personal data

Your Personal Data will be collected, stored, disclosed and processed by Genstar for the following purposes:

to assess your application for our products and services and to provide you with the products and services for which you subscribe;
to understand your needs and interests and to respond to your enquiries;
to analyze and improve our services and to manage our business;
to comply with and in order to assess compliance with applicable laws, rules and regulations (including tax reporting purposes pursuant to tax legislation), industry codes, voluntary codes we decide to adopt, or good practice, anywhere in the world and internal policies and procedures;
to confirm and verify your identity and to conduct due diligence, background and related checks (this may involve the use of a credit reference agencies and/or other third parties acting as our agents to conduct these verifications and related reviews including screens against publicly available government and/or law enforcement agency sanctions lists);
to detect, investigate and prevent fraud and other crimes or malpractice;
for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings);
to obtain legal advice or to establish, exercise or defend legal rights;
for the administration and maintenance of databases storing Personal Data;
to comply with our contractual obligations; and
for purposes otherwise set out in this Policy or as notified to you at the specific time of collection.

We are entitled to use your Personal Data for the purposes listed above because one or more of the following legal bases applies:

in order to perform our contractual obligations to you (for example, in order to manage your investments);
we have obtained your specific and informed consent;
discharge of a legal or regulatory obligation;
in order to establish, exercise or defend our legal rights or for the purpose of legal proceedings; or
the use of your Personal Data as described is necessary for our legitimate business interests or the legitimate interests of a third party provided such interest are not overridden by your rights or interest, including: (i) so that we can effectively and efficiently administer and manage the operation of our business; (ii) so that we can be compliant with internal policies and procedures.

To the extent permitted by applicable law, we may contact you by mail, e-mail, SMS/text, telephone and other electronic means to provide information on products and services that we believe will be of interest, unless you object to receiving such information. If you do not want to receive such communications from us please contact us using the details set out in the Introduction or by using the opt-out facilities provided within the relevant marketing material.

Your option not to receive promotional and marketing material: (a) shall not preclude us from corresponding with you, by email or otherwise, regarding your relationship with us (e.g., your account status and activity or our responses to questions or inquiries you pose to us); (b) shall not preclude us, including our employees, contractors, agents and other representatives, from accessing and viewing your Personal Data for our internal business purposes; and (c) shall not preclude us from disclosing your Personal Data as described in this Policy for purposes other than sending you promotional and marketing materials.

Disclosure of your personal data

Genstar may share or provide access to your Personal Data among its affiliates and business units and third party agents, service providers and contractors that perform services on our behalf, including but not limited to administrators, lenders, banks, auditors, law firms, governmental agencies or pursuant to legal process, self-regulatory organizations, consultants and placement agents outside of Genstar:

for the purpose of the management and administration of Genstar’s business;
in order to facilitate the provision and enhancement of services to you (including the management of your investments);
for the purpose of the administration and maintenance of the databases storing Personal Data;
for the purposes of Genstar receiving services. Third parties are expected to be subject to confidentiality requirements (either by contract, professional obligation, duty or otherwise) that require them to only use your Personal Data as described in this Policy;
to the extent required by law, or to establish, exercise or defend its legal rights. This may include disclosure to regulatory bodies or government agencies);
as part of a transaction, financing, or for other business needs; or
if Genstar or any of its affiliates, divisions or business units is acquired by a third party, including in the unlikely event of a bankruptcy, in which case the Personal Data held by Genstar about you will be accessible to, and may be acquired by, the third party buyer;
if you have agreed to such disclosure in applicable offering documents of our products and services or other agreements we have with you.

International transfers of personal data

The global nature of our business means that your Personal Data may be processed and disclosed as described above, in any country in which we conduct business or have a service provider. Whenever we transfer or permit access to your Personal data out of the UK or EU as applicable, we ensure a similar degree of protection is afforded to it (as is afforded to it in the UK/EU) by ensuring at least one of the following safeguards is implemented:

we will only transfer your Personal Data to countries that have been deemed to provide an adequate level of protection for Personal Data;
we may use specific contractual clauses or agreements approved for use in the UK/EU which afford Personal Data the same protection it has in the UK/EU.

Please contact us if you want further information on the specific mechanism used by us when transferring your Personal Data out of the UK or EU.

How we safeguard personal data

Genstar have implemented and maintains commercially reasonable physical, electronic and procedural safeguards, measures and controls to protect Personal Data and to maintain the security of our information and information systems in respect of Personal Data. Genstar also has internal controls to keep investor information as accurate and complete as practicable. If you believe that any information we hold about you is not accurate, please contact us using the contact information set out in the Introduction.

Retention and destruction of personal data

The period for which Genstar will hold your Personal Data will vary and will be determined by the following criteria:

The purpose for which we are using it. We are required to retain the Personal Data for as long as is necessary to satisfy or meet the purposes for which it was obtained including applicable legal or regulatory requirements; and
Legal Obligations. Laws or regulations may set a minimum period for which we must retain your Personal Data.

We will take reasonable steps in the circumstances to destroy your Personal Data when we no longer have a legal basis to retain it or to ensure that the information is anonymized.

Your rights

You may have legal rights in relation to the Personal Data we hold about you. These rights are:

the right to refuse to provide any Personal Data and the right to object at any time to the processing of your Personal Data;
the right to confirm whether we process your Personal Data and to obtain information regarding the processing of your Personal Data and access to the Personal Data about you that we hold;
where consent was provided for certain processing activities, the right to withdraw your consent to the collection, processing, use and/or disclosure of your Personal Data at any time. This will not affect the lawfulness of any collection, processing, use or disclosure undertaken before your withdrawal and that we may still be entitled to process your Personal Data if it has another legitimate reason (other than consent) or a consent exception for doing so;
in some circumstances, the right to receive a copy of some Personal Data in a structured, commonly used and machine-readable format and/or request that we transmit that data to a third party where this is technically feasible. This right only applies to Personal Data that you have provided to us;
the right to request that we rectify or correct your Personal Data if it is inaccurate or incomplete;
in some circumstances, the right to request that we erase your Personal Data;
in some circumstances, the right to request that Genstar restrict, anonymize or block its processing of your Personal Data;
where applicable, the right to lodge a complaint with the data protection regulator in your jurisdiction if you think that any of your rights have been infringed by Genstar.

You can enquire about your rights, which are applicable to you, by contacting us using the details set out in the Introduction. Please note that if you choose to exercise certain of these rights, such request may prevent us from providing services to you and that there may be circumstances where Genstar is legally entitled to retain Personal Data regardless of your request.