Gen II Fund Services | Leader in Private Capital Fund Administration

Public Privacy Statement

At Gen II, we are committed to your privacy and data protection, and we believe in the empowerment of your privacy rights. This Privacy Statement describes how we may collect and use information relating to you as an identified or identifiable natural person ("Personal Data"), whether directly or indirectly, manually or via automated means or otherwise.

Please note that as our use of your Personal Data depends on how you interact with us, our services and/or our website, not all parts of this Privacy Statement may apply to you.

If you work for or are seconded to Gen II, please refer to the Gen II Staff Privacy Statements.If you are seeking employment with Gen II, please refer to the Gen II Candidate Privacy Statement, which can be found here and within each job opening description.For more information about the cookie collection on our website, please refer to our Cookie Notice.

Gen II (or "we", "our", "us") refers to one or more of the legal entities of the Gen II Group which you may have a business engagement or other relationship or in general interact with. Gen II Luxembourg Services SARL, located at 22, Rue des Bruyères, L-1274 Howald, has been designated as Gen II's representative in the European Union for data protection matters, pursuant to Article 27 of the General Data Protection Regulation.

Gen II processes Personal Data in compliance with applicable laws and regulations, in particular in accordance with: the Regulation (EU) 2016/679 ("GDPR"); the UK's retained version of Regulation EU 2016/678 and the Data Protection Act 2018 ("UK GDPR"); the Data Protection (Jersey) Law 2018 and the Data Protection Authority (Jersey) Law 2018 ("Jersey DPL"); the Data Protection (Bailiwick of Guernsey) Law, 2017 ("Guernsey DPL"); the Data Protection Acts 1988 to 2003 and the Data Protection Act of 2018 of the Republic of Ireland; the Canadian Personal Information Protection and Electronics Documents Act ("PIPEDA"); as well as the California Consumer Privacy Act ("CCPA") as amended and/or replaced by the California Privacy Rights Act ("CPRA"). All applicable laws are collectively referred to as "Data Protection Legislation".

Each of the Gen II legal entities shall act independently as a controller / data controller, within the meaning of the Data Protection Legislation, depending on the purposes described herein.

Accessibility: If you require support or an alternative format to review this Privacy Statement, please contact us through any of the contact methods listed below.

1. Personal Data We May Collect

The Personal Data we may collect or generate about you depends on your interactions and engagement with us, be it through our website and social media pages, our service offering, or collaboration with our service providers and stakeholders. We may at times collect the following categories of Personal Data:

Data automatically collected or generated – When you visit our website or interact with software and applications that we either own or are licensed to use, we may collect data such as your connectivity, technical and aggregated usage data, your IP address and public location, device and application data (like type, operating system, mobile device or app id, browser version, language settings), date and time stamps of usage, the relevant cookies and other tracking technologies installed on or interacted with via your device, and your activity (including sessions, clicks, use of available features, logged interactions). We use analytics tools (e.g., Google Analytics or Adobe Analytics) to collect data about the use of our website and other applications, such as frequency of visits, pages visited, source of visit, and interactions with our various online features. More information regarding the use of cookies can be found in our Cookie Policy.
Contact details, such as your name, surname, job title, email address, professional or home address, country of residence, and phone number.
Photo, image or likeness and information related to access and video-surveillance logs (collected via our badge readers and video-surveillance systems in our premises).
Financial and tax-related information, such as your income, tax identification number, tax residency, tax status, payment or bank account details, and shares — but only when necessary for us to provide our services directly to you or to our clients. This also includes your source of wealth and source of funds information in the context of our statutory obligations under anti-money laundering, countering terrorist and proliferation financing, sanctions, and due diligence requirements.
Identification and background information, such as your name, birthday, national ID, passport, immigration visa, social security number, signature, occupation, professional and employment information (including level of education, professional qualifications, professional/regulatory body memberships, present employment, employer's name, and details of directorships and other offices held), and information collected in the context of regulatory and security background and compliance checks.
Information you choose to upload on social media when you render your account public and interact with us online or include relevant links in your communications with us. This may include your photo, lifestyle and social circumstances, marital status, members of your family, and employment and education details.
Customer and vendor data such as billing details, business needs and preferences. Such information will not be treated as personal data to the extent it concerns a legal entity and therefore not an identifiable human being (e.g., corporate bank account, billing address, or generic email address).
Special categories of Personal Data may sometimes be collected and processed, but this will be limited to what is required to provide relevant services, meet a legal or regulatory obligation, or where expressly permitted by Data Protection Legislation or where we have first obtained your explicit consent. Special Categories include information about racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, sex life, and sexual orientation, as well as, in certain countries/territories, criminal record and sanction screening data. Unless required, we will not actively ask you to provide such Personal Data.

Where we are provided with your Personal Data indirectly (mainly via our clients or other third parties), we take steps to ensure that you are informed and that our interlocutors comply with their own obligations under the Data Protection Legislation.

Save where we may administer trusts to which there are child beneficiaries, we do not knowingly collect or process Personal Data from children under the age of sixteen (16). If you are a parent or guardian and become aware that your child has provided us with their Personal Data, please contact us.

2. How We Use Your Personal Data

We use your Personal Data adhering to the basic principles of the Data Protection Legislation for specific and limited purposes and only where we have a valid legal basis.

a. In the context of our services and business relationships

For the performance of an agreement, or for entering into an agreement with you
To provide you with access to our portals and software applications
To provide, improve, and secure our services or as otherwise required in connection with our services to you or our clients
To internally facilitate and streamline our operations via procedures, workflows, and related tools
To fulfill our legitimate interest in the effective and lawful operation of our business
To manage our relationships with clients, prospective clients, suppliers, service providers, subcontractors, and external consultants, including client account opening, risk assessment, financial accounting, invoicing, ongoing relationship management, and communication of service offerings
To respond to your inquiries and communications and send you information as part of the services
To make sure we have a business continuity plan in place
To facilitate services we receive from professional advisors such as lawyers, accountants, auditors, and consultants
To maintain a digital mail office for incoming and outgoing correspondence, including in the context of domiciliation services
To identify client opportunities and ensure external representation of Gen II, cross-border collaboration, reporting on sales activities, and education of new salespeople
To share references with potential clients to the extent you have not objected
To ensure security threat protection and prevention of data breaches and cyberattacks
To configure and manage access rights for visitors in order to prevent unauthorized presence in our offices
To facilitate spaces arrangement (office and parking) for visitors
For the security of access to the internal Wi-Fi Network
For quality control of client deliverables, internal incident reporting, and implementation of security controls
To transfer your call messages or other communications to the concerned staff members

b. For our legal and regulatory obligations

To verify your identity, where we are legally allowed or obliged to do so
To comply with our legal or regulatory obligations (such as anti-money laundering/know your customer obligations, customer and vendor due diligence, commercial, tax, regulatory or reporting duties)
To confirm the good standing of service providers, prevent fraud, anti-money laundering, and terrorist financing
To prevent potentially illegal activities and screen for and prevent undesirable or abusive activity (phishing, spam, etc.), fraud, and credit risk
To protect the rights, property, or safety of Gen II and its assets, including our offices, IT infrastructure, proprietary software, employees, clients, visitors, or contractors
To manage litigation and other claims or complaints and to alert and assist enforcement authorities in case of incident or unlawful act

c. In the context of our website and online presence

To administer, operate, maintain, and support our website, social media, and other online applications
To understand and analyze usage trends and preferences, create internal statistics and reporting
To understand how our services are used and how our campaigns are performing
To enhance Gen II's online visibility in marketing, advertising, and selling our services
To facilitate and optimize marketing campaigns, measure their effectiveness, and manage and deliver advertisements more effectively, including on other websites and applications — including contextual, behavioral, and interest-based advertising
To address Gen II commercial communications to you (where you have agreed and for as long as you do not opt out), or to notify you about changes to our services
To ensure business development and related promotional activities such as client or employee testimonials or reviews
To enable your contact with the Company via the website
To communicate with clients and prospects, manage newsletter subscriptions, and produce statistics and reporting
To facilitate recruitment on publicly available platforms

To organize events and other online or offline initiatives in the context of our Corporate Social Responsibility and to extend invitations, prepare related communications and promotional material, press releases, articles, interviews, or other content

3. Source of Collection of Personal Data

Gen II may collect your Personal Data through various sources:

a. Directly from you

Forms and documents you complete and provide to us by way of enquiry or as required in respect of the services we provide
Documents submitted as part of our due diligence gathering procedures and/or in compliance with statutory or regulatory requirements
Personal information provided by way of correspondence with us by telephone, email, or otherwise

b. From third-party sources

Legal entities in which you have an ownership, management, or employment interest
Your or your entities' professional advisors
Company registries, court databases, published sanctions/sanctions databases, financial crime databases, or credit reference databases
Other financial institutions who hold and process your personal information and may share it with us
Regulators or other official authorities with jurisdiction over us or those structures we administer
Other publicly available information such as published articles and online content

c. From system-generated information

CCTV and/or electronic swipe card use in our different office premises
Cookies and similar technology in use on our website(s)
IT system monitoring in the event we provide you with access to our IT systems or any form of client portal

4. How We May Share/Disclose Your Personal Data

In order to achieve the purposes listed above, we may disclose your Personal Data in the following situations:

a. To our affiliates and members of the Gen II Group: We may share your Personal Data with our affiliates when necessary to provide you with our services or when asked by our clients to do so. All affiliates are required to abide by this Privacy Statement.

b. With our service providers, consultants, advisers, insurers, auditors, or business partners: Where necessary to support or administer our services and business, including promotion thereof. Third parties processing your Personal Data on our behalf will receive only limited Personal Data for the specific purpose for which they have been appointed. We enter into confidentiality and data processing agreements with all partners to ensure compliance with high levels of confidentiality, privacy, and security standards.

c. With a client's own approved service providers where Gen II is providing services and, in its capacity as processor, is following instructions to do so.

d. Public authorities and related bodies: To the extent required under applicable laws and where necessary to comply with our own legal and regulatory obligations.

e. For business transfers: We may disclose and transfer your Personal Data if we are involved in a merger, sale, acquisition, restructuring, reorganization, dissolution, bankruptcy, or other change of ownership or control.

f. With other online users or the public: When you share your Personal Data or otherwise interact in public areas or online (for example on our social media platforms), such information may be viewed by other users and may be publicly distributed outside.

g. With your consent: We may disclose your Personal Data for any other purpose with your consent. Should you participate in events, workshops, trainings, or other initiatives organized or sponsored by Gen II, your image or likeness may appear on photos or videos taken by Gen II or on its behalf and may be shared publicly. If you wish to object to such publication, please contact us via the means described below.

5. Where We May Transfer Your Personal Data

We maintain, store, and process your Personal Data in the following locations:

Within the European Economic Area or certain other countries or territories deemed to provide adequate safeguards by the European Commission, in particular in Luxembourg, Ireland, Jersey, Guernsey, and the UK
Within the United States of America, if you are mainly interacting with our Gen II entities in the US or via our website

Your Personal Data may also be transferred to other locations as reasonably necessary in the context of our collaboration with certain recipients mentioned above.

Where transfers occur to locations not considered adequate by the European Commission, Gen II will ensure those transfers are covered by appropriate safeguards such as Standard Contractual Clauses approved by the European Commission or the UK, Jersey, Guernsey, or any other additional mechanism authorized under applicable Data Protection Legislation.

Gen II is committed to the standards established in the EU-US Data Privacy Framework, the UK Extension to the EU-US DPF, and the Swiss-US Data Privacy Framework (Swiss-US DPF). For more details, please see Section 9.

6. How Long We Store Your Personal Data

We will store your Personal Data only for as long as necessary for the relevant processing activity to be completed and/or for the retention period necessary for us to comply with our legal and regulatory obligations, resolve related disputes, and enforce our legal agreements and policies.

Anonymized data may be maintained by Gen II for longer periods of time, as necessary for reporting, statistics, training purposes, and to strengthen our security or improve our services.

7. How We Protect and Secure Your Personal Data

We use a range of administrative, technical, and physical safeguards to keep your Personal Data secure, accurate, and up to date, and to protect it from loss, misuse, unauthorized access, disclosure, unauthorized alteration, or unlawful destruction. We will manage and maintain Personal Data Breach records in a privacy software tool.

Our measures include:

a. Education and training for all staff to ensure awareness of our privacy obligations when handling personal data

b. Administrative and technical controls to restrict access to your Personal Data on a "need to know" basis

c. Technological security measures, including firewalls, encryption, anti-virus software, and other controls performed as part of our cybersecurity program

d. Physical security measures to access our premises

Please note that transmission of your Personal Data via the Internet is not guaranteed to be secure. Although we do our best to protect your Personal Data, we cannot guarantee its security when transmitted to us.

8. Your Rights

You have the following rights regarding the processing of your Personal Data by us, subject to applicable exemptions:

Right to access the Personal Data held about you and receive additional information about how it is processed, including purposes, categories of data concerned, and recipients. Two requests per year will be free of charge; more frequent requests may be subject to a reasonable fee.
Right to correct or complete any inaccurate or incomplete Personal Data
Right to erasure of your Personal Data from our systems (e.g., where it is no longer necessary in relation to the specified purposes)
Right to restrict the processing of your Personal Data in certain circumstances (e.g., where you contest its accuracy or consider the processing unlawful)
Right to data portability — to receive your Personal Data in an interoperable format, or have it directly transmitted to another organization
Right to withdraw consent at any time where you have provided us with your consent to the processing of your Personal Data
Right to object to the processing of your Personal Data (in particular where we rely on legitimate interests, including for profiling)

You also have the right to lodge a complaint with the competent Data Protection Authority. We would always ask that you first notify any grievance in writing to our Global Data Protection Officer at the contact details below, to enable us the opportunity to resolve your issue first.

To exercise any of these rights or if you have any questions, please contact our Global Data Protection Officer at Privacy@gen2fund.com. We will respond to individual complaints and questions and will investigate and attempt to resolve all complaints within the timeframes set out by applicable Data Protection Legislation — typically one (1) month or four (4) weeks.

9. EU-US Data Privacy Framework, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework

The following Gen II U.S. entities adhere to the EU-U.S. DPF Principles, including as applicable under the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF Principles:

Gen II Fund Services (Colorado), LLC; Sensr Solutions, LLC; Gen II Compliance Services, LLC; Gen II Fund Services (Texas), LLC; Gen II Management, LLC; Gen II Tax Services, LLC; Gen II Fund Services (Florida), LLC; Gen II Fund Services (New Jersey) LLC; Gen II Fund Services (California), LLC; Gen II Fund Services, LLC.

Gen II complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. If there is any conflict between the terms in this privacy policy and the DPF Principles, the Principles shall govern.

To learn more about the Data Privacy Framework (DPF) Program and to view our certification, please visit https://www.dataprivacyframework.gov/.

We are subject to the investigatory and enforcement powers of the Federal Trade Commission ("FTC").

Individual Rights of EU, UK and Swiss individuals: You have the right to access your Personal Data and be able to correct, amend, or delete that information where it is inaccurate or has been processed in violation of the DPF Principles. You also have the right to request that we limit the use and disclosure of Personal Data. To exercise this right, please contact the Global Data Protection Officer at privacy@gen2fund.com.

Accountability for Onward Transfer: Gen II may share your Personal Data with external third parties who are performing services on behalf of Gen II. Such third parties have access to Personal Data solely for the purposes specified in the applicable service contract. Gen II remains responsible and liable under the DPF Principles if a third party processes personal data on our behalf in a manner inconsistent with those Principles.

Dispute Resolution — Independent Recourse Mechanism for EU, UK and Swiss individuals: In compliance with the EU-U.S. DPF, the UK Extension to the EU-US DPF, and the Swiss-U.S. DPF, Gen II US commits to cooperate and comply with the advice of the panel established by the EU Data Protection Authorities ("DPAs"), the UK Information Commissioner's Office ("ICO"), and the Swiss Federal Data Protection and Information Commissioner ("FDPIC") with regard to unresolved complaints.

To contact us regarding any transfers made under the DPF, please reach out to our Global Data Protection Officer at privacy@gen2fund.com.

If you have not received a timely or satisfactory response, you may seek further assistance at no cost from the EU DPA panel. Individuals can invoke this right by contacting their national DPA: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en

Under certain conditions, you may also invoke binding arbitration for residual claims not resolved by other redress mechanisms: https://www.dataprivacyframework.gov/s/article/G-Arbitration-Procedures-dpf

10. Special Notice to California Residents

This section supplements the information provided herein and applies solely to visitors, users, and other individuals who reside in the U.S. State of California. The purpose of this section is to demonstrate our compliance with the CCPA, CPRA, and other California privacy laws.

Information we collect: We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device ("Personal Information"). We have collected the categories of Personal Information detailed under Section 1 herein within the last twelve (12) months.

Sensitive Personal Information: We may collect the following types of Sensitive Personal Information as defined in the CCPA/CPRA:

Personal Information that reveals a consumer's social security number, driver's license number, state ID card number, and passport number
Personal Information that reveals a consumer's financial account number, debit card number, or credit card number

Personal Information does not include:

Publicly available information from government records
De-identified or aggregated consumer information
Information excluded from the CCPA's scope, such as health or medical information covered by HIPAA, information covered by the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA), the California Financial Information Privacy Act (FIPA), or the Driver's Privacy Protection Act of 1994

Sources: We obtain the categories of Personal Information listed above from: directly from our clients or their agents; indirectly from our clients or their agents; directly and indirectly from activity on our website or other software applications; and from third parties that interact with us in connection with services we perform.

Use of Personal Information: We may use the Personal Information we collect for one or more of the purposes identified under Section 2. We do not collect additional categories of Personal Information or use the Personal Information collected for materially different, unrelated, or incompatible purposes without providing you notice.

Sharing Personal Information: We may disclose your personal information to a third party for a business purpose. When we do so, we enter a contract that describes the purpose and requires the recipient to keep that Personal Information confidential. In the past 12 months, we have not sold any Personal Information.

CCPA Privacy Rights include:

Access to specific information and data portability rights: You have the right to request that we disclose certain information to you about our collection and use of your Personal Information over the past 12 months, including: the categories of Personal Information collected; the categories of sources; our business or commercial purpose for collecting or selling/sharing; the categories of third parties with whom we share; and the specific pieces of Personal Information collected about you.

Right to limit the use and disclosure of Sensitive Personal Information: You have the right to request that we limit our use and disclosure of your Sensitive Personal Information. Once we receive and confirm your verifiable consumer request, we will stop using or sharing your Sensitive Personal Information, except as necessary to perform our services or as permitted by applicable laws.

Right to correct: You have the right to correct inaccurate Personal Information. Once we receive and confirm your verifiable consumer request, we will make commercially reasonable efforts to correct it.

Right to opt-out of Personal Information sharing: You have the right to request that we stop sharing your Personal Information and Sensitive Personal Information, including for the purposes of cross-context behavioral advertising.

Deletion Request Rights: You have the right to request that we delete any Personal Information collected from you and retained, subject to certain exceptions. We may deny your deletion request if retaining the information is necessary to: complete the transaction; detect security incidents; debug products; comply with a legal obligation; or for other lawful purposes compatible with the context in which you provided it.

Exercise Access, Data Portability and Deletion Rights: To exercise these rights, please submit a verifiable consumer request to privacy@gen2fund.com. You may only make a verifiable consumer request for access or data portability twice within a 12-month period.

Response Timing and Format: We endeavor to respond within 45 days of receipt. If we require more time (up to 90 days), we will inform you in writing. We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded.

Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not deny you use of our services or provide you a different level or quality of services.

11. Inaccurate or Amended Information

Please let us know as soon as possible if any of the Personal Data we hold about you changes (including your correspondence details). Failure to provide accurate information or to update information when it changes may have a detrimental impact upon our ability to provide services or communicate with you.

12. Contact

If you have any questions or comments about this Privacy Statement, or wish to exercise your rights under applicable Data Protection Legislation, please contact us at:

Email: privacy@gen2fund.com

Postal address: Gen II Luxembourg Services SARL 22, Rue des Bruyères, L-1274 Howald, Luxembourg Attn: Global Data Protection Officer

Phone: Luxembourg: +352 20281 US toll-free: 888-GEN2-001

13. Changes to This Privacy Statement

We may from time to time update this Privacy Statement by posting an amended version on our website. The amended version will be effective as of the date it is published. When we make material changes, we will provide you with notice as appropriate under the circumstances (e.g., by displaying a message the next time you visit our website, or by sending you an email).

Please refrain from using our services in case you do not agree with the way Gen II processes your Personal Data.

Gen II is regulated in Ireland, Jersey, Luxembourg, and the UK. For more information, please visit www.gen2fund.com/regulatory

Privacy policy