Who is providing this notice?

This notice is provided by Quantum Light Management Ltd, a company incorporated under the laws of England and Wales with company registration number 13878761 whose registered office is at 5th Floor, North Side 7/10 Chandos Street, Cavendish Square, London, United Kingdom, W1G 9DQ and its subsidiaries and affiliates (“Company”). For transparency, the entities on whose behalf this privacy statement is made are the fund and its general partner, in each case, with which you contract, transact or otherwise share personal data (together with the Company, “fund Entities”). Where we use the terms “we”, “us” and “our” in this Notice, we are referring to the Entities.

Please consult your subscription documents, private placement memorandum or other offering documentation (“Subscription Documents”) provided to you by or on behalf of the fund Entities which will further specify the entities and contact details of the fund Entities relevant to our relationship with you.

DATA PROTECTION NOTICE (EU AND UK)

Personal data will be processed in compliance with the requirements of the European Union General Data Protection Regulation 2016/679 or, in respect of personal data processed by the Company, in compliance with the requirements of the United Kingdom Data Protection Act 2018, and other relevant data protection legislation which may be applicable (together, the “Data Protection Laws”).

For the purposes of this EU and UK data protection notice (“EUKDPN”), “data controller”, “data processor”, “data subject”, “personal data”, “processing” shall have the meanings attributed to them in the Data Protection Laws.

Should any changes be made to this EUKDPN, for example because the general partner processes data for a new purpose, a new EUKDPN specifically devoted to the change, will be delivered.

Data Controller

The Company insofar as it relates to the data collected by it, and the general partner on behalf of the fund are the data controller for the personal data collected and processed in the context of investor’s investment in the fund.

In relation to the administrator's collection and processing of personal data relating to the investor’s investment in the fund, the provisions of this notice shall be supplemented with the provisions of their Privacy Notice, which can be found on their website at https://www.centaurfs.com/data-protection-notice. In case of discrepancy between the two notices, the provisions of this EUKDPN shall prevail.

Personal Data Collected

The general partner, the Company, the administrator and their service providers will collect and process personal data provided by investors in relation to an investment in the fund and/or in the course of operating the fund, including first name, last name, residential address, e-mail address, telephone number and other contact details; date and place of birth, citizenship and profession; identity documents; and tax details. Personal data may also be collected relating to criminal convictions or offences concerning investor’s representatives, authorised signatories, shareholders, members, partners, underlying investors or beneficial owners from publicly available and accessible registries and sources, and third-party databases used to perform due diligence and other screening activities. This data will be processed in order to fulfil legal obligations, as described below.

Purposes of the processing

The general partner and the Company will only process personal data for the following purposes (each, a “Purpose” and collectively, the “Purposes”):

• identity verification for the purpose of preventing fraud or other financial crime, complying with statutory and regulatory requirements in relation to anti-money laundering and terrorist financing requirements including the general partner's own in-house procedures. Such use is (A) necessary to perform obligations under the Subscription Documents and to comply with legal obligations such as anti-money laundering laws and regulations, (B) necessary for the legitimate interests of the general partner and/or the fund in preventing, detecting, investigating and prosecuting fraud and/or other criminal activity, and managing risks;
• meeting the legal, regulatory, reporting and/or financial obligations of the general partner and/or the fund (including purposes ancillary to the management and operation of the fund and/or any of its investments) or of any data processor or service provider of the general partner including complying with requests from, and requirements of, local or foreign regulatory or law enforcement authorities, tax identification and reporting as applicable. Such processing is (A) necessary to ensure compliance with legal obligations, (B) necessary for the legitimate interests of the general partner and/or the fund in preventing, detecting, investigating and prosecuting fraud and/or other criminal activity, managing risks and conducting business;
• assessing and processing the investor’s application, administering the investor’s investment in the fund, including receiving payments and making payments and communicating with the investor as necessary in connection with its affairs and generally in connection with its investment. Such use is necessary to perform obligations under the subscription document(s);
• administering the business of the fund in an efficient and proper manner, including conducting audits, implementing risk management processes, corporate governance, maintaining and monitoring IT systems and management of third party service providers. Such processing is necessary for the legitimate interests of the general partner and/or the fund in managing risks and in the efficient management of the business;
• detecting, investigating and preventing internal and external breaches of internal policy and applicable law and regulation and establishing, exercising and defending legal rights. Such processing is necessary for the legitimate interests of the general partner and/or the fund in ensuring compliance with the Data Protection Laws, in managing risks and in the efficient management of the business;
• contacting the investor with information about products and services of the of the Company , the general partner, or their affiliates which may be of interest to the investor, subject to having received the investor’s consent where required. The investor may at any time withdraw such consent by contacting the general partner or the Company.

There may be other occasions where personal data is processed for purposes which will be explained at that time. The general partner or the Company, as applicable, will provide further notice to the investor of any additional processing and, if required, ask for the investor’s consent to such processing.

“Legitimate interests” means the interests of the general partner or the Company in conducting its business on behalf of or for the benefit of the fund and fulfilling the obligations under the subscription document(s)and/or the interests of the fund. This EUKDPN describes when the general partner or the Company process personal data for those legitimate interests, what these interests are and the investor’s rights. The general partner and the Company will not use personal data for activities where the impact on the investor overrides the interests of the general partner, the Company and/or the fund, unless investor’s consent is provided, or those activities are otherwise required or permitted by law.

The investor acknowledges and agrees that where provision of personal data is necessary to ensure compliance with legal obligations or to perform this Subscription Documents, failure to provide relevant personal data for the abovementioned purposes may prevent maintenance of investor’s investment.

Disclosure of Data

Personal data will be disclosed to certain third parties (“Recipients”), as set forth below:

• to the administrator and the duly appointed central administrator in relation to the fund (the “Administrative, Registrar and Transfer Agent”), and their respective associates which act as data processors on the fund ’s behalf. These parties perform certain services and functions as required by or in connection with the investor’s investment and to ensure performance of the Subscription Agreement. Subject to the general partner 's permission and instructions, such parties may provide personal data to sub-processors. In certain circumstances, the data processors may also process personal data as distinct data controllers, in particular for compliance with their legal obligations in accordance with laws and regulations applicable to them (such as anti-money laundering identification) and/or order of any competent jurisdiction, court, governmental, supervisory or regulatory bodies, including tax authorities;
• to other data processors that assist the general partner of the Company in meeting business operations needs and as necessary in connection with the investor’s affairs, investor’s investment and the affairs of the fund or for complying with legal obligations as described above. These parties include providers of certain services and functions such as hosting and cloud services and other information technology providers, email archiving services, production of investor notices and financial statements, providers of client relationship management, investment management, reporting software and other software used to meet business operation needs. Pursuant to the general partner 's instructions, these parties may access, process or store personal data in the course of performing their contractual duties;
• to third parties such as other investment funds, bank account providers, managers, directors, officers, employees, attorneys, financiers (including senior lenders), auditors or any other service providers together with their respective advisers, agents and service providers in relation to the operation of the fund;
• to governmental, regulatory or tax authorities, including in connection with the disclosure of tax treatment and tax structure of the fund and all related documentation relating to such tax treatment and tax structure, financial markets or other intermediaries or counterparties or courts, including outside the European Economic Area, pursuant to applicable laws and regulations;
• to other administrators who act as the administrator for other funds managed or advised by the general partner, the Company and/or their respective affiliates in which the investor has made (or is proposing to make) an investment to facilitate identity verification for the purpose of complying with statutory and regulatory requirements in relation to anti-money laundering and anti-terrorist financing requirements or other applicable requirements. Such transfer is necessary for the legitimate interests of the other funds and the investor in performing their obligations under the subscription agreement relating to such other funds and to comply with legal obligations such as anti-money laundering laws and regulation; and
• to prospective investors, who may be located in countries outside the European Economic Area, for the purposes of enabling others to make investments in the fund.

Data Transfers

The general partner and the Company may transfer personal data (including personal data relating to investors) outside of the United Kingdom and the European Economic Area (“EEA”) to countries or territories that provide an adequate level of protection or to non-EEA countries or territories that have not been recognised as adequate by the European Commission. If on the latter basis, the general partner will ensure it is protected and transferred in a manner consistent with the requirements of Data Protection Laws (such as by using model contractual clauses, binding corporate rules or other data transfer mechanisms).

Rights in Relation to Personal Data

Subject to applicable law, the investor has the following rights in relation to personal data:

• Right of access: If the investor requires, the general partner and the Company (as the case may be) will confirm whether they are processing personal data and, if so, will provide investor with a copy of that personal data along with certain other details.
• Right to rectification: If personal data is inaccurate or incomplete, the investor is entitled to ask correction or completion of such data.
• Right to erasure: The investor has the right to obtain deletion of personal data, such as when personal data is no longer necessary for the Purposes or the investor withdraws consent (if applicable).
• Right to restrict processing: The investor has the right to obtain restriction or the ‘block’ of the processing of personal data in certain circumstances, such as where the investor contests the accuracy of the data or objects to the processing.
• Right to data portability: The investor has the right to obtain personal data that the investor consented to provide or that is necessary to perform the Subscription Agreement, and that is processed by automated means, in a structured, commonly used and machine-readable format.
• Right to object: The investor has the right to (i) object at any time, on grounds relating to the investor’s particular situation, to the processing of personal data when the processing is based on the legitimate interest basis in the circumstances described above, unless the general partner or the Company(as the case may be) demonstrates compelling legitimate grounds for the processing, and (ii) object to the processing of personal data for direct marketing (if applicable).
• Right to withdraw consent: If the lawful basis for processing personal data is the investor’s consent, the investor has the right to withdraw that consent at any time. This will not affect the lawfulness of processing based on consent before its withdrawal.
• Right to lodge a complaint with the data protection authority: If the investor has a concern about processing of personal data under this EUKDPN, the investor has the right to report it to all applicable data protection authorities that is authorized to hear those concerns.

Data Retention

Personal data will not be held for longer than necessary with regard to the Purposes of the data processing, subject to any retention periods provided by applicable laws and regulations. The general partner and the Company apply criteria to determine the appropriate periods for retaining personal data depending on its purpose, nature, and sensitivity and any retention periods provided by applicable laws and regulations. In particular, personal data may be kept for the Purposes for as long as the investor maintain an ongoing relationship with the fund and for a period after the relationship ends, including as may be necessary in order to maintain records in accordance with applicable laws and regulations, to respond to any regulatory requests or questions, or in connection with legal proceedings, legal advice or legal rights.

Contact

For more details on the processing of the personal data pursuant to this EUKDPN or to exercise the rights described above, please contact the general partner or the Company (as the case may be).

CAYMAN ISLANDS DATA PROTECTION NOTICE

The purpose of this document is to provide you with information on the fund"s use of your personal data in accordance with the Cayman Islands Data Protection Act (as amended) (together with Data Protection Laws, "Data Protection Legislation").

Your personal data will be processed by the fund, and by persons engaged by the fund. Under the Data Protection Legislation, you have rights, and the fund has obligations, with respect to your personal data. The purpose of this notice is to explain how and why the fund, and persons engaged by the fund, will use, store, share and otherwise process your personal data. This notice also sets out your rights under the Data Protection Legislation, and how you may exercise them.

Your personal data

By virtue of making an investment in the fund (including the initial application and ongoing interactions with the fund and persons engaged by the fund) or by virtue of you otherwise providing us with personal information on individuals connected with you as an investor (for example directors, trustees, employees, representatives, shareholders, investors, clients, beneficial owners or agents), you will provide us with certain personal information which constitutes personal data within the meaning of the Data Protection Legislation.

In particular, you will provide us with personal information within the forms and any associated documentation that you complete when subscribing for interests; when you provide it to us or our service providers in correspondence and conversations (including by email); when you make transactions with respect to the fund; and when you provide remittance instructions.

We may also obtain personal data on you from other publicly accessible directories and sources. These may include websites; bankruptcy registers; tax authorities; governmental agencies and departments, and regulatory authorities, to whom we have regulatory obligations; credit reference agencies; sanctions screening databases; and fraud prevention and detection agencies and organisations, including law enforcement.

This includes information relating to you and/or any individuals connected with you as an investor in the fund such as: name, residential address, email address, contact details, corporate contact information, signature, nationality, place of birth, date of birth, tax identification, credit history, correspondence records, passport number, bank account details, and source of funds and source of wealth details and details relating to your investment activity.

How the fund may use your personal data

The fund, as the data controller, may collect, store and use your personal data for purposes including the following.

The processing is necessary for the performance of a contract, including:

• administering or managing the fund;
• processing your subscription and investment in the fund, such as entering your information in the register of limited partners;
• sending you statements relating to your investment;
• facilitating the continuation or termination of the contractual relationship between you and the fund; and
• facilitating the transfer of funds, and administering and facilitating any other transaction, between you and the fund.

The processing is necessary for compliance with applicable legal or regulatory obligations, including:

• undertaking investor due diligence including anti-money laundering and counter-terrorist financing checks, including verifying the identity and addresses of our investors (and, where applicable, their beneficial owners);
• sanctions screening and complying with applicable sanctions and embargo legislation;
• complying with requests from regulatory, governmental, tax and law enforcement authorities;
• surveillance and investigation activities;
• carrying out audit checks, and instructing our auditors;
• maintaining statutory registers; and
• preventing and detecting fraud.

In pursuance of our legitimate interests, or those of a third party to whom your personal data are disclosed, including:

• complying with a legal, tax, accounting or regulatory obligation to which we or the third party are subject;
• assessing and processing requests you make;
• sending updates, information and notices or otherwise corresponding with you in connection with your investment in the fund;
• investigating any complaints, or pursuing or defending any claims, proceedings or disputes;
• providing you with, and informing you about investment products and services;
• managing our risk and operations;
• complying with audit requirements;
• ensuring internal compliance with our policies and procedures;
• protecting the fund against fraud, breach of confidence or theft of proprietary materials;
• seeking professional advice, including legal advice;
• facilitating business asset transactions involving the fund or related entities;
• monitoring communications to/from us (where permitted by law); and
• protecting the security and integrity of our IT systems.

We will only process your personal data in pursuance of our legitimate interests where we have considered that the processing is necessary and, on balance, our legitimate interests are not overridden by your legitimate interests, rights or freedoms.

The fund continues to be a data controller even though it has engaged the service provider (the "Service Provider") and other third parties to perform certain activities on the fund"s behalf.

Sharing your personal data

We may share your personal data with our affiliates and delegates. In certain circumstances we may be legally obliged to share your personal data and other financial information with respect to your interest in the fund with relevant regulatory authorities such as the Cayman Islands Monetary Authority or the Tax Information Authority. They, in turn, may exchange this information with foreign authorities, including tax authorities and other applicable regulatory authorities.

The fund’s affiliates and delegates may process your personal data on the fund"s behalf, including with our banks, accountants, auditors and lawyers which may be data controllers in their own right. The [fund]"s services providers, such as the Service Provider, are generally processors acting on the instructions of the fund. Additionally, a service provider may use your personal data where this is necessary for compliance with a legal obligation to which it is directly subject [(for example, to comply with applicable law in the area of anti-money laundering and counter terrorist financing or where mandated by a court order or regulatory sanction)]. The service provider, in respect of this specific use of personal data, may be deemed to be acting as a data controller.

In exceptional circumstances, we will share your Personal Data with regulatory, prosecuting and other governmental agencies or departments, and parties to litigation (whether pending or threatened) in any country or territory.

Sending your personal data internationally

Due to the international nature of our business, your personal data may be transferred to jurisdictions that do not offer equivalent protection of personal data as under the Data Protection Legislation. In such cases, we will process personal data or procure that it be processed in accordance with the requirements of the Data Protection Legislation, which may include having appropriate contractual undertakings in legal agreements with service providers who process personal data on our behalf.

Retention and deletion of your personal data

We will keep your personal data for as long as it is required by us. For example, we may require it for our legitimate business purposes, to perform our contractual obligations, or where law or regulation obliges us to. We will generally retain your personal data throughout the lifecycle of the investment you are involved in. Some personal data will be retained after your relationship with us ends. We expect to delete your personal data (at the latest) once there is no longer any legal or regulatory requirement or legitimate business purpose for retaining your personal data.

Automated decision-making

We will not take decisions producing legal effects concerning you, or otherwise significantly affecting you, based solely on automated processing of your personal data, unless we have considered the proposed processing in a particular case and concluded in writing that it meets the applicable requirements under the Data Protection Legislation.

Your rights

You have certain data protection rights, including the right to:

• be informed about the purposes for which your personal data are processed;
• access your personal data;
• stop direct marketing;
• restrict the processing of your personal data;
• have incomplete or inaccurate personal data corrected;
• ask us to stop processing your personal data;
• compensation for any damage that occurred because of a breach of data protection;
• be informed of a personal data breach (unless the breach is unlikely to be prejudicial to you);
• complain to the Data Protection Ombudsman; and
• require us to delete your personal data in some limited circumstances.

Amendments

Should any changes be made to the Cayman Islands Data Protection Notice, for example because the General Partner processes data for a new purpose, a new Data Protection Notice specifically devoted to the change, will be delivered.

Contact us

We are committed to processing your personal data lawfully and to respecting your data protection rights.

Please contact us if you have any questions about this Notice or the personal data we hold about you, please contact the general partner or the Company (as the case may be) by writing to dpo@quantumlightcapital.com.