Data
Protection Policy

Medan Asset Management, S.L., together with its subsidiaries and affiliates (the “Medan Group” or “Medan”, “we” or “us”), is a global provider of investment banking, asset management and wealth management services.

General

This Privacy Policy (the “Policy“) is to explain what personal data the Medan Group collects and how Medan uses it. Personal data is any data which is provided to us or which we obtain that can be used to identify you (“you”) or that Medan can link to you (“Personal Data”).

For the purposes of data protection law, Medan is a data controller in respect of your Personal Data. You can find contact details for our subsidiaries and affiliates, and the details of the data controllers within the Medan Group, by contacting Medan in accordance with the “Our Contact Information” section below.

Our commitment to privacy

We believe that the responsible use of Personal Data collected is critical to our business objectives and reputation. As part of our commitment to privacy, we have adopted this Policy.

Sources of personal data we collect

The Medan Group will collect Personal Data about you, subject to applicable law, from a variety of sources as follows:

• When you provide it to us (e.g. sending us emails, signing an agreement, filling forms, contacting us via telephone or visiting or making an enquiry through our websites, or by any other means).
• In the ordinary course of our relationship with you (e.g. in the course of managing your transactions or your investment in our funds).
• Where you apply for a job with us, we may collect from you and third parties (where relevant) additional Personal Data such as your CV and any references.
• That you manifestly choose to make public, including via social media (e.g., we may collect information from your social media profile(s), to the extent that you choose to make your profile publicly visible).
• From third parties who provide it to us (e.g., your employer; our clients; credit reference agencies; law enforcement authorities; etc.).
• From third parties, where you purchase any of our products or services through such third parties.
• When you visit any of our websites or use any features or resources available on or through a website. When you visit a website, your device and browser may automatically disclose certain information (such as device type, operating system, browser type, browser settings, IP address, language settings, dates and times of connecting to a Site and other technical communications information), some of which may constitute Personal Data.
• Medan may also record the phone calls with clients, potential clients and third parties, both inbound and outbound calls.

Where you provide Personal Data on behalf of another individual, you are responsible for notifying that individual that you have provided their Personal Data to us and directing them to this Policy so they can see how we will process their Personal Data.

The purpose and legal basis of personal data processing

We will process Personal Data in order to:

• provide you with a personalised service;
• provide you with information on market trends and opportunities;
• to engage in marketing and business development activities and understand the effectiveness of our marketing;
• verify your identity (including for fraud prevention purposes), assess your ability to meet your financial commitments (if any) and manage Medan’s relationship with you and/or the client to whom you are connected;
• to perform the contract with you or a client/supplier to whom you are connected;
• improve our services;
• keep our site and systems safe and secure;
• to carry out financial risk assessments, risk mitigation activities and for risk reporting and risk management;
• to comply with Medan’s legal and regulatory obligations. This includes reporting to the relevant authorities, complying with anti-money laundering obligations and tax reporting obligations;
• understand our clients and their business objectives;
• update and enhance client records;
• defend against or exercise legal claims and investigate complaints; and
• inspection procedures.

Marketing materials, event invitations and news

The legal basis for processing your Personal Data for the purpose specified in this section is:

• Consent – we may need your consent to use your Personal Data. You can withdraw your consent by contacting us in accordance with the “Our Contact Information” section below.
• Performance of a contract – we may need to collect and use your personal data to enter into a contract with you or to perform our obligations under a contract with you or a client to whom you are connected.
• Legitimate interest – we may use your personal data for our legitimate interests.
• Compliance with law or regulation – we may use your personal data as necessary to comply with applicable law/regulation.

We may process your Personal Data in order to send our publications, marketing materials, event invitations and news (the “Marketing Materials”) about the Medan Group.

The legal basis for processing your data for the purpose specified in this section is your consent, as well as the legitimate interest of Medan Group.

If you do not wish to receive Marketing Materials from us you can opt out at any time by contacting Medan using the details set out in the “Our Contact Information” section below. Your request will be analyzed and answered within one (1) month from receipt by us. Such withdrawal does not affect the legality of the operations for processing of your Personal Data prior to it. You may still receive other information directly from Medan Group staff and employees you are in touch with based on the legal grounds applicable for the case (e.g. performance of a contract).

Transfer of data

As an international group we can share information between our offices (you can find contact details for our subsidiaries and affiliates, by contacting Medan in accordance with the “Our Contact Information” section below), and your Personal Data is made available to them. Some of these offices may be located outside the European Economic Area (EEA) and the laws in these countries may not provide the same level of protection as in countries within the EEA. However, all our offices at all times will ensure a level of data protection at least as protective as that required in the EEA. We may also instruct third party suppliers to perform services such as software support, e-marketing campaigns, hosting our website, etc. on our behalf. In such cases we take the necessary contractual steps to ensure the adequate protection of your Personal Data. Your Personal Data will not be given to other third parties, apart from in limited circumstances such as when we host a joint event with a third party and you register to attend it. In such cases, you will be informed in advance that this is a joint event and if you register to attend it, your contact data will be shared with the other event organizers.

Your rights

In accordance with the relevant provisions, you have the right to:

• Confirm whether Medan is processing Personal Data that concerns you, and access to the Personal Data Medan holds about you.
• Request the rectification of Personal Data.
  Request the removal of Personal Data in certain circumstances (there may be cases where Medan is legally entitled to retain it such as the defense against potential claims).
• Request the limitation of the processing of your Personal Data (again, there may be cases where Medan is legally entitled to continue processing your Personal Data).
• Object to the processing of your Personal Data, in which case, Medan shall cease to process your Personal Data (except where Medan is legally entitled to continue processing your Personal Data);
• Receive, in a structured, widely-used format that can be mechanically read, the Personal Data that concern you and that you have provided to Medan or request that Medan transfers them directly to another controller when technically possible.
• Withdraw the consent granted, although in certain circumstances it may be lawful for Medan to continue processing your Personal Data where Medan has another legitimate reason (other than consent) for doing so.
• Lodge a complaint with the relevant data protection authority if you think that any of your rights have been infringed by the Medan Group.
  You can exercise your rights by contacting Medan using the details set out in the “Our Contact Information” section below. Your request will be analyzed and answered within one (1) month from receipt by us.

You can find out more information about your rights by contacting the relevant data protection authority. We can, on request, tell you which data protection authority is relevant to the processing of your personal data.

Data retentions

The Personal Data provided will be kept for the period determined by various criteria including: (i) legal obligation of conservation; (ii) term of the contractual relationship and service of any responsibilities derived from said relationship; and (iii) If and when applicable request of removal by the interested party.

Security

Keeping your Personal Data secure is of utmost importance to us. We take appropriate technical and organizational measures according to industry standards to keep your information secure and protect it from unauthorized use or damage, both online and offline. For security reasons we cannot disclose these measures in details.

Data protection officer informations

For any doubts or queries about your personal data you may contact with the data protection officer of Medan by sending an email to contact@medanam.com

RECRUITMENT PROCESS DATA PROTECTION CLAUSE

Please note that participating in Medan’s recruitment process implies that the Medan Group will process your personal data as described below:

• Which personal data will be collected? The following personal data will be processed in the context of the recruitment process:
  • Identyfing personal data: name, contact information, image and voice, age, address, telephone number, email address, date of birth, nationality
  • Your CV including your education, qualifications, interests, training and work experience
  • Any personal data included in the information provided in the recruitment process including interviews
  • Personal data included in public sources such as associations, registers, professional organizations
  • Information from third party referrals
  • Your interactions in social media
• Who will be the data controller? The personal data will be controlled by Medan Asset Management, S.L., Paseo de la Habana 9, 28036, Madrid, Spain. You may contact Medan’s Data Protection Officer by sending an email to: contact@medanam.com. Your personal data will be assigned to the Medan companies that may be interested or involved in your recruitment. You will be informed of the identity of those companies.
• How will the personal data be collected? Your personal data will be collected directly from you, as a consequence of your participation in the recruitment process, and from the following third parties:
  • Public registrations and sources to carry out background checks
  • Third parties you may indicate as a source of references or referrals
• For what purposes will your personal data be processed? Your personal data will be processed for the following purposes:To manage your registration to the Medan recruitment platform
  • To manage your participation in the recruitment process including interviews
  • To manage the pre-contractual process including the negotiation of a job offer and/or an employment contract
  • To contact you by email or by telephone for future recruitment processes
  • To carry out background checks and ask for references to third parties
  • To interact with you in social media
  • The information collected from the use of cookies in the recruitment platform will be used to facilitate how you use it, to follow how you interact with it and to improve it
• Which is the legal basis for the processing? The legal bases to process your personal data will be:To manage your participation in the recruitment process including interviews: legitimate interest of the parties in the recruitment process
  • To manage the pre-contractual process including the negotiation of a job offer and/or an employment contract: to fulfil the pre-contractual/contractual relationship
  • To contact you for future recruitment processes: legitimate interests of both parties to manage or participate in future recruitment processes
  • To carry out background checks and ask for references to third parties: legitimate interest to know the applicants and consent (that will be provided verbally by you when providing the third party’s contact details) to ask references to those third parties indicated by you
  • To interact with you in social media: based on the parties legitimate interest to interact with each other
• Who will your personal data be shared with? Your personal data will be shared within the Medan Group. The personal data may also be accessed by Medan’s service providers.
• For how long will your personal data be processed? Your personal data will be retained for a two years period if your application is not successful. If you become an employee of the Medan group, your personal data will be retained as long as the employment contract is in force and until legal responsibilities may be derived from the employment relationship.
• Which rights do you have in relation to your personal data? You will have the right to access, rectification, erasure, objection, restriction of processing and data portability in relation to your personal data by sending a written communication to contact@medanam.com. Please be informed that you may file a complaint before the corresponding data protection supervisory authority: https://edpb.europa.eu/about-edpb/about-edpb/members_en