Data Privacy Notice

This Data Privacy Notice explains how we use the Personal Data that Konvi collects or generates both in relation to this website and our online products and services. This information is provided in fulfilment of Konvi's duty to process Personal Data in a manner which is fair, lawful and transparent, and to provide information relating to the processing at the time of collection of that data. You should read this Data Privacy Notice prior to providing any Personal Data to Konvi and refer to it at any time should you have queries regarding the use of your Personal Data.

The list below sets out what is covered in this Data Privacy Notice.

1. BACKGROUND

1.1 Konvi, registered in Dublin, Ireland, company number 683014, and other companies in the Konvi group collect and use certain Personal Data. Konvi is the 'Data Controller' in respect of this Personal Data. Konvi is responsible for ensuring that it uses that Personal Data in compliance with data protection laws.

1.2 At Konvi we respect the privacy of our clients and we are committed to keeping all your Personal Data secure. This Data Privacy Notice governs the handling of Personal Data by Konvi in the course of carrying on commercial activities.

1.3 We use the following definitions in this Data Privacy Notice:

"Konvi", "we or "us" means Konvi Limited and other companies in the Konvi Group.

"Konvi Group" means us, our subsidiaries, our holding companies and any subsidiaries of those holding companies.

"Personal Data" means any data which relates to a living individual who can be identified from that data or from that data and other information, which is in the possession of, or is likely to come into the possession of, Konvi (or its representatives or service providers). In addition to factual information, it includes any expression of opinion about an individual and any indication of the intentions of Konvi or any other person in respect of an individual.

2. THE PRODUCTS AND SERVICES WE PROVIDE

2.1 Konvi provides a financial platform to take exposure in luxury items. The Konvi Platform specializes in enabling investors take an interest in luxury assets such as watches as a niche investment class asset.

2.2 This Data Privacy Notice concerns the following categories of information that we collect about you when providing the following products and services:

(a) Information we receive through our websites (Konvi Websites);

(b) Information we receive through our products (Konvi Products);

(c) Information we receive through our support services (Konvi Services).

3. THE TYPES OF PERSONAL DATA WE COLLECT

3.1. There are a number of reasons for gathering Personal Data about you. For instance, we need to know how to get in touch with you, we need to be certain of your identity and we need to understand your financial circumstances, so we can offer you products and services and give you the best possible customer experience. The Personal Data we collect falls into various categories, such as:

Identity & contact information:

Name, date of birth, copies of ID, contact details, PPS number (or foreign equivalent), online user identities (such as your internet protocol addresses and cookie identifiers), security details to protect identity, nationality, home status and address, email address, work and personal phone numbers, marital status, family details, tax residency and tax related information.

Financial details/circumstances:

Bank account details (including Account number, sort code), any International Bank Account Number (IBAN), currency information, payments information including, payment reference information (this may identify precisely who makes payments to you and who you make payments to and possibly include special category data e.g. a payment to a trade union) transaction credits, transaction debits, credit/debit card details, income and asset details, personal guarantees provided, application processing and administration records, your employment status and employment details of your partner, credit history, credit assessment records, credit data from credit registers, credit reference agency performance data, life assurance, pension and investment details, transaction details, treasury transactions, financial needs/attitudes, contact outcomes, authorised signatories details, information relating to power of attorney arrangements.

Marital status and/or financial associations:

If you are married or are financially linked to another person in the context of a particular product or service, a financial association may be created between your records and their records, including any previous and subsequent names used by you. This means that we may treat your financial affairs as affecting each other. These links will remain on your and their files until you or they break that link. We may make searches on all joint applicants, and evidence of that search will be left on all applicants' records.

Information you provide us about others or others provide us about you:

If you give us information about someone else (for example, information about a spouse or financial associate provided during the course of a joint application with that person), or someone gives us information about you, we may add it to any personal information we already hold and we will use it in the ways described in this Data Privacy Notice. Before you disclose information to us about another person, you should be sure that you have their agreement to do so. You should also show them this Data Privacy Notice. You need to ensure they confirm that they know you are sharing their personal information with us for the purposes described in this Data Privacy Notice.

Sensitive or special categories of data:

We may hold information about you which includes sensitive or special categories Personal Data, such as but not limited to health or criminal conviction information. We will only hold this data when we need to for the purposes of the product or services we provide to you, where we are processing the data for a substantial public interest, where we have a legal obligation or where we have your consent to do so. Examples of when we use this type of data include: If you have criminal convictions, or are on a terrorist watch list, we may process this information in the context of compliance with our anti-money laundering obligations.

Information which you have consented to us using:

Your contact details and marketing preferences are used to share news about relevant services, products and offers that we think may be of interest to you.

Information from online activities:

We collect information about your internet activity using technology known as cookies, which can often be controlled through internet browsers. For detailed information on the cookies we use and the purposes for which we use them, see our Cookies Policy, which is available on our website.

We collect information about your internet browser settings and Internet Protocol (IP) address and other relevant information to help us identify your geographic location when providing you with our services.

Other personal information:

Web Chat and email conversation recordings.

Information in relation to requests made by you e.g. data access, correction, restriction, deletion, porting and complaints.

Sometimes we may collect and use your information even though you are not a customer of ours:

For example, you may be a beneficiary, guarantor, director, or representative of one of our customers, or you may be in the process of making an application for a product or service. In other cases, your own circumstances may have a material impact on the ability of our customer to perform their obligations to us, and we will need to consider these. If so, we will apply the principles outlined in this Data Privacy Notice when dealing with your information.

4. HOW WE USE YOUR INFORMATION

4.1 To provide our products and services to you and perform our contract with you, we use your information to:

• Establish your eligibility for our products and services.
• Manage and administer your accounts, policies, benefits or other products and services that we or our partners may provide you with. For example, if you have invested in a project through us with us, we may need to share information with that investee.
• Process your applications for financial services.
• Carry out KYC / AML reviews, including automated decision processes (which may have a legal or similarly significant effect on you), and to search for details of your credit history and information at credit bureaus/agencies, including the Central Credit Register. Where we make these searches, agencies may keep a record of the search.
• Contact you by post, phone, text message, email, social media, fax, digital message, but not in a way contrary to your instructions to us or contrary to law.
• Monitor and record our conversations when we speak on the telephone (for example, to check your instructions to us, to analyse, to assess and improve customer service; for training and quality purposes; and for verification, fraud analysis and prevention purposes).
• Recover debts you may owe us.
• Manage and respond to a complaint or appeal.

4.2 To manage our business for our legitimate interests:

To manage our business, we may use your information to:

• Carry out customer due diligence, credit scoring, credit management including collecting and enforcing debts and arrears We may:
  • Tell credit reference and credit registration agencies about your dealings with us including details of your credit facilities and your credit history with us. We may also search the Central Credit Register where permitted but not obliged to do so.
  • Engage agencies to trace you (for example, where the address you have provided is no longer accurate and Konvi needs to provide you with legal documentation).
• Provide service information (including sending you service related messages), to improve our service quality and for training purposes.
• Conduct marketing activities: It is in our business interests to understand our customers' needs and preferences so that we can improve our products and services offerings for our customers and identify suitable new products or services. It is also in both our and our customers' interests to let you know about those products or services which we believe may be of interest or relevance to you. Where we process your information for this purpose, this allows us to:
  • send you relevant marketing information. In the case of certain electronic marketing, we may also need your consent to send these messages.
  • identify where you are eligible for a particular product or service.
  • conduct market research, including customer surveys, analytics and related activities.
  • run competitions, promotions and other direct marketing activities.

4.3 To run our business on a day to day basis including to:

• Carry out strategic planning and business portfolio management.
• Compile and process your information for audit, statistical or research purposes (including, in some instances, making your data anonymous) in order to help us understand trends in our customer behaviour and to understand our risks better, including for providing management information, operational and data risk management.
• We also use aggregated information we have about you and our other customers (such as spending patterns or transaction information) to understand general trends and may combine this with data from other sources, such as economic or research data. We may share this analysis with third parties to help them better understand these general trends. When we do this, we combine customers' data and do not provide information (such as your name, address or account number) that would identify you.
• Protect our business, reputation, resources and equipment, manage network and information security (for example, developing, testing and auditing our websites and other systems, dealing with accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted Personal Data, and the security of the related services) and prevent and detect fraud, dishonesty and other crimes (for example, to prevent someone trying to steal your identity).
• Manage and administer our Group's legal and compliance affairs, including complying with our obligations to compliance with regulatory guidance and voluntary codes of practice to which we have committed.
• Enable our Group members to share or access your information for internal administrative purposes, fraud prevention, audit, prudential, statistical or research purposes (including making your data anonymous) to help us understand trends in customer behaviour, for helping us to understand our risks better and for the purposes set out in this Data Privacy Notice (but not for the purposes of direct marketing where you have objected to this).

4.4 To buy and/or sell assets of the Group:

• Members of the Group may in the future wish to sell, securitise, transfer or merge part or all of its business or assets or to buy a new business or the assets of another business or enter into a merger with another business. If so, we may disclose your personal information under strict duties of confidentiality to a potential buyer, investor, lender, transferee, merger partner or seller and their advisers, so long as they agree to keep it confidential and to use it only to consider the possible transaction. If the transaction goes ahead, the buyers, transferee or merger partner may use or disclose your personal information in the same way as set out in this Data Privacy Notice.
• Facilitate a potential or actual transfer of any investment or product provided to you or in connection with a securitisation or other funding arrangement.

4.5 To comply with our legal and regulatory obligations:

We need to use your information to comply with legal and regulatory obligations including:

• Complying with your information and privacy rights.
• Providing you with statutory and regulatory information and statements.
• Establishing your identity, residence and tax status in order to comply with law and regulation concerning taxation and the prevention of money laundering, fraud and terrorist financing.
• We are required by law to screen applications that are made to us to ensure we are complying with the international fight against terrorism and other criminal activities. As a result, we may need to disclose information to government and other statutory bodies.
• Preparing returns to regulators and relevant authorities including preparing income tax, capital gains tax, capital acquisition tax, Deposit Interest Retention Tax and other revenue returns.
• Reporting to and, where relevant, conducting searches on the Central Credit Register, State registers (such as the Register of Beneficial Owners), and other industry registers.
• Complying with binding requests from regulatory bodies, including the Central Bank of Ireland.
• Complying with binding requests for information about you from other payment service providers from whom you may have received payments in error so that the payer's financial service provider may contact you directly. This information will include your name, address and relevant transaction information.
• Complying with binding production orders or search warrants, and orders relating to requests for mutual legal assistance in criminal matters received from foreign law enforcement agencies/ prosecutors.
• For other reasons where a statutory reason exists, including use of your Personal Public Service (PPS) number (or foreign equivalent).
• Complying with court orders arising in civil or criminal proceedings.
• Performing a task carried out in the public interest.

4.6 Where you have given us permission (which you may withdraw at any time):

Where you have given us permission (which you can withdraw at any time) to process your information we may:

• Send electronic messages to you about products, services and offers from Konvi as well as from specially selected trusted partners but only if we think they may be suitable or of interest to you.
• Share your data with third parties so that they may send you electronic messaging about their products and offers.
• Use image recognition software to verify your identity and documentation when opening or operating an account. This process may also include using that technology to scan and copy information from the documents you provide and using that information for your application.
• Use cookies in accordance with our Cookie Policy.
• Use special categories of data, or sensitive data.
• Use information you have made public and combine this with the activities outlined above.

4.7 When we ask for your consent, we will provide you with more information on how we will use your Personal Data in reliance on that consent, including in relation to third parties we would like your consent to share your data with.

4.8 We will take steps to ensure that the Personal Data is accessed only by employees of Konvi that have a need to do so for the purposes described in this Data Privacy Notice.

5. DISCLOSURE OF YOUR INFORMATION TO THIRD PARTIES

We only share your information with a select number of individuals and companies, and only as necessary. Sharing can occur in the following circumstances and/or with the following persons:

• Your authorised representatives:
  • These include your broker/retail intermediary, attorney (under a Power of Attorney) and any other party authorised by you to receive your Personal Data.
• Third parties we need to share your information with in order to facilitate payments you have requested.
  • for example, banks or payment service providers such as SWIFT; and
  • those you ask us to share your information with.
• Third parties we need to share your information with in order to facilitate the investments you have enquired about or requested through our platform.

5.1 Companies in the Konvi Group:

We share your information with members of the Konvi Group to protect our legitimate interests or where legally required to do so.

5.2 Companies that provide support services for the purposes of protecting our legitimate interests:

Your personal information remains protected when our service providers use it. We only permit service providers to use your information in accordance with our instructions, and we ensure that they have appropriate measures in place to protect your information.

• Our service providers include providers of marketing services such as advertising agencies or social media companies (so they can present messages from us to you) and market research companies, analytics companies, investment companies, IT and telecommunication service providers, software development contractors, data processors, debit/credit card producers, computer maintenance contractors, printing companies, property contractors, document storage and destruction companies, custodians and providers of administration services, archiving services suppliers, debt collection agencies, budgeting and advice agencies, tracing agencies, receivers, liquidators, examiners, Official Assignee for Bankruptcy and equivalent in other jurisdictions, auditors, and consultants, including legal advisors.

5.3 We may also share information with the following third parties to help us manage our business for our legitimate interests:

• Trade associations and professional bodies, non-statutory bodies and members of trade associations.
• Pension fund administrators, trustees of collective investment undertakings and pensions trustees.
• Payment Service Providers
• Insurers/re-insurers and insurance bureaus.

5.4 Statutory and regulatory bodies (including central and local government) and law enforcement authorities:

These include the courts and those appointed by the courts, government departments, statutory and regulatory bodies in all jurisdictions where the Konvi Group operates including: the Central Bank of Ireland, the European Central Bank, the Data Protection Commission, Financial Services Ombudsman, Credit Review Office, An Garda Síochána/police authorities/enforcement agencies, Revenue Commissioners, Criminal Assets Bureau, US, EU and other designated authorities in connection with combating financial and other serious crime, ombudsmen and regulatory authorities, as well as fraud prevention agencies.

5.5 Credit reference/rating agencies, including the Central Credit Register:

We may search the Central Credit Register, where permitted but not obliged to do so to protect our legitimate interests.

5.6 Third parties in connection with a sale or purchase of assets by a member of our Group:

Those who are interested in or participating in buying or selling assets of our Group or in connection with a funding arrangement for our Group.

5.7 Correspondent banks, Payment Service Providers and other financial institutions engaged to supply status opinions in accordance with banking practice.

6. INTERNATIONAL TRANSFERS OF PERSONAL DATA

6.1 Konvi is a global business. Our customers and our operations are spread around the world. As a result, we collect and transfer Personal Data on a global basis. That means that we may transfer your Personal Data to locations outside of your country.

6.2 Where we transfer your Personal Data to another country outside the EEA, we will ensure that it is protected and transferred in a manner consistent with legal requirements. In relation to data being transferred outside of the EEA, for example, this may be done in one of the following ways:

• Model Clauses (also known as Standard Contractual Clauses) are standard clauses in our contracts with our service providers to ensure that any Personal Data leaving the EEA will be transferred in compliance with EU data-protection law.
• Transfers to countries outside the EEA which have an adequate level of protection as approved by the European Commission.
• Binding Corporate Rules.
• Transfers permitted in specific situations where a derogation applies as set out in Article 49 of the GDPR. For example, where it is necessary to transfer information to a non-EEA country to perform our contract with you.

6.3 You can obtain more details of the protection given to your Personal Data when it is transferred outside the EEA (including a copy of the standard data protection clauses which we have entered into with recipients of your Personal Data) by contacting us as described in paragraph 11 below.

7. HOW WE SAFEGUARD YOUR INFORMATION

7.1 We have extensive controls in place to maintain the security of our information and information systems. Client files are protected with safeguards according to the sensitivity of the relevant information. Appropriate controls (such as restricted access) are placed on our computer systems. Physical access to areas where Personal Data is gathered, processed or stored is limited to authorised employees.

7.2 As a condition of employment, Konvi employees are required to follow all applicable laws and regulations, including in relation to data protection law. Access to sensitive Personal Data is limited to those employees who need to it to perform their roles. Unauthorised use or disclosure of confidential client information by a Konvi employee is prohibited and may result in disciplinary measures.

7.3 When you contact a Konvi employee about your file, you may be asked for some Personal Data. This type of safeguard is designed to ensure that only you, or someone authorised by you, has access to your file.

8. HOW LONG WE KEEP YOUR PERSONAL DATA

8.1 How long we will hold your Personal Data for will vary and will be determined by the following criteria:

• the purpose for which we are using it Konvi will need to keep the data for as long as is necessary for that purpose;
• The type of financial product we have provided to you. For example, we may keep data relating to an investment for a longer period compared to data regarding a single payment transaction;
• Whether you and us are in a legal or some other type of dispute with another person or each other;
• The type of data we hold about you;
• Whether you or a regulatory authority asks us to keep it for a valid reason; and
• legal obligations laws or regulation may set a minimum period for which we have to keep your Personal Data.

9. YOUR RIGHTS

9.1 In all the above cases in which we collect, use or store your Personal Data, you may have the following rights and, in most cases, you can exercise them free of charge. These rights include:

• the right to obtain information regarding the processing of your Personal Data and access to the Personal Data which we hold about you;
• the right to withdraw your consent to the processing of your Personal Data at any time. Please note, however, that we may still be entitled to process your Personal Data if we have another legitimate reason for doing so. For example, we may need to retain Personal Data to comply with a legal obligation;
• in some circumstances, the right to receive some Personal Data in a structured, commonly used and machine-readable format and/or request that we transmit those data to a third party where this is technically feasible. Please note that this right only applies to Personal Data which you have provided directly to Konvi;
• the right to request that we rectify your Personal Data if it is inaccurate or incomplete;
• the right to request that we erase your Personal Data in certain circumstances. Please note that there may be circumstances where you ask us to erase your Personal Data but we are legally entitled to retain it;
• the right to object to, or request that we restrict, our processing of your Personal Data in certain circumstances. Again, there may be circumstances where you object to, or ask us to restrict, our processing of your Personal Data but we are legally entitled to refuse that request; and

9.2 You can exercise your rights by contacting us using the details listed in paragraph 10 below.

10. KONVI DESIGNATED REPRESENTATIVE

Konvi's Data Protection Officer may be contacted using the following contact information:

Address: 12A Lower Main Street, Lucan, Co. Dublin, Ireland

Email Address: info@konvi.app

11. QUESTIONS AND CONCERNS

If you have any questions or concerns about Konvi's handling of your Personal Data, or about this Data Privacy Notice, please contact our Compliance team using the following contact information:

Address: Konvi, Compliance Team, Workhub, 77 Lower Camden Street, D02 XE80, Dublin, Ireland

Email Address: info@konvi.app

• We are usually able to resolve privacy questions or concerns promptly and effectively. If you are not satisfied with the response you receive from our Privacy Officer, you may escalate concerns you have to the Data Protection Commission or another supervisory authority. You can contact the Office of the Data Protection Commissioner at http://dataprotection.ie/docs/Contact-us/b/11.html/ . Telephone: +353 (0)761 104 800 or Lo Call Number 1890 252 231. E-mail: info@dataprotection.ie . Postal Address: Data Protection Commission, 21 Fitzwilliam Square North, Dublin 2, D02 RD28.

12. MARKETING

You, or someone acting on your behalf, have the right to opt out of receiving some or all of the marketing communications we may send you at any time and can do so by emailing us at info@konvi.app.

13. RELEVANT TERMS AND CONDITIONS

You should read this Data Privacy Notice in conjunction with the Konvi Terms of Use, available on our site http://konvi.app/

14. CHANGES TO THIS NOTICE

We will update this Data Privacy Notice from time to time on our website https://konvi.app/. Any material changes to this Data Privacy Notice, where appropriate, will be notified to you.