<0><2><3><6>Definition<1>Definitions used in this Data Protection Charter can be found here:<1>“Client” means an investor in our products or a recipient of our services<1>“Petiole”, “PAM”, “we” or “us” means Petiole Asset Management AG with its registered office at Bahnhofstrasse 64, 8001 Zürich, Switzerland.<1>“Petiole Website” means the website operated by Petiole.<1>“Petiole Products and Services” means the products and services that we offer to our Clients.<1>“Personal Data” means any information relating to an identified or identifiable natural person.<1>“Sensitive Data” means :<4><5>data on opinions or activities related to religious. philosophical, political and trade union matters<5>data on health, intimate sphere, racial or ethnic origin<5>genetic data<5>biometric data which uniquely identify an individual<5>data on proceedings or criminal and administrative sanctions<5>data on social welfare measures<1>“You” means each person to whom this notice is addressed, who may be:<4><5>a Client or prospective Client of ours, or a person related to a Client or prospective Client;<5>a visitor to the Petiole website; or<5>an employee, director, officer or representative of another organisation with which we have a business relationship or otherwise interact with.<3><6>Introduction<1>This Data Protection Charter describes how Personal Data is processed by PAM and how to meet PAM’s data protection standards and comply with applicable laws and regulations. It is directed to individuals whose Personal Data we process in relation with our commercial activities and with related activities. This includes Clients and prospective Clients as well visitors to our website.<1>PAM understands that your privacy is important to you and that you care about how your personal data is used. We respect your privacy, and we are committed to keeping your Personal Data secure.<3><6>Circumstances in which we handle your personal data<1>PAM collects Personal Data relating to identified or identifiable natural persons . PAM, where acting as data controller, needs to gather and process certain information about individuals. These can include customers, prospects, suppliers, representatives, business contacts, contractors, service providers, employees and other people the organization has a direct or indirect relationship with or may need to contact<1>PAM follows the principles of privacy by design (data protection through systems and operations design) and privacy by default (only data that is absolutely necessary to a specific purpose is collected and processed.<1>PAM collects Personal Data about you in the following ways and circumstances:<4><5>Personal Data that we receive in the course of providing products or services to you. This Personal Data may be provided directly by you, but we may also collect it from other parties, for example from providers of services or tools, which we sometimes use to serve you and to help us meet our legal obligations.<5>Personal Data that we receive as part of your interest in our products or services. This Personal Data is usually provided by you and includes enquiries and other activities you perform while visiting our premises, participating in events we host and using our online channels. It may also include Personal Data about individuals who are related to our Clients or prospective Clients. It may also include Personal Data about individuals who are related to you, where necessary.<5>Personal Data that we collect, receive or generate in other scenarios, for example if we work or interact with a company or authority you work for, or if you communicate with us or if we communicate with you, or if we are involved in administrative or judicial proceedings. Where necessary, we may have to combine the Personal Data about you that we collect directly from you with information collected from or about you in other contexts.<3><6>About the data we collect<1>The nature of the Personal Data we collect may fall into one of the following categories<4><5>Identification data, such as full name, gender, marital status, date and place of birth, passport number, national identification number, tax identification number, signature, photo, video or voice recordings<5>Contact data, such as personal or business address, phone number, email address or any information a Data Subject might be providing to us or we may collect from private or public sources<5>Financial data, such as a bank account number, other account number, transactional information or information about the wealth of a Data Subject;<5>Business data such as investments monitoring or details about the products or services that a Data Subject benefits from<5>Marketing and communication data<5>Profile data such as username and password from our online services and the use of and interaction with our online services<5>Technical and electronical data such as IP address, browser type and version, browser plug in types and versions, operating system cookies<5>Data related to our internal investigations we perform in line with our contractual or regulatory duties, in particular verification relating to screening carried out before we enter into a relationship with a client, verification carried out during the course of our business relationship, verification relating to the application of the rules on sanctions, anti-money laundering and the fight against terrorism financing obligations and all information related to verification carried out on our means of communication. The Personal Data we collect or hold about a Data Subject may come from a variety of sources. Some will have been collected directly from the Data Subject. Personal Data may also have been collected in compliance with applicable regulations in the past or collected by affiliates of PAM. The source can also be records of correspondence and communication between a Data Subject and PAM, including telephone calls, emails, social media communications or any other type of exchanges and communications. We may also collect Personal Data in the context of meetings or other communications (e.g. when Data Subjects call us, write us or visit us) or when Data Subjects visit our website or use our online services or applications. Some Personal Data may come from sources that are accessible to the general public (e.g., public registers, press and websites) or may have been collected from external companies (e.g. electronic databases)<3><6>Basis and purposes of the data collection and processing <1>We collect and use Personal Data either when a Data Subject has consented to it or when such use is founded on a legal or regulatory basis: <4><5>Execution of an existing contract between a Data Subject and PAM or of a pre-contractual<5>Compliance with legal or regulatory obligations<5>analysis of data for the purpose of targeting clients, including automated data processing<5>disclosure of Personal Data to entities affiliated to PAM, in particular to ensure an efficient and harmonized service<5>to effectively manage and strengthen Client and prospective Client relationships, understand Client and prospective Client needs and interests and learn more about our Clients and prospective Clients in order to develop, improve and manage the products and services we can offer<5>Preservation of a public interest such as the prevention or detection of money laundering, fraud, tax evasion or other criminal illicit activity<5>to monitor IT systems in order to protect against cyber threats or malicious activity including abuse and misuse<5>to protect our premises from unauthorized access or use, or any unlawful activity<5>Interaction with governmental or regulatory bodies or other competent national authorities<5>Pursuit of our legitimate interests such as the development of the business relationship and the provision of information on services and products offered by PAM or by third party partners, the improvements of PAM’s internal organization and processes, any risk assessment to which PAM is subject and decision-making in risk management, or the protection of PAM’s interests, defending or exercising rights in court and the preparation thereof, and cooperating in investigations initiated by competent authorities in Switzerland or overseas. Within Petiole, your Personal Data is accessed only by personnel of Petiole that have a need to access it for the purposes described in this Data Protection Charter. <5>We may use your personal information to send you newsletters, marketing or promotional materials and other information that may be of interest to you. You may opt out of receiving any, or all, of these communications from us by following the unsubscribe link or instructions provided in any email we send.<3><6>Cross-border transfers and transfers to third parties <1>To provide global services as well as in the course of running our business, we may transfer your Personal Data outside of Switzerland and the European Union. Any cross-border transfer of Personal Data to third party recipients is subject to the same requirements applied to our internal processing of Personal Data. Accordingly, the recipient of the Personal Data will must be contractually obliged to use the Personal Data only for the defined purposes. In case of appointed third parties, the choice of a provider is based on its ability to cover the necessary technical and organizational measures to ensure adequate data protection. <1>If Personal Data is transferred to a recipient in another country, PAM, as exporter of the Personal Data, will ensure that the country in which the recipient is resident has an equivalent level of data protection , unless such transfer is based on a mandatory legal obligation.<1>In the absence of such equivalent level of data protection Personal Data may be transferred to a country outside Switzerland and the European Union if one of the following conditions is met: <4><5>the Data Subject has agreed to the transfer<5>the transfer is necessary for the execution of a contract between the Data Subject and us or for the implementation of pre-contractual measures undertaken at the Data Subject’s request;<5>the transfer is necessary for important reasons of public interest; <5>the transfer has been requested by a court or administrative authority of a third country whose decision is recognized in Switzerland or has the force of res judicata; or <5>the transfer is necessary for the recognition exercise or defense of our rights in court. <3><6>Retention of Personal Data<1>We retain Personal Data as long as necessary to fulfil the purpose(s) for which it has been collected or as long as so required by legal or regulatory obligations. We do not keep Data longer than necessary and destroy it as soon as it is no longer needed nor required.<4><5>Laws or regulation may set a minimum period for which we have to keep your Data. For example, we must keep accounting records for 10 years from the end of a business year and may be required to keep other records under tax regulation for up to 20 years<3><6>Security of Personal Data<1>We operate and maintain physical, electronic and procedural safeguards to ensure an appropriate level of security for your Personal Data and we restrict access only to authorized personnel. The effectiveness of these safeguards is periodically tested.<1>We also have appropriate controls and mechanisms in place to detect, respond and recover in case of adverse events. We implement a broad range of technical, procedural and organizational measures to provide an adequate level of protection for data, for example through anonymization, encryption, implementation of physical security measures, restricted access to the Personal Data segregation of networks ability to recover and restore access to Personal the Data shall an incident occur. <1>We require our staff and all third parties working for PAM to adhere to strict standards of security and data protection. Nevertheless, the security of data Personal Data transmitted over the internet (including by e-mail) cannot be guaranteed and carries the risk of access and interception. We endeavor to protect personal information Personal Data but cannot guarantee the security of data transmitted to us or by us. <3><6>Your rights<1>To the extent required by applicable laws and regulations, each Data Subject shall have the following rights: <4><5>Right to information about the Personal Data we hold and the processing implemented<5>Right to withdraw your consent to the processing of Personal Data at any time. Please note, however, that we may still be entitled to process your Personal Data if we have another legitimate reason for doing so. For example, we may need to retain your Personal Data to comply with a contractual, legal or regulatory obligation or to satisfy our internal audit requirements;<5>in some circumstances and where technically and commercially feasible, the right to receive some Personal Data in a structured, commonly used and machine-readable format and/or request that we transmit such data to a third party where this is technically feasible. Please note that this right only applies to certain types of Personal Data<5>Right of rectification of any wrong or incomplete Personal Data;<5>Right of deletion of the Personal Data in certain circumstances. Please note that there may be circumstances where you ask us to erase your Personal Data but we are required or entitled to retain it;<5>Right to restrict our processing of the Personal Data for instance when the accuracy of the Personal Data is contested; <5>Right of transferability where PAM must provide or transmit the Personal Data to the Data Subject or, if the Personal Data Subject so requests, to another entity; <5>Right of objection to the processing of the Personal Data by PAM; <5>Rights related to automated decision making and profiling where the Personal Data Subject may request PAM to refrain from making automated individual decisions, including the creation of profiles. <5>Right of lodging a complaint with the relevant data protection supervisory authority if you think that any of your rights have been infringed by us.<1>In some cases, the use of those rights may be limited or impossible due to the legal or regulatory requirements applicable to PAM or due to technical or commercial limitations. <3><6>Contact us<1>For any queries concerning the processing of Personal Data described in this Charter, to exercise any of the abovementioned rights or to address any complaint in relation with Personal the Data or its processing, Data Subjects may contact us at the following address:<4><5>Petiole Asset Management AG<5>Bahnhofstrasse 64<5>8001 Zurich<5>Switzerland<5>Email: privacy@petiole.ch