Privacy Policy

PRIVACY POLICY GREN WORLD MANAGEMENT S.à r.l. — Corporate Informational Website Version 4.1 — October 2026

1. Data Controller

The controller of the personal data collected through the website www.grenfinance.com (the “Website”) is GREN WORLD MANAGEMENT S.à r.l., a private limited liability company (société à responsabilité limitée) incorporated under the laws of the Grand Duchy of Luxembourg, registered with the Luxembourg Trade and Companies Register (Registre de Commerce et des Sociétés) under number B304466, EUID LURCSL.B304466, with registered office at 2-4, Parc d’Activités Capellen, L-8308 Capellen, Grand Duchy of Luxembourg (the “Controller” or “GWM”). The Controller alone determines the purposes and means of the processing described in this Policy, including the processing activities relating to marketing, business development, investor relations and event management described in Section 4 (the “Marketing Activities”). Other entities of the GREN group and external providers that support the Controller in such activities act exclusively on its documented instructions as processors within the meaning of Article 28 GDPR, under written data processing agreements. The single point of contact for data subjects is legal@grenfinance.com. Where a data subject initiates a subscription, onboarding or reverse-solicitation process, Vault AM S.à r.l. (the “AIFM”) processes personal data as an independent controller for the performance of its own legal obligations as alternative investment fund manager (including investor eligibility, anti-money laundering and marketing record-keeping obligations), in accordance with its own privacy notice, which is provided at that stage.

2. Data Protection Officer

The Controller has assessed the requirement to designate a data protection officer pursuant to Articles 37 to 39 GDPR. As at the date of publication of this Policy, such designation is not mandatory, since the Controller’s processing activities do not involve large-scale processing of special categories of data nor regular and systematic monitoring of data subjects on a large scale. The Controller keeps this assessment under periodic review, in particular in the light of the extension of the Marketing Activities to several Member States, and shall update this Policy should a data protection officer be designated, whether on a mandatory or voluntary basis. A privacy contact is in any event available at legal@grenfinance.com.

3. Categories of Personal Data Processed

3.1 Browsing data. Technical information transmitted automatically by the data subject’s browser in the ordinary operation of the Website, including IP address, approximate location derived therefrom, device identifiers, log files, browser type and version, operating system, pages visited, referral URLs and session duration. Such data is processed for technical, statistical and security purposes and for the application of the jurisdictional restrictions described in the Legal Notice & Disclaimer, and is not otherwise used to identify data subjects, save where necessary to ascertain liability in connection with unlawful conduct against the Website.

3.2 Access gate data. The country of residence or establishment selected by the data subject, the confirmation of professional investor status within the meaning of Annex II of Directive 2014/65/EU, the date and time of such confirmation and the associated technical identifiers, recorded when the data subject accesses the sections of the Website dedicated to the fund managed by the AIFM.

3.3 Data provided voluntarily. Personal data submitted through contact forms, requests for documentation, registration to events or webinars, or correspondence, which may include: first name and surname, e-mail address, telephone number, company name, professional role, country of residence or establishment, information relevant to investor categorisation (including the criteria under Annex II of Directive 2014/65/EU) and any further information freely provided by the data subject.

3.4 Professional contact data obtained from third parties. Business contact data of professionals and representatives of professional investors, intermediaries and institutions (name, role, professional e-mail address and telephone number, employer, country), obtained from publicly available sources, professional directories, professional social networks or licensed business databases, or communicated by introducers appointed by the group, for the purposes of the Marketing Activities. Where such data is not collected from the data subject, the information required by Article 14 GDPR is provided at the latest at the time of the first communication.

3.5 Event, webinar and video-call data. Registration data, attendance, questions asked and, where announced in advance, audio and video recordings of webinars or events organised by the group.

3.6 Recruitment data. Personal data submitted through the “Work with us” section or otherwise in connection with an application, including curricula vitae, qualifications and professional history, processed exclusively for recruitment and selection purposes and retained for no longer than twelve (12) months from receipt, unless the candidate consents to a longer period or a contractual relationship is established.

3.7 Cookies and similar technologies. The Website uses strictly necessary cookies required for its proper functioning. Analytics cookies and any other non-essential cookies are activated solely upon the data subject’s prior, explicit consent. Complete information is set out in the Cookie Policy, accessible from the footer of every page of the Website.

3.8 Special categories of data. The Controller does not collect, through the Website, special categories of personal data within the meaning of Article 9 GDPR, nor personal data relating to criminal convictions and offences within the meaning of Article 10 GDPR. Should such data be communicated inadvertently, the Controller shall arrange for its immediate erasure, save where retention is required by law.

4. Purposes of Processing, Legal Bases and Retention

Personal data is processed for the following purposes, each resting on a specific legal basis under Article 6 GDPR:

  • handling of contact requests, documentation requests and communications: pre-contractual measures taken at the data subject’s request (Article 6(1)(b) GDPR) or the Controller’s legitimate interest in responding to enquiries (Article 6(1)(f) GDPR); retention of twelve (12) months from the closure of the enquiry, unless a longer period is required by law or by the establishment of a business relationship;

  • verification of investor eligibility and professional categorisation, application of the jurisdictional restrictions on the marketing of the fund, and keeping of the register of marketing communications and of the persons to whom they were addressed: compliance with the legal obligations applicable to the AIFM and to the entities of the group under Directive 2011/61/EU, Regulation (EU) 2019/1156 and their national implementing measures (Article 6(1)(c) GDPR) and the legitimate interest of the Controller and of the AIFM in demonstrating such compliance (Article 6(1)(f) GDPR); retention of five (5) years from the end of the marketing of the relevant sub-fund in the relevant jurisdiction, or such longer period as required by the competent authority;

  • direct marketing towards professional investors, intermediaries and institutions, including the sending of documentation, newsletters, invitations to events and information on the funds of the group by e-mail, telephone or professional social networks (the Marketing Activities): the legitimate interest of the Controller in promoting their activities to professional counterparties (Article 6(1)(f) GDPR and Recital 47), where the national rules implementing Directive 2002/58/EC permit business-to-business communications on that basis, and otherwise the data subject’s consent (Article 6(1)(a) GDPR); in every case, each communication contains a simple and free means of objecting, and the data subject’s objection is honoured without delay; data is processed until objection or withdrawal and, in the absence of any interaction, for no longer than twenty-four (24) months from the last contact;

  • organisation and management of events, webinars and meetings, including, where announced in advance, their recording: pre-contractual measures taken at the data subject’s request (Article 6(1)(b) GDPR) and the Controller’s legitimate interest in documenting its institutional activity (Article 6(1)(f) GDPR); recordings are retained for twenty-four (24) months unless a longer period is required for regulatory record-keeping;

  • technical administration, operation and security of the Website, including the prevention and detection of fraud and unauthorised access: the Controller’s legitimate interest in the proper functioning and security of its systems (Article 6(1)(f) GDPR); navigation logs are retained for six (6) months, save for such longer period as is strictly necessary for the investigation of security incidents;

  • aggregated and anonymised statistical analysis of Website usage: the Controller’s legitimate interest in improving the Website (Article 6(1)(f) GDPR) and, where reliant on non-essential cookies, exclusively the data subject’s consent (Article 6(1)(a) GDPR); analytics data is retained for no longer than twenty-six (26) months;

  • recruitment and personnel selection: pre-contractual measures taken at the candidate’s request (Article 6(1)(b) GDPR);

  • compliance with legal and regulatory obligations applicable to the Controller, including company law, tax law and, where applicable, anti-money laundering and counter-terrorist financing legislation: legal obligation (Article 6(1)(c) GDPR); data is retained for the periods mandated by the applicable provisions;

  • establishment, exercise or defence of legal claims: the Controller’s legitimate interest (Article 6(1)(f) GDPR), for the duration of the relevant limitation periods and proceedings.

Where processing rests on legitimate interest, the Controller has carried out and documented a balancing test between such interest and the fundamental rights and freedoms of data subjects, concluding that its interest prevails for the purposes indicated above, having regard in particular to the professional nature of the data subjects concerned by the Marketing Activities and to the reasonable expectations of persons who publish their professional contact details. Data subjects may obtain information on the relevant assessments by writing to legal@grenfinance.com.

5. Data Retention

Personal data is retained solely for the period strictly necessary to fulfil the purposes for which it was collected and, in any event, for no longer than the periods indicated in Sections 3 and 4. Upon expiry of the applicable retention period, data is erased or irreversibly anonymised. Retention beyond such periods is permitted only where required by law (including tax, corporate, anti-money laundering, or financial-sector record-keeping obligations, such as the five-year record-keeping obligations of alternative investment fund managers), where necessary for the establishment, exercise or defence of legal claims, or where the data subject has consented to a longer period.

6. Recipients and Data Sharing

Personal data is not disseminated to the public and is never sold, rented or otherwise made available to third parties for their own commercial purposes. Data may be disclosed, to the extent strictly necessary and on a need-to-know basis, to the following categories of recipients:

  • technical service providers, including the website hosting platform, e-mail, newsletter, customer-relationship management, video-conferencing and event-management providers, and IT infrastructure and maintenance providers, acting as processors pursuant to Article 28 GDPR under written data processing agreements;

  • other entities of the GREN group, acting as processors on the Controller’s instructions for the Marketing Activities and for internal administrative purposes within the meaning of Recital 48 GDPR, under written intra-group data processing agreements;

  • the AIFM, as independent controller, for the purposes of its legal obligations described in Section 1, including the keeping of the register of marketing communications and, where a subscription process is initiated, the depositary, the registrar and transfer agent, the central administration agent and the auditor of the fund, as further described in the documentation provided in that context;

  • distributors, placement agents and introducers duly appointed in writing by the AIFM or by the group, acting as independent controllers within the limits of their appointment, where the data subject has been introduced by, or has asked to be put in contact with, such a party;

  • legal, tax, audit and other professional advisers assisting the Controller, bound by statutory or contractual confidentiality obligations;

  • public authorities, supervisory bodies (including the CSSF and the competent authorities of the Member States in which the fund is marketed) and courts, where disclosure is required by applicable law, regulation or enforceable order.

7. International Data Transfers

Personal data is processed primarily within the European Economic Area (“EEA”). Where personal data is transferred to countries outside the EEA, including in connection with the use of technical providers established in third countries or with the operational presence of GREN group entities outside the EEA (including the United Arab Emirates and Singapore), the Controller ensures that the transfer complies with Chapter V GDPR, namely: on the basis of an adequacy decision of the European Commission pursuant to Article 45 GDPR (including, for providers established in the United States, certification under the EU–U.S. Data Privacy Framework, where applicable); or subject to appropriate safeguards pursuant to Article 46 GDPR, including Standard Contractual Clauses approved by the European Commission, supplemented where necessary by additional technical and organisational measures identified through a transfer impact assessment; or, residually, on the basis of one of the derogations set out in Article 49 GDPR. Personal data relating to prospective investors resident in the EEA is not transferred to the group’s offices outside the EEA for marketing purposes. Data subjects may request a copy of the safeguards adopted, or information on where they have been made available, by writing to legal@grenfinance.com.

8. Security Measures

The Controller implements appropriate technical and organisational measures to ensure a level of security commensurate with the risk, pursuant to Article 32 GDPR, including: transmission of data via encrypted HTTPS/TLS protocol; access controls based on authentication and the least-privilege principle; logging, backup and recovery procedures; internal procedures for the management of security incidents and personal data breaches, including the notification obligations under Articles 33 and 34 GDPR; periodic awareness and training of personnel involved in processing; and the selection of providers offering sufficient guarantees pursuant to Article 28 GDPR.

9. Rights of Data Subjects

Pursuant to Articles 15 to 22 GDPR, data subjects have the right to: obtain confirmation as to whether personal data concerning them is being processed, and access such data and the related information (Article 15); obtain the rectification of inaccurate data and the completion of incomplete data (Article 16); obtain the erasure of personal data in the cases provided for by law (Article 17); obtain the restriction of processing in the circumstances provided for by law (Article 18); receive the personal data they have provided in a structured, commonly used and machine-readable format and transmit it to another controller, where technically feasible (Article 20); object at any time, on grounds relating to their particular situation, to processing based on legitimate interest, and object at any time and without justification to processing for direct marketing purposes, including by using the unsubscribe link contained in each communication (Article 21); and not be subject to decisions based solely on automated processing, including profiling, which produce legal effects concerning them or similarly significantly affect them (Article 22).

Where processing rests on consent, the data subject may withdraw consent at any time, without prejudice to the lawfulness of processing carried out prior to withdrawal (Article 7(3) GDPR).

Requests may be submitted to legal@grenfinance.com. The Controller shall respond without undue delay and, in any event, within one (1) month of receipt; such period may be extended by two (2) further months where necessary, having regard to the complexity and number of requests, in which case the data subject shall be informed of the extension and of the reasons therefor within one month of receipt (Article 12(3) GDPR).

Data subjects further have the right to lodge a complaint with the competent supervisory authority, namely the Commission Nationale pour la Protection des Données (“CNPD”), 15, Boulevard du Jazz, L-4370 Belvaux, Grand Duchy of Luxembourg, www.cnpd.lu, or with the supervisory authority of the EEA State of their habitual residence, place of work or place of the alleged infringement (Article 77 GDPR), including: for Italy, the Garante per la protezione dei dati personali (www.garanteprivacy.it); for Belgium, the Autorité de protection des données / Gegevensbeschermingsautoriteit (www.autoriteprotectiondonnees.be); for Bulgaria, the Commission for Personal Data Protection (www.cpdp.bg); for Estonia, the Andmekaitse Inspektsioon (www.aki.ee); for Ireland, the Data Protection Commission (www.dataprotection.ie); for Norway, Datatilsynet (www.datatilsynet.no); for Romania, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (www.dataprotection.ro); and for Sweden, the Integritetsskyddsmyndigheten (www.imy.se).

10. Nature of Data Provision

The provision of browsing data is inherent to the technical operation of the Website, and its absence prevents access thereto. The provision of the information requested through the access gate is a condition for access to the sections of the Website dedicated to the fund. The provision of data through contact or request forms is voluntary; however, failure to provide the information indicated as mandatory will render it impossible to process the relevant request. The provision of data for direct marketing purposes on the basis of consent is entirely optional, and refusal entails no consequence on access to the Website or on the handling of other requests.

11. Data Relating to Minors

The Website is not directed at individuals under the age of eighteen (18). The Controller does not knowingly collect personal data relating to minors and, upon becoming aware that such data has been collected inadvertently, shall arrange for its immediate erasure. Any person who believes that data relating to a minor has been collected through the Website is invited to contact legal@grenfinance.com.

12. Automated Decision-Making and Profiling

The Controller does not carry out, through the Website, processing involving solely automated decision-making, including profiling, which produces legal effects concerning data subjects or similarly significantly affects them, within the meaning of Article 22 GDPR. The application of geolocation-based access restrictions is a technical measure of regulatory compliance and does not produce legal effects concerning the data subject; any person who believes that a restriction has been applied in error may contact legal@grenfinance.com.

13. Social Media Pages

The Controller maintains official pages on professional social networks (including LinkedIn). For the statistical information (“page insights”) made available to the Controller by the platform operator in relation to visitors of such pages, the Controller and the platform operator act as joint controllers within the meaning of Article 26 GDPR, in accordance with the joint controllership terms published by the platform operator, which also sets out the responsibilities of each party. The processing of personal data by the platform operator for its own purposes is governed by that operator’s privacy notice. Messages and comments received through such pages are processed by the Controller for the purpose of responding to them, on the basis described in Section 4; the Controller does not provide investment advice or accept subscription requests through such channels.

14. Updates to This Policy

The Controller reserves the right to amend or update this Policy at any time, including to reflect regulatory developments, guidance of the competent authorities, the extension of the marketing of the fund to further jurisdictions or changes in processing activities. The most recent version, together with its version number and date, is available at all times on this page. In the event of material changes, the Controller shall inform data subjects through a prominent notice on the Website or, where appropriate, by direct communication.

15. Applicable Law and Regulatory Framework

This Policy is drawn up in accordance with: Regulation (EU) 2016/679 (GDPR); the Luxembourg Law of 1 August 2018 on the organisation of the National Commission for Data Protection and the general data protection framework, as amended; the Luxembourg Law of 30 May 2005 concerning the protection of privacy in the electronic communications sector, as amended, with respect to cookies and electronic communications; the national rules implementing Directive 2002/58/EC in the Member States in which the Marketing Activities are carried out; the guidelines and decisions of the CNPD; and the guidelines, recommendations and opinions of the European Data Protection Board.

16. Contact

For any information, request or enquiry relating to this Policy or to the processing of personal data, please contact GREN WORLD MANAGEMENT S.à r.l. at legal@grenfinance.com. The registered office is located at 2-4, Parc d’Activités Capellen, L-8308 Capellen, Grand Duchy of Luxembourg. Additional information is available at www.grenfinance.com.

GREN WORLD MANAGEMENT S.à r.l. · Privacy Policy · Version 4.1 · October 2026