POLICY COVERING THE PROTECTION OF PERSONAL DATA APPLYING TO THE PRODUCTS AND SERVICES OF THE LYXOR GROUP This policy applies to all personal data processed by entities belonging to Lyxor Group[1] acting as the data processor. The Lyxor Group attaches great importance to the protection of your personal data. Whenever you provide us with personal data, we will handle it in accordance with the Policy set out below and with the applicable legal and statutory provisions. We act as the data processor when processing your personal data within the framework of our portfolio management activities. The main aim of this policy is to inform you about the purposes of such processing, how long we keep your data for, your rights and how to exercises these rights. [1] Lyxor Asset Management, Lyxor International Asset Management, Lyxor Intermédiation, Lyxor Asset Management UK LLP, Lyxor Asset Management Inc., Lyxor Asset Management Japan Co., Ltd. What personal data do we process? We only collect the personal data necessary for the conduct of our activities and that allow us to introduce you to our products and services, whether you are a potential client, a client, a visitor to our websites or a service provider. We may collect different categories of personal data such as, in particular, your last name, first name, IP address, postal and email address, telephone number, nationality, place and date of birth, ID card or passport number. Why and on what legal bases do we use your personal data? When you browse our website, we may collect some of your personal data and specifically your IP address. In some cases, you will also provide us with your last name, first name, telephone number and email address by completing forms or via contact pages, in particular for the following purposes: Managing your connection and browsing. Your personal data may be retained for a period of one (1) year, counting from the date on which your data were collected. Replying to your requests sent via the website. Your personal data may be retained for a period of three (3) years, counting from the last contact date; Providing news relating to our products and services by means of newsletters. Your personal data may be retained until you unsubscribe; and Commercial prospection. Your personal data may be retained for a period of three (3) years, counting from the date on which business relations ended, or the date on which a potential client last contacted us. Furthermore, we may process your personal data for the following purposes: To comply with our legal and statutory obligations, among which: combatting money laundering and the financing of terrorism, and in particular verifying and updating "Know Your Customer – KYC" data. Your personal data may be retained, as part of the KYC process, for a period of six (6) years, counting from the date on which business relations ended; compliance with the applicable legislation governing international sanctions and embargos. Your personal data may be retained for a period of five (5) years, counting from the date on which business relations ended; combatting tax fraud, complying with obligations regarding tax returns and declarations. Your personal data may be retained for a period of ten (10) years, counting from the declaration; compliance with the regulations associated with financial markets by virtue of which we need, in particular, to: carry out due diligence operations. Your personal data may be retained for a period of five (5) years, counting from the date on which business relations ended; meet our reporting obligations to the competent Authorities. Your personal data may be retained for a period of five (5) years, counting from the date on which business relations ended; record conversations and communications regardless of their media (electronic or paper correspondence, faxes, telephone interviews, etc.) Depending on the cases covered by the regulations, your personal data may be retained for a period of seven years, counting from the date on which they were recorded; in replies to official requests from duly authorised public or judicial authorities. Your personal data may be retained for a period of five (5) years, counting from the date of the reply; To assist you and reply to your requests made via our websites or addressed to us by email or on the telephone, especially so as to provide you with information relating to our products and services. Your personal data may be retained for a period of three (3) years, counting from the date on which you last contacted us; To monitor and manage the business relations we have with each of our clients and potential clients. Clients' personal data may be retained for a period of three (3) years, counting from the date on which business relations ended; personal data relating to a potential client may be retained for a period of three (3) years, counting from the date on which they were collected or the date on which a potential client last contacted us. To provide you, under certain conditions, with the contact details of our portfolio managers. Your personal data may be retained for a period of three (3) years, counting from the date of your last connection to the relevant website; To provide news relating to our products and services by means of newsletters. Your personal data may be retained until you unsubscribe; To carry out commercial prospection, subject to you exercising your right of objection, by informing you, in particular, of our news, if that could be of interest to you (sales events, updates or additional publication about our products an services...). Your personal data may be retained for a period of three (3) years, counting from the date on which business relations ended, or the last date on which a potential client last contacted us; To combat fraud. Your personal data may be retained for a period of ten years, counting from the date on which the judicial file was closed; To manage our relations with the press. If you are a journalist, your personal data may be retained for a period of three (3) years, counting from the last contact date. Your personal data are processed with respect for your fundamental freedoms and rights, with regard to: the execution of a contract, compliance with a legal or statutory obligation incumbent upon us, the pursuit of our legitimate interests, or obtaining explicit consent from you, which we will seek in the event of the personalisation, targeting and/or optimisation of our offers and services. You can, therefore, withdraw your consent at any time. We may also aggregate your data in order to establish anonymised marketing reports. Your personal data may be retained for the period necessary to achieve the purpose for which they were collected as referred to above, within the prevailing time limits. They will subsequently be deleted. Exceptionally, these data may be stored to manage ongoing complaints and disputes, as well as to meet our legal or statutory obligations and/or to reply to requests from duly authorised authorities. Accounting data may be retained for a period of ten (10) years in accordance with the applicable legislation. Communication with third parties Lyxor is likely to communicate your personal data to its partners and distributors, as well as to its subcontractors and providers, within the limits necessary to achieve the purposes set out above. Lyxor may also communicate your data to meet its legal or statutory obligations, or to respond to requests from authorities duly authorised to make such requests. Transfer of personal data outside the EEA Due, in particular, to the international dimension of Lyxor Group and in order to provide our services, the processing referred to above is likely to involve the transfer of personal data to non-member countries of the European Economic Area (EEA) whose laws on personal data protection differ from those of the European Union. In this case, a precise and demanding framework, complying with the models adopted by the European Commission, as well as appropriate security measures, have been put in place to ensure the protection of personal data. Transfers of personal data outside the EEA take place in conditions and with guarantees suitable for ensuring the confidentiality and security of such data in accordance with the applicable legislation. To this end, we implement all the appropriate technical and organisational measures to ensure the security of your personal data which could be communicated to the authorised administrative and judicial authorities in the country concerned, in particular concerning the fight against money laundering and the financing of terrorism, the fight against fraud and the determination of a person's tax status. What are your rights and how can you exercise them? You have several rights when it comes to protecting your personal data: Rights of access and rectification, Right to erasure, Right to limitation in time with regard to data processing, and Right to data portability. You can also object at any time, for reasons relating to your specific situation, to your personal data being processed. It is stated that the exercise of some rights may result, on a case-by-case basis, in it being impossible for Lyxor to provide a product or a service. You can also, at any time and free of charge and without having to provide reasons for your request, object to your data being used for commercial prospection or being communicated to third parties for the same. You can exercise your rights by contacting the Personal Data Protection Officer at the following address client-services@lyxor.com. You have the right to complain to the National Commission for Data Protection (Commission Nationale de l’Information et des Libertés (CNIL)), the supervisory authority responsible for ensuring compliance with personal data protection obligations. How do we guarantee the security of your data? We do our utmost to implement technical and organisational measures designed to protect your data. We insist that our staff and all third parties who work for us observe strict standards regarding the security and protection of information and meet contractual obligations under which they commit to protecting all personal data and applying strict measures regarding the transfer of data. How can you find out about the changes to the Personal Data Protection Policy? This Policy may be updated at any time without notice or systematic notification. If you have printed or saved this Policy, please consult the latest version of the Policy available on our websites. How can you contact us? If you have any questions about the use of your personal data within the framework of this Policy, please contact the Data Protection Officer by writing to the following address client-services@lyxor.com.