Privacy notice

Structure of this notice

This notice explains which Highvern entity is responsible for your personal data and, where relevant, when Highvern acts as a processor on behalf of a client. It also covers the types of personal data we collect, including information required for AML and KYC purposes; how and why that data is used; the legal bases for processing; who it may be shared with; international transfers across Highvern’s network; how long data is retained; and the rights available to individuals.

It also explains how to contact us to exercise those rights or raise a question about the use of your personal data.

PRIVACY NOTICE

The Highvern group of companies is comprised of various entities across several jurisdictions (collectively, “the Company”, “us” or “we”).

For a full list of Highvern entities see our legal and regulatory page here.

INTRODUCTION

Highvern provides fund administration, accounting, depositary, private wealth management and corporate services.

We are committed to the principles of respecting the safety, accuracy, and integrity of all personal data that we hold and only using it for the purposes for which it has lawfully been collected. We are also committed to the principle of transparency – i.e. ensuring that to the extent permitted by law all individuals in respect of whom the Highvern holds personal data are aware of how that data is being used and of their rights in relation to that data.

From time to time we may need to make changes to this Privacy Notice. This could be because of government regulation, new technologies or other developments in data protection laws.

TYPES OF DATA PROCESSING CARRIED OUT

Highvern will act as a data processor within the meaning of the GDPR (as defined below) to process data on our clients’ instructions, as set out in the contract in order to provide the service to you and according to the relevant Terms of Business.

Highvern will also separately act as a data controller (within the meaning of the GDPR) where it determines the processing of data for its own purposes for example employment matters, risk assessments and screening.

Highvern may engage with other data controllers such as lawyers or auditors in order to provide the service to you. Where such a joint controller arrangement (within the meaning of the GDPR) is put in place, this will be communicated to you.

DATA PROTECTION PRINCIPLES

All processing of personal information is conducted in accordance with the data protection principles set out in the EU’s General Data Protection Regulation (GDPR) and/or other relevant data protection legislation depending on your location and as applicable to the relevant entity and processing activity. Our policies and procedures are designed to ensure compliance with the following principles:

• Your personal data is processed fairly, lawfully and in a transparent manner;
• Your personal data is collected for a specific purpose and is not processed in a way which is incompatible with the purpose for which it was collected;
• Your personal data is adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed;
• Your personal data is kept accurate and, where necessary, kept up to date with every effort to erase or rectify without delay;
• Your personal data is kept no longer than is necessary for the purposes for which the personal information is processed;
• We take appropriate steps to keep your personal information secure; and
• Your personal information is processed in accordance with your rights.
• We are responsible for, and must be able to demonstrate, compliance with the data protection principles set out above.

WHAT PERSONAL DATA DO WE PROCESS?

The types of personal information that we collect will vary depending on a number of factors including the nature of your relationship with us and the services we are requested to perform. Highvern collects personal data from many sources, both public and private. The collected information may be used by us to enhance our service offerings, and otherwise to communicate with our clients and network and to transmit newsletters. Over time, we may also create personal data by documenting our interactions with you, including updating your contact information or preferences etc.

The categories of personal data processed typically include:

• Name and contact information – email, postal address and telephone number;
• Information required to meet legal and regulatory requirements in respect of anti-money laundering legislation, including details such as date of birth, passport number(s), other government-issued number(s), nationality, images of passports and driving licences, signatures, occupation, source of funds and source of wealth;
• Information required to meet legal and regulatory requirements relating to the automatic exchange of tax information (e.g. FATCA and CRS), including details of tax residency, tax classification and tax identification numbers;
• Financial details, including billing address; bank account numbers; instruction records; transaction details and counterparty details;
• Public domain information including matters revealed by client screening processes;
• Information about the services we provide to you, including any preferences you have expressed in relation to these services;
• Information required to facilitate investments you make or redeem from funds or trusts we administer or actions we make on your behalf based on instructions from corporate clients;
• Details of meetings and telephone calls with our office and employees;
• Any other information you may provide to us or might be provided to us by our clients, third parties etc;
• CCTV or similar security information should you visit our premises (closed-circuit cameras are installed at some of our offices for the purposes of security);
• Any other information about you which we may obtain as part of our day-to-day business operations, including but not limited to events hosted by Highvern;
• Information obtained through our use of our cookies (please see our cookie notice which is linked at the footer of this website); and
• In certain limited circumstances we may request or receive special category data about you, including but not limited to details about your health if the context requires it and with your express consent. For example, if you require documents in larger font or if you require access arrangements to our offices, this could indicate your health status. If you attend one of our events we may request details of your dietary preferences which could indicate your health status or religious beliefs.

SPECIAL CATEGORY DATA

Highvern will normally not hold information which is considered special category data (previously known as sensitive personal data). This includes information on racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, data concerning health or data concerning a natural person’s sex life or sexual orientation. However, there may be occasions where this data is processed or held by us for example during screening of public sources or where you disclose it to us.

CRIMINAL DATA

We may process personal data relating to criminal convictions and offences, where required by statute. For example, when conducting client screening or enhanced due diligence, we may process personal data relating to criminal convictions and offences that include information regarding trade prohibition, money laundering, terrorism or other criminal offences.

OTHER DATA

We may process personal data about other individuals to the extent it is necessary to fulfil our contract with a client. These individuals may be legal representatives of the client, relatives or associates who may fall under the definition of a politically exposed person (PEP), employees of companies which are sold or acquired, parties to a relevant contract or similar.

HOW DO WE COLLECT YOUR PERSONAL INFORMATION?

We mainly collect information from you directly via telephone, electronic communications and to a lesser extent written correspondence (post). However, this may also be collected indirectly from third parties as a result of the nature of the services we provide. Such information is requested during the following processes conducted by Highvern:

• Client introductions and onboarding, including due diligence;
• Client specific activities and transactions;
• Transfer agency processes; and
• For legal matters, e.g., to execute and perform contractual agreements.

Depending on the nature of our relationship with you, we may also collect your personal information from a number of different sources including publicly available information. For example:

• Through companies which validate identity for financial crime purposes;
• From third party registers maintained by regulators;
• Through business interactions between your company and us;
• Other electronic verification checks or screening systems to ensure all regulatory obligations are met; and
• Other third parties including fund service providers, lawyers, tax advisers, investment managers and other professional advisors retained by the relevant client.

HOW AND WHY DO WE USE YOUR PERSONAL INFORMATION?

This is dependent on our relationship with you and includes (but is not limited to):

• If you are a prospective client or existing client, we use your personal information to onboard you as a client and to provide services;
• If you are a financial services firm, we use your personal information to provide you with information about our services and events or in order to service a common client;
• If you are an employee of a firm that we have a business relationship with, we use your personal information as part of our normal course of business;
• If you are a candidate for a job, we use your personal information as part of our recruitment process;
• To prevent fraud and comply with our regulatory obligations; and
• If you are viewing our website, we use your personal information contained in cookies.

MARKETING

We may from time to time use your personal information to promote to you the services we offer and other related services offered by Highvern. However, we will only do so if you have explicitly consented to receiving marketing materials from us.

You may unsubscribe from receiving marketing communications from us at any time by emailing unsubscribe@highvern.com.

WHAT IS THE LEGAL BASIS FOR PROCESSING PERSONAL DATA?

We may process your personal information for a number of different purposes. However, we need a reason to use and process your personal information which is called a legal basis – further details are given below. Reasons for collecting personal information includes:

• Performance of a contract- where processing is necessary for the performance of a contract to which you are party.
• Legitimate Interest- to manage, maintain and develop our relationship with clients and day to day operations – to facilitate the management and administration of all aspects of our business.
• In order to manage and administer billing and payment services connected to Highvern and to manage and administrate our accounting.
• In order to defend Highvern against actual or potential legal claims.
• Statutory basis- To ensure all legal obligations are met including requests from regulators.
• Consent – where you, for example, have consented to receiving marketing materials or to retention of your personal data for the purpose of your job application or future suitable roles.

WHO DO WE SHARE YOUR PERSONAL INFORMATION WITH?

We will only disclose your personal information in accordance with applicable laws and regulations. This may include (but is not limited to):

• Our corporate clients e.g., if you are a client business contact then this could be your employer;
• Any person with legal or regulatory power over us that may require disclosure on legal grounds. Please note that where we share your personal information with the authorities, we may, depending on the circumstances be forbidden from advising you of the fact that your personal information was disclosed or requested by the authorities;
• Service providers engaged by us to help us run our business. Such service providers may include, for example, cloud or archive storage providers (engaged by us to provide electronic or physical storage facilities for our business data and your information), or providers of software or other IT resources, tax advisers etc;
• Any member of Highvern which means our affiliates, our ultimate holding company and its subsidiaries (from time to time) including those who are engaged by us to perform support services;
• Providers of background checks and risk screening services; and
• Where required to provide information to a Regulator or Enforcement Authority.

HOW LONG DO WE KEEP RECORDS FOR?

We will only store personal data for as long as it is necessary to fulfil a legitimate purpose for which we collected it, or as necessary for fulfilling any statutory retention period according to for example anti-money laundering, bookkeeping or accounting legislation. After any statutory retention period, we will either delete or destroy the relevant personal data permanently or irreversibly anonymise this information.

INTERNATIONAL DATA TRANSFER

In the course of providing services to clients we may transfer personal data to third parties located in other countries, including countries outside the European Economic Area (EEA), or countries which do not have data protection legislation deemed equivalent to the GDPR. By way of example, this may happen if any of our servers are from time to time located in a country outside of the EU or if a service provider operates in another jurisdiction. If you use our services while you are outside the EEA, your information may be transferred outside the EEA in order to provide you with those services. We will only transfer your personal information to another country or an international organisation outside the EEA where we have taken the required steps to ensure that your personal information is protected. Legal mechanisms Highvern may use to ensure safeguards in terms of international data transfers (where applicable) are:

1. The use of EU Standard Contractual Clauses. These are pre-approved, standardised legal templates issued by the European Commission for transferring personal data from the EU or the EEA to jurisdictions without an official adequacy decision. The Standard Contractual Clauses can be viewed on the European Commission’s website here.
2. The use of Binding Corporate Rules – these are an intra-group contractual mechanism which apply exclusively to intra-group transfers of data.
3. The use of a ‘derogation’ – which is an approved exception to the requirements for international transfer. Derogations include but are not limited to: explicit consent; contractual necessity or public interest.

CHILDREN’S DATA

We do not knowingly collect data relating to children (under 16 years of age), except with parental consent (or if the child is the beneficiary of a Trust N.B our Trust Companies may need to process their data without their consent or knowledge if they are a beneficiary). Taking into account the above exceptions, if we learn that we have collected the personal information of a child under 16 without parental consent, we will take steps to delete the information as soon as possible.

JOB APPLICATIONS

If you apply for a role with us, the information you submit will not be shared with any third parties unless recruitment is performed via an external party. However, we may share information with other companies in Highvern, to the extent necessary. In addition, we use the recruitment platform Teamtailor provided by Teamtailor AB. Access to the information will be restricted to the persons involved in the recruitment process.

Types of data processing included in the recruitment process typically include:

• To assess candidates based on experience, qualifications and academic performance and to collect evidence of such credentials;
• To administer and arrange interviews and to record the outcomes of the interviews; and

With your consent, we may save your information in a database for candidates for future suitable roles.

YOUR RIGHTS

Under GDPR and equivalent data protection legislation in other jurisdictions, you have the following rights in relation to our use of your personal information including:

• Right to access your personal information: You are entitled to a copy of the personal information we hold about you and certain details of how we use it (subject to certain exemptions). This can be done by contacting Highvern using the contact details below.
• Right to object: Where we process your personal information on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation. We will stop that processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing is necessary for establishing, exercising or defending legal claims. You may object at any time to processing for direct marketing, including related profiling, and we will stop processing your information for that purpose.
• Right to rectification: We take reasonable steps to ensure that the personal information we hold about you is accurate and complete. However, if you do not believe this is the case, please contact us and request an update or amendment.
• Right to erasure: In the circumstances provided by applicable law, you may ask us to erase your personal information. This right is subject to exceptions, including where processing is necessary to comply with a legal obligation or to establish, exercise or defend legal claims.
• Right to restriction of processing: In certain circumstances, you are entitled to ask us to stop using your personal information. We will implement and maintain appropriate procedures to assess whether a request to restrict the processing of your data can be implemented.
• Right to data portability: In certain circumstances, you have the right to ask that we transfer any personal information that you have provided to us to another third party of your choice. Once transferred, the other party will be responsible for looking after your personal information.
• Right to object to direct marketing: You can ask us to stop sending you marketing messages at any time.
• Right not to be subject to automated decision making. We make certain decisions using automated systems, such as checking identity for financial crime purposes. You have the right to request that this decision is checked by a human.
• The right to withdraw consent: For certain limited uses of your personal information, we will ask for your consent. Where we do this, you have the right to withdraw your consent to further use of your personal information. You may withdraw consent at any time using the contact details below, without affecting the lawfulness of processing based on consent before its withdrawal. For marketing, you may also use the unsubscribe facility provided in our communications.
• You can make any of the requests set out above using the contact details in this policy. Please note that in some cases we may not be able to comply with your request for reasons such as our own obligations to comply with other legal or regulatory requirements. However, we will always respond to any request you make and if we can’t comply with your request, we will tell you why.
• You have a right to complain to the relevant Data Protection Regulator at any time if you object to the way in which we use your personal information. While you do not have to contact us first, we would be grateful if you would contact the Group Head of Data Privacy in the first instance by emailing dpo@highvern.com who will do their best to resolve. The contact details for the respective regulators are below. Where the GDPR applies, you may complain to the supervisory authority in the country of your habitual residence, place of work or the alleged infringement.

Regulators

JERSEY OFFICE OF THE INFORMATION COMMISSIONER — www.jerseyoic.org

OFFICE OF THE DATA PROTECTION AUTHORITY - GUERNSEY — www.odpa.gg

OFFICE OF THE OMBUDSMAN OF THE CAYMAN ISLANDS — www.ombudsman.ky/data-protection

INFORMATION COMMISSION’S OFFICE – UNITED KINGDOM — www.ico.org.uk

DATA PROTECTION COMMISSION - IRELAND — www.dataprotection.ie

INFORMATION REGULATOR - SOUTH AFRICA — www.rapdp.org

SWEDISH AUTHORITY FOR PRIVACY PROTECTION — www.imy.se/en/

NORWEGIAN DATA PROTECTION AUTHORITY — www.datatilsynet.no

CONTACT DETAILS

If you wish to exercise any of your rights or have a question or concern, please reach out to your Highvern contact in the first instance and/ or the Group Head of Data Privacy dpo@highvern.com

If you are located in the EU, our EU data protection representative is in Ireland and can be contacted at: EUDataProtectionRepresentative@highvern.com

If you are located in Cayman, our Cayman data protection representative can be contacted at: CaymanDataProtectionRepresentative@highvern.com

If you are located in South Africa, our South African data protection representative can be contacted at: SADataProtectionRepresentative@highvern.com

If you are located in the UK, our UK data protection representative can be contacted at: UKDataProtectionRepresentative@highvern.com

If you are located in the UK, this is also the contact email for any data protection related complaints. Any such complaints will be acknowledged within 30 days and will be investigated and responded to without undue delay. You will be informed of progress and provided with a clear outcome, including any action taken and information about the right to complain to the Information Commission’s Office.

This privacy statement was last reviewed in October 2026.