PREAMBLE

A This Data Protection Protocol (Protocol) sets out how BGA Law and its subsidiaries and affiliates (in this Data Protection Protocol referred to as BGA Law, we, us or our) protect the confidentiality of the Personal Data which we collect, hold, use and disclose, for and on behalf of Clients.

B This Protocol is applicable where we process and/ or control Personal Data and where our clients are a (joint) Controller. It sets out the security practices and technical and organizational measures that we have implemented to ensure the security and confidentiality of the Personal Data.

C This Protocol shall form an integral part of the agreement for Services entered into between BGA Law and and the Client (the Agreement) insofar as and to the extent that such Agreement shall provide for the protection and confidentiality of Personal Data and where applicable, this Protocol shall replace any and all other provision made in such Agreement, as it relates to the same subject matter.

D for the purposes of any applicable Data Protection Law, this Protocol shall be deemed to constitute an arrangement between the Parties with regard to (a) the specific rights and obligations related to the processing or controlling or joint controlling of personal data; and (b) to ensure that sufficient safeguard is provided in respect of the technical and organisational security measures concerning the use of such Personal Data. 

E Data Protection Laws impose on the Parties the obligation to monitor compliance with the measures set out herein.

NOW THEREFORE this Protocol shall form part of any Agreement in place between BGA Law and a Client as regards the Agreement.

Definitions

Data Subject

the person to whom Personal Data relates.

Security Incident

an infringement of the technical or organizational security measures taken that may lead
to a considerable chance of serious adverse consequences or that has serious adverse
consequences for the protection of personal data.

Data Controller or Controller

shall have the meaning given to it under applicable Data Protection Laws and in the case where there shall be more than one Data Controller, each shall be a Joint Controller.

Data Processor or Processor

shall have the meaning given to it under applicable Data Protection Laws

Client

Means the party with whom BGA Law shall have contracted with for the provision of Services.

Data Leak

an incident resulting in unlawful destruction, loss, change, unauthorized disclosure of or
access to personal data as a result of a security incident.

Data Protection Laws

means any laws or regulations that shall for the time being, be applicable to Personal Data relating to the protection of Personal Data but in particular shall include (without limitation):

(a) for the European Union, the Regulation (EU) 2016/679 of the European Parliament and of the council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as “the GDPR”); (b) for the Cayman Islands the Cayman Data Protection Law 2019; (c) the British Virgin Islands, the Data Protection Act 2021; (d) for Hong Kong, the Personal Data (Privacy) Ordinance (Cap. 486) as amended in 2012.

Personal Data

means any data regarding a Data Subject identified or identifiable living person, collected and processed by BGA Law and for the purposes of this Protocol, the types of Personal Data may include (without limitation)

(a) Demographic data such as name, gender, date of birth, age, nationality;

(b) Contact details such as home and work phone numbers, postal addresses and email addresses;

(c) Financial data such as bank account number;

(d) Government identifiers such as passport copies, driver’s licence, income tax number; and

(e) Criminal records and political associations where they are revealed by client screening.

Agreement

means the agreement BGA Law shall have entered into with a Client for the provision of the Services.

Services

Means the services provided by BGA Law to a Client as specified in the Services Agreement and shall include (without limiting the generality thereof) fund administration and ancillary services, corporate and fiduciary services, reporting and tax services

Subject Transmission Request

Means a request by a Data Subject to have their Personal Data transferred or transmitted to a third-party Controller.

Subject Access Request

Means a request by a Data Subject to obtain information about the processing of their Personal Data or to have the information rectified, erased or blocked

Party or Parties

Means any party who shall be a party to a Services Agreement.

Interpretation

For the purposes of this Protocol:

(a) capitalised words used in this Protocol without definition, shall have the meaning as otherwise set out herein or as set out in any applicable Data Protection Laws.

Article 1 – Data processing

1. BGA Law obtains Personal Data of Data Subjects for the purposes of:

• administrative processing of subscription applications;
• transfers and requests for redemptions of shares or participations;
• to enable BGA Law to perform a risk assessment as prescribed by applicable anti-money laundering and anti-terrorist financing laws and regulations;
• to conduct checks and monitoring in accordance with BGA Law KYC policies in force from time to time and as may be required by any applicable laws and regulations;
• to enable BGA Law to carry out a classification for FATCA, CRS and other similar regulations and AEOI purposes;
• to enable BGA Law to process Confidential Information in accordance with the performance of the Services
• complying with any legal obligation to which either Party is subject; and
• to optimise the global services which BGA Law is able to provide to Clients.

2. The details of the processing activities carried out on behalf of the Client by BGA Law (such as the subject matter of the processing, the nature and purpose of the processing, the type of personal data and the categories of data subjects) are listed in Appendix I.

3. The Parties shall not process Personal Data in a way that is incompatible with the purposes agreed above and in the Agreement.

4. BGA Law takes no responsibility for obtaining consent by the Client for the purposes of sending marketing communications including newsletters or statements.

5. As a Data Controller, the Client remains responsible together with BGA Law for ensuring that all uses of the Personal Data are in compliance with the Privacy Laws.

6. BGA Law guarantees that the processing of Personal Data  is done with due care and only processes the Personal Data made available within the framework of the Agreement, except for deviating statutory obligations and/or with the Client’s prior permission. BGA Law may decide in its sole discretion on the means of processing of Personal Data and will inform the Client if any relevant changes occur.

Article 2 – Responsibilities of the parties

1. Where the Client shall pass the Personal Data of a Data Subject to BGA Law, it shall ensure that it is compliant with Data Protection Laws to the extent necessary for the processing of Personal Data, including:

a. ensuring it has obtained any necessary consents in order for BGA Law to process the Personal Data in accordance with the Agreement; and
b. ensuring it has provided adequate notice as required by Data Protection Laws to the processing of the Personal Data by BGA Law and if applicable the transfer of data outside the European Economic Area.

2. Where Personal Data relating to a Data Subject is collected by BGA Law.  we shall, at the time when Personal Data is obtained, or at least within one month after that time, provide the Data Subject with all of the following information:

• BGA Law’s company information and the contact details;
• the contact details of the data protection officer, where applicable;
• the purposes of the processing for which the Personal Data is intended as well as any legal basis for the processing;
• the recipients or categories of recipients of the Personal Data, if any;
• where applicable, the fact that BGA Law intends to transfer Personal Data to a third country or international organisation and reference to the appropriate or suitable safeguards in place.

3. In addition to the information referred to in paragraph 2 of this Article, BGA Law shall, at the time when Personal Data is obtained, provide the Data Subject with the following further information necessary to ensure fair and transparent processing:

• the period for which the Personal Data will be stored, or if that is not possible, the criteria used to determine that period;
• the existence of the right to request from BGA Law access to and rectification or erasure of Personal Data or restriction of processing concerning the Data Subject or to object to processing as well as the right to data portability which is the right of a Data Subject to receive the Personal Data concerning him or her, which he or she has made available, in a structured, commonly used and machine-readable format and have it transmitted to another controller without hindrance;
• where the processing is based on consent or when it concerns specific categories of Personal Data, the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
• the right to lodge a complaint with a supervisory authority;
• whether the provision of Personal Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as;
• whether the Data Subject is obliged to provide the Personal Data and of the possible consequences of failure to provide such Personal Data.

4. Where BGA Law intends to further process the Personal Data for a purpose other than that for which the Personal Data was collected, BGA Law shall request approval from the Client first. After approval, BGA Law shall provide the Data Subject prior to that further processing, with information on that other purpose and with any relevant further information as referred to in paragraph 2 and 3 of this Article.

5. Paragraphs 2, 3 and 4 of this Article shall not apply where and insofar as the Data Subject already has the information.

6. Each Party shall, in respect of Personal Data, ensure that they have provided sufficient information to the Data Subjects in order for them to understand which of their Personal Data is being shared, the circumstances in which it will be shared, the purposes for the data sharing and the identity of with whom the Personal Data shall be shared.

Article 3 – Non Disclosure

The Parties undertake not to disclose to third parties anything that comes to the notice of the parties or their employees about the other party’s operations and/or Personal Data made available, except for information that is known to and/or accessible to anyone, or if such is necessary or mandatory, it is:

• within the framework of the implementation of the Agreement;
• under or in compliance with legislation and regulations, including any applicable regulation or supervision of the services to be provided by BGA Law;
• under a statutory obligation to disclose to a judicial authority, government authority or supervisory agency;
• under a provisionally enforceable or final and binding court decision;
• the information is public other than through a breach by a Party of the terms of the Agreement; or
• with the other Party’s written consent.

Article 4 – Security and subprocessing

1. BGA Law shall take and maintain appropriate technical and organisational measures, and if necessary, adjust these to protect the Personal Data from destruction, loss, falsification, unauthorized dissemination or unauthorized access, or any form of unlawful processing.

2. Under this Article, BGA Law ensures that a duty to protect Personal Data shall be imposed on third parties to be engaged by it. BGA Law assures the Client that sub-processors will be chosen with the necessary care and that the same data protection obligation as stated in this protocol and if relevant is imposed on all its sub-processors. If BGA Law engages a third-party processor for carrying out specific processing activities, the obligations that shall be imposed on that processor by way of a written contract providing sufficient guarantees to implement appropriate technical and organisational measures in such manner that the processing will meet the requirements of the Data Protection Laws. A list of approved sub-processors BGA Law uses or intends to use, is attached to this Agreement as Appendix II.

3. Notwithstanding the obligations under this article, BGA Law may in any case engage third parties that qualify or may qualify as Processor for delivering IT solutions to the organisation. BGA Law will obtain the written consent of the Client at least 14 days before engaging Processors for any task not listed in this article. BGA Law will accurately inform the Client on the Processors engaged by it and any changes thereof. In case the Client has reasonable grounds to object to the use of new or more sub-processors, the Client must immediately inform BGA Law of this in writing within 14 days of receipt of this notification. BGA Law will, if the objection is not unreasonable, endeavor to make changes to the services available to the Client or to recommend a commercially reasonable change in the configuration of the Client or the use by the Client of the services to prevent the processing of Personal Data by the new or other sub-processor objected to, without unjustifiably burdening the Client. If BGA Law cannot make this change available within a reasonable period, which period shall not exceed sixty (60) days, the Client may terminate the affected part of the Agreement, but only in respect of those services that cannot be provided by BGA Law without the use of the new or other sub-processors objected to by means of written notification to BGA Law.

4. If a sub-processor is located in a third country (as defined and or stated under the Data Protection Laws), at the written request of the Client and insofar as required, BGA Law shall enter into a model contract (in the name of the Client). In this case, the Client instructs and authorizes BGA Law to give sub-processors instructions on behalf of the Client and to use all rights of Client to the sub-processors on the basis of the model contract.

5. BGA Law remains liable to the Client for compliance with the obligations of a sub-processor, in case such sub-processor does not fulfil its obligations. However, BGA Law is not liable for damage and claims arising from instructions from the Client to sub-processors.

6. Where BGA Law only processes Personal Data on the instructions of the Client, BGA Law has the obligation to demonstrate compliance with paragraph 1 of this article and should cooperate with any reasonable audit request from the Client on 30 days notice.

Article 5 – Data retention rules

1. BGA Law shall not retain or process Personal Data for longer than is necessary to carry out the agreed purposes.

2. Notwithstanding paragraph 1 of this article, the Parties shall continue to retain Personal Data in accordance with any statutory or professional retention periods applicable in their respective countries and/or industry.

Article 6 – Security incidents and data leaks

1. BGA Law shall at all times during the term of the Agreement, have measures and procedures in place designed to detect Security Incidents and Data Leaks and to take relevant action, including recovery measures. Upon discovery of a Security Incident or Data Leak BGA Law shall notify the Client without undue delay of Security Incidents which have resulted in a Data Leak.

BGA Law shall include information in the notification regarding:

• the nature of the infringement;
• the nature of the leaked Personal Data;
• the (alleged) cause of the infringement and the (alleged) cause of the leaked Personal Data;
• a description of the infringement found and the probable consequences of the infringement for the processing of Personal Data;
• the measures recommended to limit the negative consequences of the infringement;
• the measures BGA Law has taken or proposes to remedy the consequences.

2. In the event of such an infringement in connection with Personal Data, BGA Law will assist with the obligation of the Client pursuant to the applicable Data Protection Laws to inform the data subjects and the Supervisory Authorities respectively, and to document the Personal Data breach. Contact details regarding the report are recorded in the customer service system. Contacts persons are specified in Appendix I attached to this Agreement.

Article 7 – Rights of data subjects

1. Data Subjects have the right to obtain information about the processing of their Personal Data or to have the information rectified, erased or blocked through a Subject Access Request. Data Subjects may also request to have their Personal Data transferred or transmitted to a third-party controller through a Subject Transmission Request.

2. Where the data is to be transmitted to a third-party controller, this shall be done in a structured, commonly used and machine-readable format.

3. BGA Law shall maintain a record of Subject Access Requests and Subject Transmission Requests received by BGA Law, the decisions made and any information that was exchanged, transmitted or transferred.

4. The Parties agree that the responsibility for complying with a Subject Access Request or a Subject Transmission Request falls to the Party receiving the request in respect of the Personal Data held by that Party.

5. The Parties agree to provide reasonable and prompt assistance to each other as is necessary for each Party to comply with their obligations under applicable Data Privacy Laws.

Article 8 – Automated decision making

BGA Law does not carry out automated profiling and will not make any decisions based on the automated processing of Personal Data without informing the Client.

Article 9 – Transfer of personal data

1. BGA Law may, in the performance of the Services, transfer and provide access to Personal Data in third countries. Such transfer shall only be made to a country whose laws shall have been   assessed by the European Commission to have an adequate level of protection by means of an adequacy decision and in which case the transfer shall be subject to the terms of a contract incorporating standard contractual clauses in the form adopted by the European Commission under Decision 2010/87/EU
(the Model Clauses) or equivalent or replacement decision.

2. BGA Law shall not transfer or provide access to Personal Data outside a country as referred to in Article 9.1 above, except with the Client’s express written permission.

Article 10 – Accountability and obligation to report

1. Following a reasonable request, BGA Law shall provide the Client with the necessary information in order for the Client to be able to draw an informed opinion on Border’s compliance with its obligations set out under Data Protection Laws

2. Where Border qualifies as a Joint Controller the Parties are responsible for any applicable reporting of the relevant processing of (personal) data to the relevant data protection authority. The Parties will cooperate in this regard until the obligations have been met.

Article 11 – Liability

All liability arising from or in connection with this protocol follows and is exclusively governed by the liability provisions set out in, or otherwise applicable to, the Agreement. Therefore, and in order to calculate liability limits and/or to determine the application of other limitations of liability, any liability arising from this protocol is deemed to arise under the relevant Agreement.

Article 12 – Duration and termination

1. This protocol shall be in force for as long as the Agreement is in force. On termination of the Agreement, the arrangement of this protocol shall end by operation of law without any further (legal) act being required.

2. Early termination of this protocol or the arrangement made by it is not possible.

3. Subject to a statutory provision resting with Border, Border shall, in the case of termination of the Agreement, and when the processing of Personal Data is no longer necessary to settle the Agreement’s termination, ensure that:

• the Personal Data is returned or provided to the Client or a successive contractor designated by the Client on a suitable information carrier;
• the Personal Data is destroyed, if the Client so requests;
• after return, provision or destruction, it immediately ceases and does not resume any processing of (the relevant) Personal Data.

4. Obligations under the Agreement including this protocol, which by their nature are intended to continue even after the end of the Agreement, continue to exist after the end of the Agreement.

Article 13 – Miscellaneous

1. In the event of conflict between the provisions in this protocol and the Agreement and/or any other agreements between the Parties, the provisions of this protocol with regard to the data protection obligations of the Parties shall prevail. In case of doubt as to whether clauses in these other agreements relate to the data protection obligations of the Parties, the arrangements of this protocol will prevail.

2. The invalidity or unenforceability of any provision in this protocol will not affect the validity or enforceability of the other provisions of this protocol. The invalid or unenforceable provision is (i) so modified so as to guarantee its validity or enforceability and at the same time the parties’ intentions are preserved as much as possible or, if not possible, (ii) interpreted as if the invalid or unenforceable part had never been included therein. The foregoing also applies if this protocol contains an omission.

3. Personal Data which BGA Law processes is stored by BGA Law on its servers and/ or on the servers of the cloud-based database located in Switzerland. This protocol is exclusively governed by the applicable law of the Agreement and any dispute in respect of this Agreement or execution thereof shall be submitted to BGA Law entity servicing the Client and before the competent court as defined in the Agreement.

4. Any amendment to this protocol shall be published on BGA Law website, but shall not reduce or otherwise limit the rights of the Client.

APPENDIX I

Categories of data subjects

Transmitted Personal Data concern, but are not limited to, the following categories of Data Subjects:

• The shareholders, directors or unit holders in entities or investment funds for which we give legal advice to individuals connected with the entity or unit holders (for example directors, trustees, employees, representatives, shareholders, investors, clients, beneficial owners or agents) which includes, but is not restricted to, data such as name, residential address, email address, place of birth, date of birth, bank account details and details relating to your investment activity;
• Individuals that represent the Client, that are advising the Client, that are in any contractual or statutory relationship with the Client, or that the Client has collected in view of its servicing towards such individuals, or are otherwise connected to such individuals.

Subject of processing

All processing activities (including the collection, organisation and analysis of Personal Data) as are reasonably required to facilitate or support the provision of the Services described under the Agreement.

Nature and purpose of the processing

BGA Law collects, processes and uses the Personal Data of the Data Subjects:

• where this is necessary for the performance of the Agreement;
• where this is necessary for compliance with a legal obligation (such as the anti-money laundering obligation to verify the identity of our customers (and, if applicable, their beneficial owners) and other applicable regulations, such as tax reporting regimes as FATCA and CRS; and/or
• where this is necessary for the purposes of the legitimate interests of us or a third party and such legitimate interests are not overridden by your interests, fundamental rights or freedom.

Kind of personal data

The Personal Data collected, processed and used by BGA Law includes:

• names and contact information;
• general demographic information (such as gender, age, date of birth, marital status, nationality, employment details, residence, utility bills, etc.);
• personal identification documentation and related information such as passport numbers and employee identification numbers;
• financial and payment data such as bank account numbers and transaction information;
• information related to the provision of the Services

Appendix II

1. POT Verhuizingen/ Logistiek B.V.
2. Avantage Cloud Solutions B.V.
3. Remondis B.V.
4. Docusign.