Sapphire Capital Partners LLP's Privacy Notice

• INTRODUCTION

Sapphire Capital Partners LLP (“Sapphire”, “we”, “us” or “our”) is committed to protecting the privacy and security of your personal data. This Privacy Notice sets out how we collect, use, store, share and protect personal data in the course of our business activities, and explains your rights in relation to that data.

For the purposes of the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 (“DPA 2018”) and the Data (Use and Access) Act 2025 (“DUAA”). Sapphire Capital Partners LLP acts as the data controller in respect of your personal data.

Our Details

Sapphire Capital Partners LLP is regulated by the Financial Conduct Authority (FCA number: 565716). We are registered in the United Kingdom under registration number NC000562 and our registered office is at 28 Deramore Park, Malone, Belfast, BT9 5JU. You can contact us: by post, to the address given above, by telephone, on +44 (0) 2890 597213 or by email, info@sapphirecapitalpartners.co.uk

Data Protection Lead

Our Data Protection Lead ("DP Lead") is responsible for overseeing our compliance with data protection law and is your first point of contact for any data protection queries or concerns. Please contact our DP Lead, Beth Collins at beth@sapphirecapitalpartners.co.uk or +44 (0) 75 4311 9329.

We are registered with the Information Commissioner's Office ("ICO") under registration number Z3330253.

Updates to This Notice

This notice is reviewed and updated on a regular basis to reflect changes in applicable data protection law and our processing activities. The date of the most recent update is shown at the top of this notice. We encourage you to check this notice periodically.

• PERSONAL DATA WE COLLECT AND WHERE WE GET IT FROM

We collect personal data from a variety of sources depending on your relationship with us. The personal data we collect may include:

1. your name, date of birth and contact details (including address, email address and telephone number);
2. identification documentation such as passport or driving licence;
3. national insurance number, unique taxpayer reference and other tax-related information;
4. bank account details and financial information;
5. source of funds and source of wealth information;
6. investment history and transaction details;
7. your company name and role where you are acting in a professional capacity;
8. online identifiers such as IP addresses and cookie data where you visit our website; and
9. any other information you provide to us in the course of your dealings with us.

Where you are a founder or director of a company in which are receiving investment, we may also collect information from third party sources including credit reference agencies, public registers and other due diligence sources as part of our investment assessment process. We collect personal data directly from you. In some cases we may also receive your personal data from third parties involved in the administration of our funds and services, or from publicly available sources.

3. HOW WE USE YOUR PERSONAL DATA AND OUR LAWFUL BASIS

We only process your personal data where we have a lawful basis to do so. The lawful bases we rely on are set out below alongside each processing activity. The main bases we rely on are:

• Contract - where processing is necessary to perform a contract with you or to take steps at your request before entering into one;

• Legal obligation - where processing is necessary to comply with a legal or regulatory obligation;

• Legitimate interests - where processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms; and

• Consent - where you have given us your explicit consent to process your data for a specific purpose.

Fund Administration and Investment Management - We process your personal data to administer and manage any fund in which you are invested or are considering investing, regardless of its legal structure, including maintaining investor records, processing subscriptions, calculating and distributing returns, and communicating with you about your investment. The lawful basis for this processing is the performance of a contract with you and our legitimate interests in the proper administration of our business. .

Investor Onboarding and KYC/AML Compliance - We are required by law to verify your identity and assess the source of your funds before accepting you as an investor. This includes collecting identification documentation, source of funds and wealth information, and conducting anti-money laundering checks. The lawful basis for this processing is compliance with our legal obligations under the Money Laundering Regulations and FCA rules.

EIS/SEIS and Tax Relief Processing - Where you are investing through an Enterprise Investment Scheme ("EIS"), Seed Enterprise Investment Scheme ("SEIS") or other tax-advantaged structure, we process your personal data including your national insurance number, unique taxpayer reference and tax information in order to obtain and administer the relevant tax reliefs on your behalf. We also process personal data in connection with Exempt Property Unit Trusts, and Property Unit Trusts ("EPUTs" and “PUTs”) where applicable. The lawful basis for this processing is the performance of a contract with you and compliance with our legal obligations.

Due Diligence on Portfolio Companies - Where you are a founder or director of a company in which we are considering investing or have invested, we process your personal data as part of our investment due diligence process. This may include information obtained from public registers, credit reference agencies and other third party sources. The lawful basis for this processing is our legitimate interests in assessing the suitability of investments and managing the risks associated with our funds.

Regulatory Compliance and Reporting - As an FCA-authorised firm, we are required to process personal data to meet our regulatory obligations, including reporting to the FCA, HMRC and other regulatory bodies, maintaining records required by law, and responding to regulatory enquiries. The lawful basis for this processing is compliance with our legal obligations.

Client and Investor Relationship Management - We process your personal data to manage our relationship with you, including maintaining records of our communications, responding to your queries and keeping you informed about matters relevant to your investment. The lawful basis for this processing is the performance of a contract with you and our legitimate interests in maintaining effective client relationships.

Marketing and Communications - From time to time we may send you information about our services, industry updates and other relevant communications. Where we do so by electronic means, we will only contact you with your consent or where we are otherwise permitted to do so under applicable law, including the Privacy and Electronic Communications Regulations ("PECR"). You can opt out of receiving marketing communications from us at any time by contacting us at info@sapphirecapitalpartners.co.uk.

Website Enquiries - Where you submit an enquiry through our website, we process your personal data to respond to your query and, where relevant, to follow up with you about our services. The lawful basis for this processing is our legitimate interests in responding to enquiries and developing our business.

Job Applicants - Where you apply for a role with us, we process your personal data including your name, contact details, employment history and any other information you provide as part of the application process. The lawful basis for this processing is our legitimate interests in assessing your suitability for the role. We will retain your personal data for a period of six months following the conclusion of the recruitment process, after which it will be securely deleted unless you have consented to us retaining it for future opportunities.

Legal Claims and Risk Management - We may process your personal data where necessary for the establishment, exercise or defence of legal claims, or for the purposes of obtaining or maintaining insurance coverage and managing business risks. The lawful basis for this processing is our legitimate interests in protecting and asserting our legal rights and managing the risks associated with our business.

Our services are directed at adults. We do not knowingly collect personal data from individuals under the age of 16. If you believe we have inadvertently collected personal data from a child, please contact us at beth@sapphirecapitalpartners.co.uk and we will take prompt steps to delete it.

4. AI AND TECHNOLOGY TOOLS

We use AI tools to assist with tasks such as investment screening, document analysis, research and internal administrative processes. Where AI tools are used, outputs are reviewed by a member of our team before being used in any decision or communication. We do not make solely automated decisions about you that produce legal or similarly significant effects without human review.

Some of the AI tools we use are provided by third parties, including providers based outside the UK. Where those tools process your personal data, we ensure that appropriate data processing agreements and international transfer safeguards are in place before use. We only use enterprise or business versions of AI tools - we do not use consumer-facing or free versions of AI tools for the processing of personal data.

Where we use automated processing that produces decisions with legal or similarly significant effects concerning you, you have the right to obtain human review of that decision, to make representations, and to challenge the outcome. If you have any concerns about how AI tools are used in relation to your personal data, please contact our DP Lead at beth@sapphirecapitalpartners.co.uk.

We ensure that only the minimum personal data necessary is inputted into AI tools. Staff are trained not to input special category data or sensitive financial information into AI tools without appropriate safeguards in place.

5. SHARING YOUR PERSONAL DATA

We do not sell your personal data to third parties. We may share your personal data with third parties in the following circumstances:

Fund Administration Parties - In order to administer our funds and provide our services, we share personal data with parties involved in the fund structure, including custodians, nominees, fund mentors and investment advisers. These parties are provided with only the personal data necessary for the performance of their role.

Regulatory and Legal Bodies - We may be required to share your personal data with regulatory bodies including the FCA, HMRC and other government agencies in order to comply with our legal and regulatory obligations. We may also share your personal data where required to do so by law or court order.

Professional Advisers - We may share your personal data with our professional advisers including lawyers, accountants and insurers where necessary for the management of our business, the obtaining of professional advice, or the establishment, exercise or defence of legal claims.

Service Providers - We engage third party service providers who process personal data on our behalf in the course of providing their services to us, such as IT and technology providers. All such providers are required to have appropriate data protection agreements in place and to process your personal data only on our instructions.

Appointed Representatives - Where relevant, we may share your personal data with our Appointed Representatives in connection with the administration of funds and services. All Appointed Representatives are required to handle your personal data in accordance with applicable data protection law.

In all cases we ensure that personal data is shared only to the extent necessary for the relevant purpose and that appropriate safeguards are in place.

6. INTERNATIONAL TRANSFERS

Some of the third parties we work with, including certain AI tool providers and other service providers, are based outside the United Kingdom. Where we transfer your personal data outside the UK, we ensure that appropriate safeguards are in place to protect it.

The primary mechanisms we rely on for international transfers are:

• Adequacy regulations - where the UK Government has determined that a country provides an adequate level of data protection, we may transfer personal data to that country without further safeguards. This includes transfers to countries within the European Economic Area;

• International Data Transfer Agreements ("IDTAs") - where a transfer is to a country not covered by an adequacy regulation, we put in place an IDTA, which is the UK's standard contractual safeguard for international transfers; and

• UK-US Data Bridge - transfers to the United States may be made to organisations certified under the UK Extension to the EU-US Data Privacy Framework, known as the UK-US Data Bridge, which came into force in October 2023.

If you would like further information about the safeguards we have in place for international transfers, please contact our DP Lead at beth@sapphirecapitalpartners.co.uk.

7. DATA RETENTION

We will only retain your personal data for as long as is necessary for the purposes for which it was collected. The retention periods we apply are as follows:

• Fund and investment data - we retain personal data relating to your investment for a period of six years following the end of the investment. Where HMRC or applicable tax legislation requires us to retain data for a longer period, we will do so accordingly;

• EIS/SEIS and tax relief data - we retain personal data relating to EIS, SEIS and other tax relief engagements for a period of six years following the end of the engagement;

• KYC and AML records - we retain identity verification and anti-money laundering records for a period of five years following the end of our relationship with you, in accordance with the Money Laundering Regulations; and

• General correspondence and enquiries - we retain records of general correspondence and website enquiries for a period of two years.

Where it is not possible to specify a fixed retention period, we will retain your personal data only for as long as is necessary having regard to the purpose for which it was collected and any applicable legal or regulatory requirements.

When your personal data is no longer required, it will be securely deleted or anonymised.

8. YOUR RIGHTS

Under UK data protection law, you have a number of rights in relation to your personal data. These are summarised below.

• Right of Access You have the right to request a copy of the personal data we hold about you and information about how we use it. This is known as a Subject Access Request ("SAR"). We will respond to your request within one calendar month.

• Right to Rectification You have the right to ask us to correct any inaccurate personal data we hold about you, or to complete any incomplete data.

• Right to Erasure You have the right to ask us to delete your personal data in certain circumstances, for example where it is no longer necessary for the purpose for which it was collected or where you have withdrawn your consent.

• Right to Restrict Processing You have the right to ask us to restrict the processing of your personal data in certain circumstances, for example where you contest the accuracy of the data or where you have objected to our use of it.

• Right to Data Portability Where we process your personal data on the basis of your consent or in performance of a contract, and the processing is carried out by automated means, you have the right to receive your personal data in a structured, commonly used and machine-readable format.

• Right to Object You have the right to object to our processing of your personal data where we rely on legitimate interests as our lawful basis. You also have an absolute right to object to your personal data being used for direct marketing purposes.

• Rights in Relation to Automated Decision-Making Where we use automated processing that produces decisions with legal or similarly significant effects concerning you, you have the right to obtain human review of that decision, to make representations and to challenge the outcome.

• Right to Withdraw Consent Where we rely on your consent as the lawful basis for processing, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of any processing carried out before the withdrawal.

To exercise any of your rights, please contact our DP Lead at beth@sapphirecapitalpartners.co.uk. We will respond to all requests within one calendar month. In some circumstances we may need to verify your identity before processing your request.

Please note that some rights are not absolute and may be limited in certain circumstances - for example where we are required to retain data to comply with a legal obligation or where the data is needed for the establishment, exercise or defence of legal claims. We will always explain our reasons if we are unable to fulfil a request.

9. DATA PROTECTION COMPLAINTS

If you have a concern about how we have handled your personal data, we encourage you to contact us in the first instance so that we can try to resolve the matter for you. You can raise a data protection complaint directly with us by contacting our DP Lead at beth@sapphirecapitalpartners.co.uk. We will acknowledge your complaint within 30 days and will keep you informed of the progress of our investigation.

If you are not satisfied with our response, you have the right to lodge a complaint with the ICO (registration number Z3330253) at any time. The ICO is the UK's data protection regulator and can be contacted at www.ico.org.uk or by telephone on 0303 123 1113.

10. COOKIES

Our website uses cookies to improve your browsing experience and to help us understand how our website is used. Cookies are small text files placed on your device when you visit our website. You can control and manage cookies through your browser settings at any time. Please note that disabling certain cookies may affect the functionality of our website. For more information about cookies and how to manage them, please visit www.ico.org.uk/cookies. By continuing to use our website you consent to our use of essential cookies. For analytics and marketing cookies, we will ask for your consent separately.

Our website may contain links to third party websites. This Privacy Notice applies only to our website and our processing activities. We encourage you to review the privacy notices of any third party sites you visit.

11. HOW TO CONTACT US

If you have any questions about this Privacy Notice or about how we handle your personal data, please contact us using the details below.

Data Protection Lead: Beth Collins Email: beth@sapphirecapitalpartners.co.uk Telephone: +44 (0) 75 4311 9329

General Enquiries: Sapphire Capital Partners LLP 28 Deramore Park, Malone, Belfast, BT9 5JU Telephone: +44 (0) 2890 597213 Email: info@sapphirecapitalpartners.co.uk