Privacy Policy

1. Data Controller

For the purposes of the General Data Protection Regulation (Regulation EU 2016/679, "GDPR"), SCG Global LLC acts as the Data Controller for personal data collected through this Website.

2. Categories of Personal Data We Collect

2.1 Data You Provide

We collect personal data that you voluntarily provide when initiating contact, including:

• Identification data: full name, country of residence or origin
• Contact data: email address, telephone number (where provided)
• Inquiry data: area of interest, investment criteria, free-text message, and any information you choose to share
• Communication records: content of emails, messages, and other written correspondence

2.2 Data Required for Compliance

In connection with a potential engagement, and prior to substantive introduction, we (or licensed counterparts engaged in connection with a transaction) may request:

• Identity verification documentation (KYC)
• Source-of-funds and beneficial-ownership information (AML/CFT)
• Proof of qualified investor status or authorization to act

This data is handled separately, through secure channels, and is subject to additional safeguards.

2.3 Technical Data

When you access this Website, certain technical data may be processed automatically, including IP address, browser type, operating system, and timestamps of access. This data is used solely for security, integrity, and logging purposes, and is not combined with identifying data without legal basis.

2.4 Data We Do Not Collect Through This Website

We do not collect through this Website:

• Financial account numbers or payment information
• Copies of identification documents (passports, ID cards)
• Sensitive data under GDPR Article 9 (health, political opinions, religious beliefs, etc.)
• Data from minors under 16 years of age (the Website is not directed at minors)

3. Legal Basis for Processing

We process personal data only where we have a valid legal basis under GDPR Article 6, namely:

• Pre-contractual measures (Art. 6(1)(b) GDPR) — responding to your inquiries at your request;
• Performance of a contract (Art. 6(1)(b) GDPR) — providing services under a signed engagement;
• Legal obligation (Art. 6(1)(c) GDPR) — compliance with AML, CFT, tax, and reporting obligations;
• Legitimate interests (Art. 6(1)(f) GDPR) — maintaining internal records, preventing fraud, ensuring integrity and security of our services. You have the right to object to this processing at any time;
• Explicit consent (Art. 6(1)(a) GDPR) — where specifically requested and documented.

4. Purposes of Processing

We use personal data exclusively for the following legitimate purposes:

• Responding to inquiries you have initiated;
• Coordinating private introductions and related engagements;
• Communicating about opportunities relevant to your expressed interest;
• Fulfilling legal, tax, and regulatory obligations;
• Exercising or defending legal claims;
• Maintaining the security and integrity of our systems.

We do not:

• Sell, rent, lease, or trade your personal data to third parties under any circumstances;
• Use your data for automated decision-making with legal or similarly significant effect (Art. 22 GDPR);
• Engage in profiling, targeted advertising, or behavioral tracking;
• Share your data with data brokers or aggregators.

5. Recipients and Disclosure

Personal data is strictly confidential and shared only with:

• Licensed counterparts directly involved in your engagement (e.g. legal counsel, tax advisors, notaries) — only with your knowledge and, where required, your explicit consent;
• Service providers processing data on our behalf (e.g. email hosting, website hosting, customer relationship tools) — each bound by data processing agreements and confidentiality obligations, and each processing data only on documented instructions;
• Competent authorities — where disclosure is strictly required by applicable law, court order, or regulatory request.

We select our service providers with due diligence and require that they comply with appropriate security standards and applicable data protection law.

6. International Data Transfers

SCG Global LLC is a U.S. entity with operational presence in the European Union. Consequently, personal data may be transferred to, stored in, or processed in jurisdictions outside the European Economic Area ("EEA").

For any transfer of personal data outside the EEA, we ensure an adequate level of protection through one or more of the following safeguards:

• European Commission adequacy decisions, where applicable;
• Standard Contractual Clauses (SCCs) approved by the European Commission;
• Other safeguards recognized under GDPR Article 46;
• Your explicit consent, where applicable under GDPR Article 49.

You may request a copy of the applicable safeguards by contacting us at the address below.

7. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including legal and regulatory retention requirements:

• Inquiries not resulting in engagement: deleted within 24 months, unless you request earlier deletion;
• Active engagement data: retained for the duration of the engagement and for the applicable statutory retention period thereafter (typically 5–10 years depending on jurisdiction);
• Compliance records (KYC/AML): retained in accordance with applicable AML/CFT law, typically no less than 5 years after the end of the business relationship;
• Technical logs: retained for security purposes for a limited period (typically 90 days).

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized.

8. Your Rights Under GDPR

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights in relation to your personal data:

• Right of access (Art. 15 GDPR) — obtain confirmation of whether we process your data, and a copy thereof;
• Right to rectification (Art. 16) — correct inaccurate or incomplete data;
• Right to erasure (Art. 17) — request deletion of your data, subject to legal exceptions;
• Right to restrict processing (Art. 18) — limit how we process your data in certain circumstances;
• Right to data portability (Art. 20) — receive your data in a structured, machine-readable format;
• Right to object (Art. 21) — object to processing based on legitimate interests;
• Right to withdraw consent (Art. 7(3)) — where processing is based on consent, without affecting the lawfulness of prior processing;
• Right not to be subject to automated decision-making (Art. 22) — we do not engage in such processing;
• Right to lodge a complaint (Art. 77) — with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement.

To exercise any right, contact us at info@scgglobalgroup.com. We will respond within one month, unless the request is complex or numerous, in which case the period may be extended by two further months, with prior notice to you.

We may require reasonable identity verification before responding. No fee is charged for legitimate requests; repetitive or manifestly unfounded requests may be refused or charged.

9. Cookies and Tracking Technologies

This Website uses only strictly necessary technical cookies required for its operation and security. We do not use advertising cookies, analytics cookies, or third-party tracking technologies on this Website without prior explicit consent.

Strictly necessary cookies do not require consent under GDPR and ePrivacy rules. If this changes, we will update this Policy and introduce an appropriate consent mechanism.

10. Data Security

We apply appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, disclosure, or destruction, including:

• Access controls limiting personal data access to authorized persons only;
• Encryption of data in transit where applicable;
• Confidentiality obligations binding all persons with access to personal data;
• Periodic review of security measures.

However, no transmission over the internet or electronic storage method is fully secure. We cannot guarantee absolute security, and process personal data at your own risk insofar as such risk cannot reasonably be eliminated by applicable technical means.

11. Data Breach Notification

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of the breach, in accordance with GDPR Article 33. Where the breach is likely to result in a high risk, we will also notify you directly without undue delay, in accordance with GDPR Article 34.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The latest version will always be available on this page, with the "Last updated" date revised accordingly. Material changes will be communicated by appropriate means.

13. Contact

For any question, concern, or request in relation to this Privacy Policy or the processing of your personal data, please contact us at info@scgglobalgroup.com.

---

This Privacy Policy is provided for transparency purposes and does not constitute legal advice. Individuals uncertain about their rights are encouraged to consult qualified data protection counsel or the supervisory authority in their jurisdiction.