FLC GDPR Data Protection Notice

Last Updated: September 1, 2026

Fisher Lynch Capital, LLC and its affiliates (each, a “Data Controller”, and together being the “Data Controllers” or “we”) collect and process personal data of natural persons resident in the United Kingdom and/or the European Economic Area and/or other jurisdictions that have implemented a law similar to the EU General Data Protection Regulation 2016/679 (together “GDPR Jurisdictions”), (the “Data Subjects”). The Data Subjects are expected to be either natural person investors or natural persons connected to the investor.

This Notice is provided by each relevant Data Controller only to the extent that it is regarded as a data “controller” of the Data Subjects’ personal data under applicable data protection laws in the GDPR Jurisdictions.

Personal Data Collected

The Data Controllers receive personal data from a number of sources, including: (i) from Data Subjects directly; (ii) as part of Investor completing the Subscription Agreement on behalf of themselves or as representatives of other Data Subjects; (iii) from third parties working with the Data Controllers’ such as placement agents, and other intermediaries; (iv) from information Data Controllers’ have gathered from prior transactions; (v) from publicly available information; (vi) from a Data Subject’s bank in connection with investor information and from professional advisers; (vii) through any investor portal and from online data sources and information providers; and (viii) through information provided in correspondence and other forms.

The personal data may include:

  • Contact information, such as name, title, address, business and/or personal telephone number, and business and/or personal email addresses.
  • Verification information, such as passport, driving license, utility bill, credit or bank card statement, wire transfer information, consumer reports, country of residence, country of origin/nationality, country of domicile/tax residency, tax reference number, date of birth, family information, occupation, investor status, and other applicable legal and regulatory information.
  • Finance-related information, such as the amount invested and details of the investment made, and related details of the investor/Data Subject.
  • Work information, such as name, name of the business the Data Subject works for and/or is a controlling person for, business address, business telephone number, and business email address as well as preference related and work-related information (e.g., role title, level of education and professional qualifications, dietary requirements).
  • Investment experience information, such as capital account balance, capital commitment, capital contributions and distributions and, in the case of an investor that is an individual retirement account, and information with regard to such account, risk tolerance and transaction history or investment experience.
  • Marketing information, such as information about marketing and communication preferences.
  • Online information, such as [information regarding a person’s interaction with an investor portal].

The Data Controllers do not anticipate that any “special category” personal data (e.g., any information that reveals or contains racial or ethnic origin, political opinions, religious and philosophical beliefs, trade union membership, genetic data, biometric data, health data, sex life and sexual orientation) will be collected. It may be collected incidentally. Where any such information is provided this will generally be because a Data Subject has volunteered such information and/or documents gathered for certain regulatory or legal purposes (e.g., for AML/KYC checks) reveal such information.

We will endeavor to keep personal data we store about Data Subjects reasonably accurate and up to date by enabling Data Subjects to correct it by request. Data Subjects should notify us of any personal data changes or if they become aware of any inaccuracies in the personal data we hold.

Purposes & Lawful Basis for Processing Personal Data

The Data Controllers use the personal data held about Data Subjects for certain purposes relying upon certain lawful basis/bases as set out below.

With respect to the processing of personal data in the context of this Notice, we are generally permitted to do this because:

  • There is a legal or regulatory obligation (“Legal/Regulatory Obligation”);
  • It is necessary for the performance of a contract (e.g., the Subscription Agreement or any other related agreements or documentation) or to take steps before entering into a contract with the Investor/Data Subject (“Contract”); or
  • It is in our legitimate interests or those of a third party (“Legitimate Interests”).
PurposesPersonal DataLawful Basis
To undertake pre-investment steps, including, but not limited to:
(i) determining eligibility to invest;
(ii) required due diligence; and
(iii) ascertaining investment preferences.
Contact information
Verification information
Finance-related information
Investment experience information
Contract
Or
Legal/Regulatory Obligations
To complete anti-money laundering checks and other checks as are required by law, including counter-terrorist financing law and tax law, and/or detect crime.Contact information
Verification information
Legal/Regulatory Obligations
Or, if not, Legitimate Interests, including to protect and enhance the business and operations, including: (i) to comply with applicable non-statutory regulations and guidance as well as internal policies and procedures; and (ii) to respond to requests from legal, regulatory, judicial, administrative, governmental and other official bodies.
To process transactions, to accept Data Subjects/investors as a limited partner and to carry out obligations arising from investment related documents entered into by or on behalf of investors/Data Subjects.Contact information
Verification information
Finance-related information
Contract
To provide services to and manage the affairs of the investments and relationships with Data Subjects and investors (including the acquisition and disposal of investments, and arranging for the preparation and auditing of accounts, statements or reports and similar), for periodic investor reporting, and for other administrative purposes, including to maintain records and correspondence relating to Data Subjects’ participation in the relevant funds as well as for corporate governance.Contact information
Verification information
Finance-related information
[Online information]
Contract
Or, in all other cases, Legitimate Interests, including to provide a comprehensive, professional and tailored service to Data Subjects and investors.
To communicate with Data Subjects, for business development activities and to send informational and/or marketing messages to Data Subjects, whether current or past, about the Data Subjects’/related parties’ investment.Contact information
Work information
[Marketing information]
Where it is in the Data Controllers’ Legitimate Interests to promote the funds or services of the Data Controllers and provide a comprehensive, efficient and tailored service to Data Subjects.
To disclose information to Data Recipients (as defined below) in order to enable the other purposes outlined in this Data Protection Notice.Contact information
Verification information
Finance-related information
Legal/Regulatory Obligations
Or, in all other cases, Legitimate Interests, including to conduct business and to provide a comprehensive, professional and tailored service to Data Subjects and Investors.
To protect the Data Controllers’ rights, property, or safety of their business, their clients, investors or others and/or to comply with judicial or regulatory proceedings, a court order or other legal process or law.Contact information
Verification information
Finance-related information
Legal/Regulatory Obligations
Or, in all other cases, Legitimate Interests, including to conduct and protect the business (e.g., (i) to initiate and defend claims, (ii) to prevent and detect crime, fraud and other abuses, (iii) to investigate and attend to enquiries and (iv) to enforce legal rights).
In case of sale or merger or similar to potential purchasers, investors and their applicable third party service providers.Contact information
Verification information
Finance-related information
Legitimate Interests, including to conduct and protect the business.

We do not anticipate that we will make any decision with respect to Data Subjects’ personal data using fully automated means.

Where the provision of personal data is necessary for the Data Controllers to ensure compliance with Legal/Regulatory Obligations or to take actions pursuant to the fund related documentation, failure to provide relevant personal data for the abovementioned purposes may prevent the maintenance of the fund and/or may prevent the execution of the fund related documentation.

Disclosure of Personal Data

The Data Controllers disclose personal data about Data Subjects to Data Controllers’ affiliates and subsidiaries as well as to certain third parties, including legal advisers; accountants and auditors; administrators; investment managers/advisers; financial service providers, banks, broker-dealers, credit providers; parties undertaking anti-money laundering checks; companies engaged to dispose of or store data, including personal data; adverse parties who have a legal right to receive such information and their counsel, experts; supervisory, tax, or other authorities and regulators in various jurisdictions; transfer agents, brokerage firms and or other such advisors, and relevant affiliates or third party service providers of each of the above (each a “Data Recipient”).

The Data Recipients may, as the case may be, process the personal data as data processors (when processing the personal data upon instructions of a Data Controller for the purposes set out in this Notice) or as distinct independent data controllers (when processing the personal data for their own purposes, including fulfilling their own legal obligations). The attention of Data Subjects is therefore also drawn to the relevant data protection notices of Data Recipients of data controllers for further details of their further processing.

The Data Controllers may also disclose personal data to other parties at the direction of, or with the consent of, a Data Subject or investor, including to persons acting in a fiduciary or representative capacity on their behalf, and may disclose certain investor information (such as investor name and capital commitment) to other investors in a specific fund where contemplated by the relevant fund documents.

Personal Data Retention

The Data Controllers will endeavor not to keep personal data in a form that allows a Data Subject to be identified for any longer than is reasonably necessary for achieving the permitted purposes. At the end of the applicable retention period, we may destroy, erase from our systems, or anonymize personal data as part of such efforts. The retention period will be determined by various criteria, including the amount, nature and sensitivity of the personal data, the purposes for which we process it and whether we can achieve those purposes through other means, and our legal, regulatory, tax, accounting and records‑retention obligations (including any applicable statutes of limitation).

International Transfer of Personal Data

The Data Controllers are located in the United States. Where the Investor is an alter ego of a natural person, the Investor has sought the explicit consent of the natural person (and any other related Data Subject) to the transfer of the personal data to the United States as envisaged by this Notice and the Subscription Agreement. Where the Data Recipients are located outside the GDPR Jurisdictions, the Data Controllers will ensure that relevant safeguards are implemented where required by applicable data protection laws. Where the jurisdiction has not been deemed to provide an adequate level of protection pursuant to applicable data protection laws, this usually means we will enter into specific contracts approved by relevant authorities.

If further information is required with respect to international transfer this can requested by using the details set out in the ‘Questions’ section below.

Rights in Relation to Personal Data

Data Subjects may have certain rights in relation to their personal data, these may include, where certain conditions are met:

  • the right to request access to the personal data we hold about Data Subjects;
  • the right to have inaccurate information about them rectified (amended or updated);
  • the right to object to processing of personal data about Data Subjects;
  • the right to withdraw consent at any time (where relevant);
  • the right to have personal data erased or to restrict processing in certain limited situations;
  • the right to data portability and to request the transmission of personal data to another organization;
  • the right to object to the processing of personal data in certain circumstances, including with respect to direct marketing; and
  • the right to lodge complaints with applicable data supervisory authorities (e.g., the ICO in the UK).

Data Subjects should use the contact information below to obtain more information and/or to make a formal request.

Changes to this Notice

This Notice sets out our current policy as regards the maintenance and processing of personal data. It does not form, and should in no way be construed as, a contract and no contractual rights or causes of action shall arise in relation to or in consequence of the content of this Notice.

The Data Controllers reserve the right to modify this Notice at any time and without prior notice. Updated versions may be provided through investor communications, the Fisher Lynch extranet or other appropriate channels, and Data Subjects are encouraged to review such updates to remain informed about our data protection practices.

Questions

Please direct any questions in relation to this Notice to: Dana O’Brien at compliance@fisherlynch.com.