Introduction

Petiole Asset management AG (“PAM”) understands that your privacy is important to you and that you care about how your personal data is used. PAM acting as data controller needs to gather and process certain information about individuals. These can include customers, prospects, suppliers, representatives, business contacts, contractors, service providers, employees and other people the organization has a direct or indirect relationship with or may need to contact. This Charter describes how data is processed by PAM and how to meet PAM’s data protection standards and comply with applicable laws and regulations.

About the data we collect

PAM collects personal data (“Data”) relating to identified or identifiable natural persons (each a "Data Subject"). Data may allow to identify a Data Subject directly or indirectly. The nature of the Data we collect may fall into one of the following categories:

• Identification data such as full name, gender, marital status, date and place of birth, passport number, national identification number, tax identification number, signature, photo, video or voice recording;

• Contact data such as personal address, phone number, email address or any information a Data Subject might be providing us when filling out a form provided by us;

• Financial data such as bank account number, other account number or information about the wealth of a Data Subject;

• Business data such as investments monitoring or details about the products or services that a Data Subject benefits from;

• Marketing and communication data;

• Professional information data such as position, work address, professional phone number, professional email address;

• Profile data such as username and password from our online services and the use of and

• interaction with our online services;

• Technical and electronical data such as IP address, browser type and version, browser plug in types and versions, operating system cookies, IP address; data related to our internal investigations, in particular verification relating to screening carried out before we enter into a relationship with a client, verification carried out during the course of our business relationship, verification relating to the application of the rules on sanctions, anti-money laundering and the fight against terrorism financing obligations and all information related to verification carried out on our means of communication.

• We may use your personal information to send you newsletters, marketing or promotional materials and other information that may be of interest to you. You may opt out of receiving any, or all, of these communications from us by following the unsubscribe link or instructions provided in any email we send.

The data we collect or hold about a Data Subject may come from a variety of sources. Some will have been collected directly from the Data Subject. Data may also have been collected in compliance with applicable regulations in the past or collected by affiliates of PAM. The source can also be records of correspondence and communication between a Data Subject and PAM, including telephone calls, emails, social media communications or any other type of exchanges and communications. We may also collect data in the context of meetings or other communications (e.g. when Data Subjects call us, write us or visit us) or when Data Subjects visit our website or use our online services or applications. Some Data may come from sources that are accessible to the general public (e.g., public registers, press and websites) or may have been collected from external companies (e.g. electronic databases). Data Subjects have to ensure that the data about them collected by us are accurate, relevant and up to date.

Legal basis and purposes of the data processing

We use Data either when a Data Subject has consented to it or when such use is founded on a legal basis:

• Execution of an existing contract between a Data Subject and PAM or of a pre-contractual measure;

• Compliance with legal or regulatory obligations;

• Preservation of a public interest such as the prevention or detection of fraud or other criminal activity;

• Interaction with governmental or regulatory bodies or other competent national authorities;

• Pursuit of our legitimate interests such as the development of the business relationship and the provision of information on services and products offered by PAM or by third party partners, the improvements of PAM’s internal organization and processes, any risk assessment to which PAM is subject and decision-making in risk management, or the protection of PAM’s interests, defending or exercising rights in court and cooperating in investigations initiated by authorities in Switzerland or overseas.