Please note this is a convenience translation only and the legally binding document is the German version.

Privacy Policy – Spinoza Capital GmbH

Protecting your personal data is a key priority for us. Spinoza Capital GmbH is committed to handling your data with the highest care in accordance with applicable data protection regulations, in particular the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and relevant BaFin requirements.

This Privacy Policy informs you about how we process personal data, your rights, and the purposes for which we process your data.

1. Data Controller

The data controller responsible for processing is:

Spinoza Capital GmbH
Opernturm, 16th Floor
Bockenheimer Landstraße 2–4
D-60306 Frankfurt am Main
Phone: +49 69 5095 89444
Email: info@spinozacapital.com
Website: www.spinozacapital.com

Data Protection Officer: Mr. Benedikt Schöps
Email: datenschutz@spinozacapital.com

2. Definitions
• Personal data: Any information relating to an identified or identifiable natural person.
• Data subject: Any natural person whose personal data we process (e.g., clients, prospects, applicants, authorized representatives, other third parties).
3. Which Data Do We Process?

We process personal data that we:

• receive directly from you (e.g., contract data, application documents),
• lawfully receive from custodians, financial service providers, or other third parties,
• obtain from publicly available sources (e.g., commercial registers, press, internet).

Additionally, anonymized usage data from our website is processed, which does not allow conclusions to be drawn about individual persons.

4. Purpose and Legal Basis for Processing

4.1 Contractual Obligations (Art. 6(1)(b) GDPR)

To fulfill financial services contracts (asset management, fund management, investment advice, investment brokerage), we process your data for:

• performing and managing contracts
• fulfilling post-contractual information obligations
• documenting and recording advisory meetings

4.2 Legitimate Interests (Art. 6(1)(f) GDPR)

Where your interests do not override, we process data to protect legitimate interests, such as:

• asserting or defending legal claims
• IT security and fraud prevention
• business management and product development
• internal group transfers for administrative purposes

4.3 Legal Obligations (Art. 6(1)(c) GDPR)

As a financial services provider, we are subject to numerous statutory obligations (KWG, GwG, HGB, AO, WpHG, etc.) and supervisory requirements (BaFin, national authorities), e.g.:

• identity verification
• anti-money laundering measures
• accounting and risk management
• documenting advisory meetings
• retention obligations under commercial and tax law

4.4 Consent (Art. 6(1)(a), Art. 9 GDPR)

Where you give explicit consent, we process personal data, e.g., to share account data with intermediaries or to use online meeting recordings. Consent may be revoked at any time; processing performed until then remains lawful.

5. Recipients of Your Data

Access is granted only to persons or entities that:

• fulfill contractual or statutory obligations, or
• have a legitimate interest.

Data may be transmitted to service providers (IT services, investment advice, logistics, printing, telecommunications).

Other potential recipients include insurers, reinsurers, banks, asset management companies, lawyers, tax advisors, auditors, arbitration boards, and BaFin.

Third Countries:

Data may only be transferred outside the EU/EEA if:

• necessary to perform the service,
• you have explicitly consented, or
• required by law.

Appropriate safeguards are applied (standard contractual clauses, EU Commission adequacy decision).

6. Storage and Deletion

Your data is stored only as long as required to fulfill statutory or contractual obligations. After expiration of retention periods or once the purpose ceases, data is deleted or anonymized.

Legal retention periods:

• Commercial and tax law: 2–10 years
• Limitation periods under German Civil Code (BGB): typically 3 years, up to 30 years in some cases
7. Cookies & Tracking

Our website does not use cookies. Anonymized log files are used solely to ensure website functionality, optimization, and IT security (Art. 6(1)(f) GDPR).

8. Contact Forms & Email
• Data collected: Name, email, contact details, IP address, date/time, optional information
• Purpose: Handling your inquiry
• Legal basis: Consent (Art. 6(1)(a) GDPR) or legitimate interest (Art. 6(1)(f) GDPR)
9. Job Applications
• Retention: Max. 12 months (if not hired), 6 months for legal claims
• Legal basis: §26 BDSG, Art. 6(1)(b/f) GDPR
• Special categories of personal data (e.g., health data) are processed only with consent or a statutory basis (Art. 9(2)(b) GDPR).
10. Online Meetings, Telephone & Video Conferences
• Tools: Microsoft Teams or Zoom
• Data collected: Display name, email, meeting metadata, text/audio/video data
• Recordings are only made after prior notice and, if necessary, consent
• Legal basis: Art. 6(1)(b/f) GDPR, §26 BDSG for employees
• Data is stored only within the EU; transmission is encrypted
11. Profiling

We analyze data automatically, e.g., to assess suitability and appropriateness of investment recommendations.

• No automated decisions with legal effect (Art. 22 GDPR)
• Data includes knowledge, experience, financial situation, and risk profile
12. Your Rights

You have the right to:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object (Art. 21 GDPR)

You may object to direct marketing at any time, e.g., via email or contact with the Data Protection Officer.

13. Cooperation Obligations

You are only required to provide data necessary for establishing, performing, or complying with legal obligations of a contract. Without such data, a business relationship may not be possible.

14. Data Security

We implement technical and organizational measures to protect personal data against unauthorized access, loss, or manipulation. Security measures are regularly reviewed and updated.

15. Updates to the Privacy Policy

We reserve the right to update this Privacy Policy at any time in accordance with applicable regulations.

Effective: September 2025