Arrowstreet is a controller in respect of your personal data and responsible for ensuring that it uses your personal data in compliance with applicable data protection law, including but not limited to the General Data Protection Regulation 2016/679 (“GDPR”) and the Data Protection Act 2018.

This Privacy Notice applies if you are a client or prospective client of Arrowstreet and sets out the basis on which any personal data about you that you provide to us, that we create, or that we obtain about you from other sources, will be processed by us.

We will collect and process the following personal data about you:

Information that you provide to us or one of our affiliates. This includes information about you that you provide us by communicating with us, whether face-to-face, by phone, e-mail or otherwise. This information may include:

• your full name, business address, email address, and telephone number

Information we collect or generate about you includes:

• your full name, title, business address, company affiliation, email address, email communications, telephone number, and notes on our communications with you

Information we obtain from other sources.

• Due diligence checks on authorized signers and signatories
• The privacy notice provided by the service provider conducting such due diligence checks can be found here:
  
  Service Provider Privacy Notice Link

• Contact information, emails, and notes on communications to contact you in connection to providing services under any investment management or subscription agreement
• Contacting you in order to advise you of other products and services, unless you have indicated otherwise
• Performing due diligence checks
• Performing client reporting in connection to services under any investment management or subscription agreement

• Arrowstreet is performing services under our applicable investment management or subscription agreement;
• Arrowstreet must comply with its regulatory and legal obligations with respect to Anti-Money Laundering and other applicable laws and regulations;
• we may need to in order to establish, exercise or defend our legal rights or for the purpose of legal proceedings; or
• the use of your personal data as described is necessary for our legitimate business interests (or the legitimate interests of one or more of our affiliates), such as:
  • matters related to servicing your account or accounts or in connection to any contractual agreement Arrowstreet has with you;
  • contacting you regarding additional products or services Arrowstreet offers.

We may disclose your personal data to our affiliates in the circumstances described below:

• Arrowstreet Capital, Limited Partnership may access your personal data in connection to serving you through the Arrowstreet Capital, Limited Partnership office;
• Types of personal data accessed include:
  • name and contact information, emails, notes on communications, and due diligence checks

We will take steps to ensure that the personal data is accessed only by employees of such affiliates that have a need to do so for the purposes described in this notice.

We may also share your personal data outside of Arrowstreet and our affiliates:

• to third party agents or contractors (for example, the providers of our electronic data storage services) for the purposes of providing services to us. These third parties will be subject to confidentiality requirements and they will only use your personal data as described in this privacy notice; and
• to the extent required by law, for example if we are under a duty to disclose your personal data in order to
  comply with any legal obligation, establish, exercise or defend our legal rights.

The personal data that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area (“EEA”) or the United Kingdom (“UK”). It may also be processed by staff operating outside of the EEA/UK who work for our affiliates or for one of our service providers.

Where we transfer your personal data outside the EEA/UK, we will ensure that it is protected in a manner that is consistent with how your personal data will be protected by us in the EEA/UK. This can be done in a number of ways, for instance:

• the country that we send the data to might be approved by the European Commission or the UK Government (as applicable)
• the recipient has signed a contract based on “model contractual clauses” approved by the European Commission or the UK Government (as applicable), obliging them to protect your personal data, in addition to other related steps as may be required by other applicable laws.

In other circumstances the law may permit us to otherwise transfer your personal data outside the EEA/UK. In all cases, however, we will ensure that any transfer of your personal data is compliant with data protection law.

You can obtain more details of the protection given to your personal data when it is transferred outside the EEA/UK (including a copy of the standard data protection clauses, as applicable, which we have entered into with recipients of your personal data) by contacting us in accordance with the “Contacting us” section below.

How long we hold your personal data for will vary. The retention period will be determined by various criteria including:

• the purpose for which we are using it – we will need to keep the data for as long as is necessary for that purpose; and
• legal obligations – laws or regulation may set a minimum period for which we have to keep your personal data.

You have a number of legal rights in relation to the personal data that we hold about you. These rights include:

• the right to obtain information regarding the processing of your personal data and access to the personal data which we hold about you;
• the right to withdraw your consent to our processing of your personal data at any time. Please note, however, that we may still be entitled to process your personal data if we have another legitimate reason (other than consent) for doing so;
• in some circumstances, the right to receive some personal data in a structured, commonly used and machine readable format and/or request that we transmit those data to a third party where this is technically feasible. Please note that this right only applies to personal data which you have provided to us;
• the right to request that we rectify your personal data if it is inaccurate or incomplete;
• the right to request that we erase your personal data in certain circumstances. Please note that there may be circumstances where you ask us to erase your personal data but we are legally entitled to retain it;
• the right to object to, and the right to request that we restrict, our processing of your personal data in certain circumstances. Again, there may be circumstances where you object to, or ask us to restrict, our processing of your personal data but we are legally entitled to continue processing your personal data and / or to refuse that request; and
• the right to lodge a complaint with the data protection regulator (details of which are provided below) if you think that any of your rights have been infringed by us.

You can exercise your rights by contacting us using the details set out in the “Contacting us” section below.

You can find out more information about your rights by contacting the Information Commissioner’s Office, or by searching their website at https://ico.org.uk/.

If you would like further information on the collection, use, disclosure, transfer or processing of your personal data or the exercise of any of the rights listed above, please address questions, comments and requests to [email protected].