Privacy Policy

This Privacy Policy applies to Personal Data processed through the SDM website, forms, communications, onboarding channels, and related services that link to this Policy. "Personal Data" means information about an identified or identifiable individual and includes "personal information" and similar terms used under applicable privacy laws. Depending on how you interact with SDM, we may collect: - Identifiers and professional contact details, such as your name, business email address, telephone number, company, title, and mailing address - Information you submit through contact, affiliate, newsletter, access-request, account, onboarding, or support channels, including message content and attachments - Eligibility and preference information, such as your selected location, investor type, service interests, and communication preferences - Identity, compliance, and financial information required for an approved client relationship, which may include date of birth, government identification, beneficial ownership, source-of-funds, tax, bank, wallet, transaction, and sanctions-screening information - Technical and usage information, such as IP address, browser and device type, approximate location, referring page, pages viewed, session activity, and cookie or similar-technology identifiers - Records of our relationship with you, including applications, agreements, correspondence, service activity, and records we must maintain for legal, regulatory, fraud-prevention, security, or audit purposes Please do not provide Personal Data that we have not requested, particularly sensitive information, through a general website form. Additional notices may apply during onboarding or when you enter into a client agreement with a specific SDM entity.

We collect Personal Data: - Directly from you, including when you browse the Site, complete a form, subscribe, correspond with us, request access, begin onboarding, or use an SDM service - From the organization or person you represent, an authorized representative, or another party involved in a transaction or referral - Automatically from your browser or device through cookies, local storage, server logs, analytics tools, and similar technologies - From service providers and business partners that support identity verification, compliance, fraud prevention, communications, analytics, hosting, security, and service delivery - From public records, sanctions lists, regulatory or government sources, and other lawful third-party sources where relevant to due diligence or compliance

We use Personal Data to: - Operate, secure, troubleshoot, and improve the Site and our services - Respond to inquiries, provide requested information, assess service eligibility, and manage business relationships - Process newsletter subscriptions, affiliate applications, access requests, onboarding, and account administration - Verify identity, conduct know-your-client and anti-money-laundering reviews, screen for sanctions and fraud, manage risk, and satisfy legal and regulatory obligations - Execute and administer approved services and transactions under the applicable client agreement - Send operational messages and, where permitted, marketing communications; you may unsubscribe from marketing emails at any time using the link in the message or by contacting us - Measure Site performance and understand how visitors use the Site - Establish, exercise, or defend legal claims and enforce our agreements and policies - Complete a corporate transaction, such as a financing, merger, acquisition, reorganization, or sale of assets Where applicable law requires a legal basis, we process Personal Data with your consent; to take steps at your request or perform a contract; to comply with legal obligations; and for legitimate interests such as operating and securing our business, preventing fraud, communicating with business contacts, and improving our services, provided those interests are not overridden by your rights.

The Site uses cookies and similar technologies for the following purposes: - Essential and access functions: short-lived cookies may remember that you completed a service-specific access notice or entered an authorized access credential - Eligibility preferences: browser local storage remembers the location and investor-type selections you provide so the Site can display relevant service information - Analytics: if configured, Google Analytics uses cookies and related identifiers to measure users, sessions, approximate location, browser and device information, and Site interactions These technologies do not all operate in the same way. Essential access technologies are used to provide requested Site functions. Analytics technologies help us understand and improve Site use. SDM does not use a general website form to collect payment-card information. You can block or delete cookies through your browser settings and can clear local storage through your browser controls. Blocking essential technologies may prevent access-controlled portions of the Site from functioning. Google also provides a browser add-on for opting out of Google Analytics measurement. Browser-based privacy signals, including Global Privacy Control, may communicate additional preferences where recognized by applicable law and supported by the Site.

We may disclose Personal Data only as reasonably necessary for the purposes described in this Policy: - Within the SDM corporate group, including the SDM entity responsible for a requested or approved service - To service providers that support hosting, infrastructure, security, analytics, communications, customer relationship management, email delivery, marketing lists, identity verification, compliance, professional advice, and other business operations - To counterparties, banking partners, liquidity providers, custodians, or other participants where necessary to evaluate, execute, settle, or support a requested service or transaction - To regulators, courts, law enforcement, government authorities, self-regulatory bodies, or other parties when required or permitted by law, regulation, legal process, or to protect rights, safety, and security - In connection with an actual or proposed financing, merger, acquisition, reorganization, sale of assets, or similar corporate transaction, subject to appropriate safeguards - With your direction or consent The Site currently uses Google Analytics for website measurement, Mailchimp for newsletter subscription management, and Mailgun for form-notification email delivery when those services are configured. These providers process information under their own terms and privacy documentation and may process information outside your country. SDM does not disclose Personal Data more broadly simply because you submit a website form.

We retain Personal Data only for as long as reasonably necessary for the purposes described in this Policy, including to provide services, maintain business and transaction records, meet legal and regulatory requirements, resolve disputes, enforce agreements, and protect against fraud and security threats. Retention periods vary based on the type and sensitivity of the information, the relationship and service involved, applicable limitation periods, and legal or regulatory obligations. For example, a general inquiry may be retained for a shorter period than compliance, onboarding, or transaction records. When Personal Data is no longer required, we take reasonable steps to delete, destroy, anonymize, or restrict it, subject to lawful backup and recordkeeping requirements.

SDM and its service providers may process Personal Data in Canada, the United States, and other countries where SDM group entities or service providers operate. Those countries may have privacy laws that differ from the laws where you live, and information may be accessible to courts, law enforcement, or regulators in those jurisdictions. Where required, we use contractual, organizational, and other recognized safeguards for international transfers. The SDM entity identified in the applicable onboarding materials or client agreement may provide additional information about transfers connected with its services.

We use administrative, technical, and physical safeguards designed to protect Personal Data against accidental or unlawful loss, misuse, unauthorized access, disclosure, alteration, or destruction. Safeguards are selected with regard to the nature and sensitivity of the information and may include access controls, encryption in transit, vendor controls, logging, and incident-response procedures. No internet transmission or storage system can be guaranteed to be completely secure. You are responsible for protecting credentials provided to you, using secure devices and communications, and notifying SDM promptly if you suspect unauthorized access.

Depending on where you live and subject to legal exceptions, you may have the right to: - Ask whether we process your Personal Data and request access to it - Request correction of inaccurate or incomplete Personal Data - Request deletion or erasure - Request restriction of processing or object to certain processing - Receive certain Personal Data in a portable format - Withdraw consent where processing is based on consent, without affecting processing already completed - Opt out of or unsubscribe from marketing communications - Opt out of certain sale, sharing, targeted-advertising, or profiling activities if applicable law grants that right - Appeal a decision on a privacy request and lodge a complaint with an applicable privacy or data-protection authority - Receive equal service and not be discriminated against for exercising an applicable privacy right We may need to verify your identity and authority before completing a request. You may use an authorized agent where permitted by law. Some requests may be limited by legal, regulatory, recordkeeping, fraud-prevention, security, contractual, or third-party rights. We will respond within the period required by applicable law.

Canada: Subject to applicable Canadian privacy law, you may request access to Personal Data under our control, ask how it has been used or disclosed, request correction, withdraw consent where applicable, and challenge our compliance. You may also contact the Office of the Privacy Commissioner of Canada or the relevant provincial privacy regulator. European Economic Area, United Kingdom, and Switzerland: Where applicable, you may have rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent, and the right to complain to your local supervisory authority. You may also object to direct marketing at any time. United States: Residents of states with comprehensive privacy laws may have rights to know or access, correct, delete, and obtain a copy of certain Personal Data, and to opt out of certain sales, sharing, targeted advertising, or profiling, subject to the law that applies and its exemptions. SDM will not discriminate against you for exercising an applicable right.

The Site and services are intended for business and institutional audiences and are not directed to children. You must be at least 18 years old, and at least the age of majority where you live, to use the services. We do not knowingly collect Personal Data from children through the Site. If you believe a child has provided Personal Data to us, please contact us so that we can review and, where appropriate, delete it.

We may update this Privacy Policy to reflect changes in our practices, services, technology, or legal obligations. We will post the revised Policy on this page and update the "Last Updated" date. If a change materially affects how we process Personal Data, we will provide any additional notice or request any consent required by applicable law.