1. About this Notice

   This Privacy Notice explains how Kane LPI Solutions Limited (DIFC Branch) ("Kane", "we", "us" or "our") processes Personal Data when acting as a Controller under DIFC Data Protection Law No. 5 of 2020, as amended. It applies to individuals who interact with us, including business contacts, clients and prospective clients who are individuals, directors, officers, authorised representatives, ultimate beneficial owners, guarantors, beneficiaries, investors, supplier and service-provider contacts, website users, visitors, and applicants for employment or contractor roles.

   Where Kane processes Personal Data solely on a client’s documented instructions, Kane acts as a Processor and separate terms and conditions ordinarily govern that processing.

   Successful employment applicants will also receive a separate workforce privacy notice for processing arising during employment or engagement.

2. Personal Data We Collect and Where It Comes From

   Depending on your relationship with us, we may process:

   • identity and contact information, including date of birth, nationality, role, employer, address and identification or verification details;
   • professional, business and communication information, including information relevant to services provided by or to Kane;
   • client, investor, transaction and financial information where relevant to our services or legal obligations;
   • compliance and due-diligence information, including beneficial ownership, source-of-funds/source-of-wealth information where required, and sanctions, PEP and adverse-media screening results;
   • website, device, access-control and security information, including IP address, browser/device details and relevant system logs; and
   • other information you provide or that is reasonably required for the purposes described below.

   We obtain Personal Data directly from you and, where relevant, from clients, funds, your employer or representatives, Kane Group companies, public and regulatory sources, corporate registries, sanctions/PEP lists, screening and identity-verification providers, recruitment agencies, referees, former employers, educational or professional bodies, service providers, regulators, courts and public authorities. Where DIFC law requires us to provide information about indirectly collected data, we will do so within the applicable timeframe unless an exemption applies.

3. Job Applicants

   If you apply for employment or a contractor role, we may also process your CV/resume, employment and education history, qualifications, professional memberships, interview notes, assessments, references, recruitment correspondence, remuneration expectations, availability, right-to-work/immigration information, and information needed to consider reasonable workplace adjustments.

   All DIFC employment applicants may be subject to proportionate pre-employment screening because Kane considers screening appropriate for the roles currently undertaken within its regulated business. Screening may include sanctions/PEP, adverse-media, identity, qualification, employment-history and, where relevant and lawful, criminal-record or criminal-risk information. Screening is performed through appropriate third-party screening and verification providers and is reviewed by authorised personnel. Kane does not make hiring or engagement decisions that produce legal or similarly significant effects solely by automated processing. The scope and necessity of screening are reviewed periodically.

   Screening may return Special Category Personal Data, including criminal-record information. That section explains how we handle such information and the conditions we rely on.

4. Special Category Personal Data

   Some of the information we may process falls within the definition of Special Category Personal Data under the DIFC Data Protection Law. This arises in two distinct contexts, described below. We do not rely on your consent in either context.

   Client, investor and counterparty due diligence. Sanctions, politically exposed person (PEP) and adverse-media screening of clients, prospective clients, investors, directors, officers, authorised representatives, ultimate beneficial owners, guarantors and beneficiaries may reveal information concerning political affiliations or opinions, and may return information relating to criminal convictions, offences or alleged offences. We process this information because it is necessary for compliance with the anti-money laundering, counter-terrorist financing, sanctions and financial crime obligations that apply to us as a DFSA Authorised Firm, and, where relevant, for the establishment, exercise or defence of legal claims.

   Recruitment and pre-employment screening. Criminal-record information obtained through pre-employment screening is Special Category Personal Data. We process it because it is necessary for compliance with the regulatory obligations that apply to us, including our obligation to assess and maintain the fitness and propriety of personnel performing controlled functions, and for carrying out obligations in the field of employment so far as authorised by applicable law. We do not rely on consent in this context.

   In both contexts we limit what we request to the information necessary for the purpose; we restrict access to authorised personnel; results are reviewed by a person and are not determined by automated means alone; and detailed source material is minimised and deleted once the purpose has been met. Where a result is potentially adverse, we will ordinarily give you an opportunity to correct inaccurate information and to provide relevant context before we take a decision that affects you, unless a legal or regulatory restriction prevents us from doing so.

5. Why We Use Personal Data

   We process Personal Data only where permitted by DIFC law. The principal purposes and lawful bases are:

   Purpose	Principal lawful basis
   Providing services and managing client, supplier and professional relationships	Contract / pre-contract steps where applicable; legitimate interests in operating and administering our business.
   Fund administration and related regulated activities	Legitimate interests in operating our regulated business; applicable legal and regulatory obligations. Where Kane acts solely as Processor, the Controller is obliged to determines the lawful basis.
   AML, CTF, sanctions, PEP and other due diligence	Applicable DFSA/UAE legal and regulatory obligations; legitimate interests in preventing financial crime where applicable. See the Section titled Special Category Personal Data.
   Recruitment and pre-employment screening	Pre-contract steps; legitimate interests in recruiting suitable personnel and protecting a regulated business; applicable employment, immigration and regulatory obligations. See the Section titled Special Category Personal Data.
   Security, fraud prevention, business continuity and access control	Legitimate interests in protecting people, information, systems, premises and operations; applicable legal/regulatory obligations.
   Accounting, tax, audit, corporate administration, legal claims and regulatory matters	Legal/regulatory obligations; legitimate interests in governance, audit, recordkeeping and establishing, exercising or defending legal claims.
   Business development and direct marketing	Legitimate interests and consent where required. You may object to direct marketing at any time.
   Responding to enquiries, complaints and privacy-rights requests	Legal obligations and legitimate interests in responding to and documenting requests and disputes.

   Where we rely on legitimate interests, we consider whether those interests are overridden by your rights and interests. We do not rely on consent where another lawful basis is more appropriate merely because consent is available.

6. Sharing and International Transfers

   Where necessary for the purposes above, we may share Personal Data with Kane Group companies; clients, funds and financial institutions; screening, identity-verification and information-service providers; IT, cloud, security and communications providers; recruitment agencies and referees; professional advisers, auditors and insurers; and regulators, courts, tax authorities, law-enforcement bodies or other public authorities. We may also share information in connection with a corporate transaction, subject to appropriate safeguards.

   Kane operates internationally. Relevant Personal Data may therefore be transferred outside the DIFC. Kane’s principal systems used to maintain relevant information are hosted in Ireland and Germany. Other service providers may process or access data from additional locations. Transfers are made only where permitted by DIFC law, including through DIFC adequacy decisions, DIFC Standard Contractual Clauses or another permitted safeguard. Contact privacy@kanesolutions.com for information about safeguards used for a relevant transfer, subject to lawful confidentiality restrictions.

7. Retention

   We retain Personal Data only for as long as reasonably necessary for the purpose for which it was collected and to satisfy applicable legal, regulatory, tax, accounting, audit, contractual and claims requirements. We consider the nature and sensitivity of the information, statutory or regulatory minimum periods, limitation periods and any actual or anticipated dispute, investigation or legal hold. Recruitment and screening information for unsuccessful applicants is retained in accordance with our applicable retention schedule and detailed screening material is minimised and deleted when no longer necessary.

8. Marketing and Automated Decision-Making

   We may send relevant business-to-business marketing communications where permitted by law. You may object or opt out at any time. Kane does not make decisions about individuals that produce legal or similarly significant effects solely by automated processing. If this changes materially, we will assess the applicable DIFC requirements and update this Notice where appropriate.

9. Your Rights

   Subject to the DIFC Data Protection Law and applicable exemptions, you may have rights to access and correct your Personal Data; request erasure or restriction; object to processing (including an absolute right to object to direct marketing); receive certain data in portable form; withdraw consent where consent is the lawful basis; and complain to the DIFC Commissioner of Data Protection. To exercise your rights, contact privacy@kanesolutions.com. We may need to verify your identity, and some rights may be limited where retention or processing is required by law or for legal claims.

   Information about complaints to the DIFC Commissioner of Data Protection is available through the official DIFC website.

10. Is Providing Personal Data Mandatory?

    You are not generally required to provide Personal Data to Kane. However, depending on context, some information is required by law or regulation, is necessary to enter into or perform a contract, or is required for us to provide services, complete compliance checks, consider an application or verify right to work. If necessary information is not provided, we may be unable to proceed with the relevant relationship, service or application.

11. Premises and CCTV

    Kane does not itself operate CCTV in common areas of its leased premises. The building owner or facilities operator may do so under its own privacy arrangements. If Kane separately controls or accesses CCTV for its own purposes, that processing will be assessed and notified as required.

12. Controller and Contact Details

    Controller: Kane LPI Solutions Limited (DIFC Branch), DIFC, The Gate Village 1, 2nd Floor, Unit 8, Dubai International Financial Centre, Dubai, United Arab Emirates, P.O. Box 506732. Tel: +971 4 434 3642.

    Data Protection Officer: Chris Gorski.

    Privacy contact: privacy@kanesolutions.com

13. Changes to this Notice

    We may update this Notice from time to time. Material changes will be communicated where appropriate, and the current version will be made available through our usual privacy channels or website.

V2.0 Last Updated: August 2026