RMG SUISSE SA

1. Controller and scope

RMG Suisse SA, rue du Rhône 23, 1204 Geneva, Switzerland ("RMG", "we", "us") is the controller of the personal data processing described in this policy. For any questions, please contact privacy@rmgroup.com.

This policy applies to personal data we process (i) when you visit our website www.rmgroup.com, (ii) when you contact us, and (iii) in connection with our relationships with clients, prospects, counterparties, service providers and their representatives.

2. Data processed

Depending on the circumstances, we process:

• identification and contact data (surname, first name, position, company, address, email, telephone);
• data relating to the business relationship (correspondence, mandates, transaction documents);
• data required under anti-money laundering regulations (identity documents, information on beneficial owners and the source of funds);
• website browsing data (IP address, browser type, pages visited, date and time of visit).

We obtain this data directly from you or, where applicable, from your employer, our clients, our counterparties or publicly available sources (e.g. the commercial register).

3. Purposes

We process your data in order to:

• perform our mandates and manage our business relationship;
• comply with our legal and regulatory obligations;
• respond to your requests;
• ensure the operation and security of our website;
• establish, exercise or defend our rights.

This processing is based on the performance of a contract or pre-contractual measures, compliance with our legal obligations, our legitimate interest in managing and developing our business or, where required, your consent.

4. Cookies

Our website only uses technical cookies necessary for its operation. You can also set your browser to refuse cookies.

5. Recipients

Your data is only accessible to RMG employees who need it. It may be disclosed:

• to our service providers (in particular IT and hosting providers), who process it on our behalf and in accordance with our instructions;
• to third parties involved in the performance of our mandates (lenders, counterparties, legal, tax or technical advisers, notaries);
• to authorities, where required by law.

6. Transfers abroad

Some recipients are located outside Switzerland, mainly in the European Union. Where data is transferred to a country that does not provide an adequate level of protection (e.g. the United States), we rely on appropriate safeguards, such as the standard contractual clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC) or the recipient's certification under the Swiss-U.S. Data Privacy Framework.

7. Retention period

We retain your data for as long as necessary for the purposes described above and thereafter for the periods required by law (generally ten years for accounting and contractual documents and for documents relating to anti-money laundering). Browsing data is retained for a maximum of 12 months.

8. Security

We implement appropriate technical and organisational measures to protect your data against loss, unauthorised access or any other form of unlawful processing.

9. Data subject rights

You may at any time request access to your data, its rectification or erasure, object to its processing or request its delivery in a commonly used format, within the limits provided by law (in particular our statutory retention and confidentiality obligations). Please send your request to privacy@rmgroup.com; we may ask you to provide proof of your identity.

You may also contact the FDPIC (www.edoeb.admin.ch) or, if you reside in the European Union, the data protection authority of your country.

10. Amendments

We may amend this policy at any time. The version published on our website is the version in force.