Privacy notice on personal data processing

In case you or third party are/is providing your personal data, we as a data controller or data processor:

IAD Investments Real Estate Investment Fund (with the previous business name HB Reavis Real Estate Investment Fund), with the registered seat at 1B rue Jean Piret, L-2350 Luxembourg, Grant Duchy of Luxembourg ID: B161180, represented by the company IAD Investment Management S.à r.l. with the registered seat at 1B rue Jean Piret, L-2350 Luxembourg, ID: B161180

IAD Investments Management S.à r.l. (with the previous business name HB Reavis Investment Management S.à r.l.), with the registered seat at 1B rue Jean Piret, L-2350 Luxembourg, Grand Duchy of Luxembourg ID: B161176

(hereinafter „IAD IM“ or „we“) would like to inform you about the processing of your personal data and we also inform you of your rights related to the above processing, in accordance with the EU Regulation No. 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, (General Data Protection Regulation) (GDPR).
We take the privacy and security of your personal information very seriously and will only use your personal information as set out in this Privacy Notice or as we may otherwise inform you from time to time.

Depending on the nature of our relationship with you, we will collect various types of personal information about you which may include some or all the following purposes:

Conclusion of contract
Performance of customer due diligence
Reporting obligation
Contact persons
Evidence of incoming and outgoing mails
Mutual communication
Processing of marketing cookies and statistical cookies
GDPR related complaints

More specific description of the particular purposes:

1. Conclusion of contract

Description of our purpose for the processing of your personal data:
Personal data provided by you will be used for the purpose of ensuring the negotiation and conclusion of the contract, including our pre-contractual relationships, as well as financial intermediation.

What is our legal basis for the processing of your personal data?
The legal base for processing of your personal data in connection with the conclusion of contract is the performance of a contract (i.e., the personal data is provided as part of pre-contractual relations leading to conclusion a contract) under Article 6 (1) (b) of GDPR. In case of failure to provide us with the personal data, we cannot enter a contract with you.

What kind of personal data do we process?
Name, surname, e-mail, date of birth, birth registration number, residential address, citizenship, identification document (such as passport, driving license, utility bill and bank statement), function, signature, financial information (such as taxes, wealth, source of finances etc.)

For how long we will process your data?
IAD IM is obliged to store your personal data for at least 10 years after the termination of the contractual relationship with you.

2. Performance of customer due diligence

Description of our purpose for the processing of your personal data:
The personal data provided by you will be used for the purpose of performance of customer due diligence (CDD), procedures are required to comply with regulation, especially in Anti-money laundering and counter-terrorism financing (AML-CTF), including for example your identification and/or verifying your identity and other data required by law.

What is our legal basis for the processing of your personal data?
Your personal data are processed under Article 6 (1) (c) of GDPR, i.e. the processing of your personal is required to comply with our legal obligation under the law.

What kind of personal data do we process?
Name, surname, date of birth, place of birth, birth registration number, residential address, citizenship, identification document or proof of identity (such as passport, driver’s license, utility bill, bank statement etc.) and personal data contained therein, function, signature, financial information (such as tax information, source of wealth, source of funds etc.) and information related to the ultimate beneficial owner.

For how long we will process your data?
IAD IM is obliged to store your personal data at least 10 years after the termination of the contractual relationship with you or after the completion of the transaction.

3. Reporting obligation of IAD IM

Description of our purpose for the processing of your personal data:
The personal data provided by you will be used for the purpose of provision of obligatory or required Information and reports to competent public authority.

What is our legal basis and legitimate interest for the processing of your personal data?
Legal basis for processing of your personal data in connection with reporting obligation to public authorities is legal obligation under Article 6 (1) (c) of GDPR.

What kind of personal data do we process?
Name, surname, e-mail, date of birth, birth registration number, residential address, citizenship, financial information, and other information required by law.

For how long we will process your data?
IAD IM is obliged to store your personal data 10 years after the termination of the contractual relationship with you.

4. Contact persons

Description of our purpose for the processing of your personal data:
We process your personal data to ensure that our contractual obligations arising from the contract with you or a third party, of which you are in the position of a contact person or a signatory on behalf of the contractual party, are effectively fulfilled and to be compliant with legal obligations under the applicable law. Since we concluded the contract with your or the third party, we need to process your personal data to ensure effective, flawless, and clear communication as well as to ensure fulfilment of our contractual obligations and legal obligations (tax and accounting) towards you or the third party. This processing also applies to other legal acts than contracts as for example power of attorney.

What is our legal basis and legitimate interest for the processing of your personal data?
We process your personal data based on legitimate interests under Article 6 (1) (f) of GDPR. When we handle the tax and accounting matters, we process your personal data based on a legal obligation under Article 6 (1) (c) of GDPR. If you or the third party fail to provide us with your personal data, we cannot fulfill our legal obligations.

What kind of personal data do we process?
Title, name, surname, position, department, personal and employee number, business department, place of work, signature, e-mail, phone and fax number and identification information of your employer (incl. identification information of the entity on which behalf you act).

For how long we will process your data?
Once we no longer need your personal data for the purposes for which we processed it, we will delete your personal data or archive it for the period of time specified by law, which can be up to 10 years after the termination of the contractual relationship with you.

5. Recording of incoming and outgoing mail:

Description of our purpose for the processing of your personal data:
We process your personal data for the purpose of incoming and outgoing mail records.

What is our legal basis and legitimate interest for the processing of your personal data?
We process your personal data based on legitimate interests under Article 6 (1) (f) of GDPR.

What kind of personal data do we process?
Name, surname, address, telephone number and e-mail.

6. Mutual communication

Description of our purpose for and legitimate interest in processing your personal data:
Our philosophy is to always be open and transparent. This includes being open to communication from any person interested in us. To ensure efficient, flawless, and clear communication, we must process some of your personal data. Moreover, when selling the shares in our real estate fund to our clients we strive to maintain very effective and transparent communication canal. To fulfil this purpose, we use our records of contact data (including personal data) of our (potential) clients or their employees. We use these records to ensure effective and flawless communication with our (potential) clients and our business partners.

What is our legal basis and legitimate interest for the processing of your personal data?
If you contact us via email or a web-based form, we process your personal data
based on the legitimate interests under Article 6 (1) (f) of GDPR.

What kind of personal data do we process?
Name, surname, email address and phone number. For the purposes of our contact records, in addition to the aforementioned data, we also process job title and employer identification data.

For how long we will process your data?
We keep your personal data until you express your interest in having your contact deleted from our records.

7. Processing of marketing cookies and statistical cookies

Description of our purpose for the processing of your personal data: Processing marketing and statistical cookies for the purpose of improving the quality of services and information provided to our clients or potential clients.

What is our legal basis and legitimate interest for the processing of your personal data?
If you access our website, we process your personal data on the basis of your consent in accordance with Article 6 (1) (a) of GDPR and on the basis of legitimate interests under Article 6 (1) (f) of GDPR in case of personal data necessary for the functioning of the website.

What kind of personal data do we process?
Data stored in the so-called cookie files, where in particular files that serve to secure and identify the connection between us and your computer during one of its visits (for example, information about whether it is a mobile device or a computer and also various identifiers that are used for a secure connection). These files are also used, for example, to identify the language used, or to pre-fill the form, or they also serve to provide more relevant content and personalized communication with the user.

How long do we store your personal data?
We process your personal data only for the necessary time, more information about cookies and the storage time of personal data associated with cookies are provided in the document entitled Information about cookies available on the IAD IM website at the link https://iadim.fund/cookies.

8. GDPR related complaints

Description of our purpose for the processing of your personal data:
We strive to protect your privacy as much as possible, and therefore we process your personal data in compliance with GDPR and all other relevant laws. However, if you disagree with the way we handle your personal data, you can exercise your rights with us at the below contact details. To ensure that your complaint / input is handled, some of your personal data has to be processed.

What is our legal basis for the processing of your personal data?
Your personal data is processed while handling your complaint in accordance with Article 6 (1) (c) GDPR, i.e., the processing is necessary for compliance with a legal obligation to which we are subject.

What kind of personal data do we process?
Personal data provided by you when submitting the complaint (such as name, surname, email, phone number, etc.).

How long do we store your personal data?
We store your personal data strictly during the time necessary to deal with the complaint.

General data processing and data retention statement.
As long as we no longer require your personal data for the purposes, we were processing them for, we will erase your personal data or archive them for the period specified by the law.

With whom do we share your personal data?
We may share your data with other companies belonging to group of related companies via ownership of control, which IAD IM is a part of. We may be obliged to provide your personal information to regulatory authorities (Luxembourg financial regulator Commission de Surveillance du Secteur Financier, or other financial regulators), public authorities, courts, law enforcement agencies (such as the police, prosecutors, etc.) only to the extent necessary and within the limits of the law when these are exercising their legal authority.

Based on the various agreements with third parties acting as our processors or separate controllers with respect to the personal data processing, we provide your personal data to the following companies in the extent necessary to provide the services specified below by the particular companies:

GEN II MANAGEMENT COMPANY (LUXEMBOURG) S.a.r.l., 33, avenue J-F Kennedy L-1855 Luxembourg, Grand Duchy of Luxembourg, ID: B159082, as separate controller during provision of the following services: Alternative Investment Fund Manager and Distributor. As processor while providing administration and other services.
CF Fund Services S.A., with the registered seat: 1b, rue Jean Piret L-2350 Luxembourg, Grand Duchy of Luxembourg, ID: B143316, having its registered seat at: 1b, rue Jean Piret L-2350 Luxembourg,
ID No.: B143316, as separate controller during provision of the following services: Central
Administrator, Registrar and Transfer Agent and Listing Agent.
Distributors of the IAD Investments Fund shares such as financial intermediaries, banks and brokers, management companies as well as other entities that carry out the distribution of fund shares in accordance with applicable laws on a contractual basis.

From whom did we receive the personal data?
We receive the personal data from you, the person on whose behalf you communicate with us or a third party we or you have entered into a contract with.

Do we use automated individual decision-making?
No, we do not use automated individual decision-making.

Do we transfer your personal data to third countries?
Your personal data are processed within the territory of the European Union. Your personal data can be processed by a country outside of European Union if this third country has been confirmed by the European Commission as a country with adequate level of data protection or if other appropriate data protection safeguards exist (for example, binding corporate privacy rules or EU standard data protection clauses).

What are your rights?
Your rights as a data subject are stated below. Please note that the exact conditions to exercise these rights are set out in detail in Chapter III of GDPR, while in a particular circumstance not all rights may be exercised.

You have the following rights:

Access to personal data we process about you, purpose of personal data processing, category of processed personal data, the identification of the recipient or the category of recipient to whom the personal data have been or are to be provided, in particular the recipient in a third country or an international organization, if possible or applicable
The right to information about the time period of processing of personal data
Rectification of incorrect or inaccurate personal data and add incomplete personal data
Restriction, i.e. blocking of processing of your personal data
The deletion of personal data in case the purpose absence or unauthorized data processing
Submission of an objection to the processing of personal data if you believe that our data processing is not justified
Be excluded from automated decision-making
The right to obtain information about the source of personal data, if the personal data was not obtained from you as the data subject
Listing of personal data in a structured and machine-readable format or for another controller
Revocation of consent to the processing of personal data
To lodge a complaint with the supervisory authority

Confirmation of whether IAD IM processes the personal data of the person concerned and the personal data of the person concerned persons processed by IAD IM will be provided by IAD IM to the person concerned upon request.

How can you exercise your rights?
electronically: info@iadim.fund
in writing at the following address: IAD Investments Management S.à r.l. 1b, rue Jean Piret, L-2350 Luxembourg, Grand Duchy of Luxembourg, FAO: / compliance officer

We strive to protect your privacy as much as possible and therefore we process your personal data in compliance with GDPR and all other relevant laws. However, if you disagree with the way we handle your personal data, you can exercise your rights at above contact details.

Or you can file a complaint in supervising authority regarding the processing of your personal data by the HB Reavis. Your local supervisory authority may be found at https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm

The Luxembourg supervisory authority, which is the National Commission for the Protection of Personal Data ( Commission nationale pour la protection des données) can be found here https://cnpd.public.lu/en/commission-nationale.html

Supervisory authority in Slovakia is the Slovak Personal Data Protection Authority, you can find here: https://dataprotection.gov.sk/sk/

26.07.2024