The Company is committed to protecting and respecting your privacy. We believe that transparency and honesty about what we do with your personal data is crucial for maintaining strong relationships with our clients. We would like to inform you through this privacy statement about how we process and use your personal data.

More information on these processing activities can be found below.

You can print this Privacy Statement by selecting “Print” from your browser’s menu commands or by right-clicking on this page and selecting “Print” from the pop-up menu.

The Company, having its registered office in the State of Delaware, US, is the controller or co-controller of all personal data that fall within the scope of this Privacy Statement.

If you have any questions about this statement, please contact our Data Protection Office:

Email US Data Protection Officer

More information on your rights as a data subject are contained below under ‘Your Rights’.

The most common processing activity we conduct which involve the collecting and processing of personal data include:

• Conducting checks and assessments prior to doing business
• The administration of the service we have agreed to provide.
• Servicing our customers and prospective customers.
• To develop our products and services
• Managing third party and supplier relationships.
• Internal management reporting and support functions
• Managing relationships with governments and supervisory authorities
• Marketing to our customers and prospects
• Cookies

More information on these processing activities is contained below.

You or someone representing you, for example a financial advisor, consultant, an employer, or the business you work for, may give us information about you by completing forms (paper versions or through a website), concluding contractual arrangements or by contacting us by phone, mail, email or otherwise. We may also receive your personal information from a third party where they have obtained your consent or have to share such information.

For the processing activities described below, the personal data that is gathered and processed may include:

• Full name
• Title
• Job description
• Address including zip code
• Phone number
• E-mail address (personal and/or business)
• Website username and password
• IP address
• Date of birth
• Gender
• Driver’s License number
• Passport number
• Loan number or account number or other identifier, whether for internal or external use
• Bank account
• Taxpayer identification number
• Cookie information collected when you visit one of our websites. Further information is available in our Cookie Statement.

Where sensitive personal data is collected and processed as part of any of the activities below, this will be stated in the relevant processing descriptions. Sensitive personal data processed may include the following:

• Copy of identification document (i.e. driver’s license, passport or ID card)
• Social security number

When collecting and processing personal data, we will only process the minimum amount of personal data relevant to the specific purpose it is collected for. We will only use the data for the original purpose for which it was collected (stated below) or a further purpose which you have consented to or that is compatible with the original purpose for which it was collected and that is likely to be in line with your expectations regarding the processing of that data.

If certain elements of personal data are not provided, then we may not be able to conduct all relevant processing required (including meeting regulatory requirements) and as such not be able to provide the full range of products and services.

Conducting checks and assessments prior to doing business. This will include Anti-Money Laundering checks as well as screening personal data against known sanctions and politically exposed persons (‘PEP’) lists. This processing is conducted in order to detect and prevent fraudulent behavior. It is also necessary in order for us to meet our legal obligations as a company. We conduct the screening check automatically using a third party system provided by FinScan which compares personal data against a number of official sanctions lists. For lending activities, your personal data may also be checked with a credit rating company as part of the loan approval process. The results of these checks will be considered by a member of our staff in determining whether to proceed with conducting business/providing a service or not.

This processing may require the collecting and sharing of (sensitive) personal data, including copies of identification documents, with our affiliates and appointed suppliers. Data may also need to be shared with supervisory and governmental authorities in certain circumstances.

The administration of the service we have agreed to provide. This includes processing your instructions and account transactions, settling those transactions, assessing investments, managing investment portfolios, monitoring investment portfolios and managing risks associated with an account or product, including areas of regulatory compliance. This processing is imperative to us providing the requested service and executing the agreement between us.

Servicing our customers and prospective customers. This includes managing existing and prospective customer relationships, handling queries and complaints, managing any incidents/issues encountered, providing account reporting, detecting fraud and providing online services including our websites. This processing is required in order for us to provide the service agreed under our agreement and ensure the integrity of any account you have with us. Customer relationships may be maintained by phone, mail, e-mail personal contact and fax where appropriate (see the section below titled 'Being in contact with us').

In order to develop our products and services. This includes reviewing our existing offering of products and services, making required improvements and launching new products/services. Personal data may also be processed when we develop our appropriate business strategies internally. Where these processes include personal information they are conducted in the legitimate interest of the Company to ensure we provide the best products and services for our customers. We are committed to ensuring that the impact to the data subjects involved is minimal, the approach adopted is reasonable and we will ensure that the least intrusive approach is followed. The data may be shared with our affiliates. More information can be found in the section titled 'Sharing your personal data’.

Managing third party and supplier relationships. Personal data may be processed to assess and obtain services provided by a third party company, to manage the relationship between the companies (including where they act as our data processor) and reporting and performance analysis on these relationships. These processes may also require sharing personal information with our affiliates as well as consulting publicly available records. These processes are conducted to ensure appropriate execution of the agreement between the parties and between us and our clients, as well as being in the legitimate interests of the Company to be able to utilize third party services when providing its products and services to clients in the best way possible.

Where appropriate, these processes may include the use of any sensitive data provided on copies of identification documents.

More information can be found in the section titled 'Sharing your personal data’.

Internal management reporting and support functions. This includes the provision of legal and regulatory support and advice (both internal and external), internal auditing, strategy development and providing and maintaining IT solutions. It also includes processing required to effectively manage data including scanning, classification and labelling. Most of these processes are conducted in order to execute activities vital to the internal management of our business and are imperative to the performance of our agreements with clients, customers and suppliers, however some will be conducted in order to meet our legitimate interests as a company. Where this is the case, we are committed to ensuring that the impact to the data subjects involved is minimal, the approach adopted is reasonable and that the least intrusive approach is followed. Other processes may be conducted in order to fulfill a legal or regulatory obligation. Personal data may be shared with our affiliates, including our affiliate Aegon Global Technology Services, which acts as a data processor of personal data handled or processed when providing IT and technology solutions to us. Personal data may also be shared with third parties including external law firms, accountants and auditors.

More information can be found in the section titled 'Sharing your personal data’.

Managing relationships with governments and supervisory authorities. This includes responding to requests and providing regular and ad hoc reporting. These processes are conducted in order to fulfill legal and regulatory obligations of the company. Where personal data, including sensitive personal data, needs to be processed in order to fulfill these obligations, it will be in line with this privacy statement, including when processing involves third parties and our affiliates.

More information can be found in the section titled 'Sharing your personal data’.

Marketing to our customers and prospects. This includes the execution and analysis of marketing campaigns, surveys and strategies, promoting products and services provided by the Company and our affiliates, running and contributing to promotional events, and the use of ad hoc competitions and promotions.

We may use the personal data we have to send you marketing information and news about our products and services that may be of interest to you, unless you have opted out of marketing.

We may conduct marketing with our customers (business partners) based on our legitimate interest to share product and service information with them in order for them to take it into account when providing a related service. When doing this, we will ensure that the least intrusive method is used and that we feel the recipient would reasonably expect to receive marketing of this type. Business partners will be able to opt out of marketing from us at any point and this will be respected.

Marketing communications will be conducted using various channels such as mail, phone and email.

Please remember that you can withdraw your consent or request to opt-out of marketing communications at any time by contacting us (see section 'Your Rights'). The withdrawal of consent, or your objection to the specific processing of personal data, including for the purposes of marketing, does not affect the processing conducted before the withdrawal. It will also not affect the provision of other products and services unrelated to the process for which you have withdrawn consent.

We may conduct marketing related analytics which includes the processing of personal data based on our legitimate interest to ensure we provide customers with appropriate marketing information that is relevant to them. When doing this, we will ensure that aggregated information is used where possible and where personal data is processed the least intrusive method is used and that we feel the recipient would reasonably expect this type of processing. Data subjects may object to this at any time by contacting us. This analytics may include additional (personal) information obtained from third parties where we consider the use of this data fair and legal.

Cookies. We also collect information through the use of cookies. Cookies are small files which save and retrieve information about your visit to this website – for example, how you entered our site, how you navigated through the site, and what information was of interest of you.

Read more about how we use cookies in our Cookie Statement.

All emails or electronic communications sent to or from any member of our staff will be retained and may be monitored to complete the respective processing activities or achieve the processing purposes stated in this statement. Only the appropriate staff members are authorized to monitor or review email or message content in line with their job role.

Some internet browsers enable you to send a request to websites to not to collect your internet browsing data or track your internet browsing activities. Our website does not currently recognize or respond to “do not track” signals.

Sharing your personal data among affiliates within the Equitable Group and AEGON Group
The Company is a joint venture of Equitable Financial Life Insurance Company and AEGON USA Realty Advisors, LLC, which are members of the Equitable Group and AEGON Group, respectively. As such, the Company’s affiliates include members of the Equitable Group and the AEGON Group, both of which are global organizations. As a global organization, personal data we collect may be transferred internationally throughout the worldwide organizations of the Equitable Group and the AEGON Group. For the Equitable Group, this may include transfers to Equitable Financial Life Insurance Company, and for the AEGON Group, this may include transfers to AEGON USA Realty Advisors, LLC, AEGON USA Realty Advisors of California, Inc., and AEGON USA Investment Management, LLC.

We share your data for the purposes described in this Privacy Statement and to have a complete overview of our contacts and contracts within the Equitable Group and the AEGON Group. We may also share your data in order to offer you a complete package of services and products. This will be handled in line with the description above on how we provide marketing to customers and prospects. Sharing of data within the Equitable Group and the AEGON Group will be conducted in line with applicable regulatory requirements, including appropriate technical and organizational measures.

Company personnel are authorized to access personal data only to the extent necessary to serve the applicable purpose and to perform their job.

Disclosing your personal data to third parties
We work with carefully selected providers that carry out certain functions on our behalf and cooperate with relevant authorities. The following types of third parties have or could be granted access to your personal data where relevant for the processing described above.

• Governments
• Supervisory authorities
• Administrative bodies
• Banks
• Affiliated and unaffiliated technology suppliers – including Aegon Global Technology, Microsoft, Amazon Web Services, Snowflake, and OneTrust
• Accountants
• Auditors
• Consultants
• Advisors
• Third party service providers
• External legal counsel
• Judicial bodies
• Lenders for whom we orginate and service loans

When third parties are given access to your personal data, we will implement such contractual, technical and organizational measures as may be legally required to ensure that your personal data is only processed to the extent that such processing is necessary. Unless we tell you otherwise, we will strive to ensure that the third parties to whom we provide your personal data for processing purposes as described above will only process your personal data in accordance with our instructions and applicable law.

In other cases, your personal data will not be supplied to third parties, except:

• With your consent at the time the data is collected;
• to the extent that we are required to do so by law, by a government body or by a law enforcement agency, or for crime prevention purposes (including financial crime protection and credit risk reduction);
• when protecting your interests or the interests of other individuals or for reasons of substantial public interest;
• in connection with any legal proceedings (including prospective legal proceedings);
• in order to establish or defend our legal rights;
• in the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets and for the purposes of effecting any sale or purchase; or
• if we, or substantially all of our assets, are acquired by a third party, we may disclose your personal data to that third party in connection with the acquisition.

The use of your personal data by data processors
When a third party processes your personal data solely following our instructions, it acts as a data processor. We routinely seek to enter into agreements with such data processors concerning the processing of personal data to help ensure that your personal data is used by the data processor to provide specific services to us and the data is afforded a sufficient level of protection.

We will keep your personal data following the conclusion of our relationship and/or the processes mentioned above. This is to ensure that we comply with our record retention obligations, as set out in our internal record retention policy and determined by the appropriate supervisory and governmental authorities (including financial regulators) or other regulatory and legislative requirements. Any personal data retained after the conclusion of the relationship will be kept confidential and we will not use the information for any purpose other than to meet our legal obligations.

The Company has implemented appropriate functional, technical, physical and organizational measures designed to protect the personal data that we have under our control from:

• unauthorized access and alteration;
• Improper disclosure; and
• Accidental or unlawful destruction or accidental loss.

All our employees and service providers who have access to personal information are obliged to protect it and keep it confidential.

Of course, no network or system (including the internet) is entirely secure, and despite the measures described above, we cannot guarantee the security of networks and systems we operate or use, or that are operated on our behalf (including the security of email or other transmissions of data).

You have a number of rights with respect to personal data about you that we collect and process, including:

• the right to request a copy of the personal data we hold on you. (Example; when you request this information, this is known as making a Subject Access Request (SAR). In most cases, this will be free of charge, however in some limited circumstances, for example, repeated requests for further copies, we may apply an administration fee);
• the right to have any inaccurate personal data corrected;
• the right to have any out of date personal data deleted once there is no business need or legal requirement for us to hold it;
• the right to object or restrict some processing, in limited circumstances and only when we do not have legitimate grounds for processing your personal data;
• the right to object to your personal data being used to send you marketing material;
• the right to have personal data we hold about you transferred to another service provider in electronic form in certain scenarios; and
• the right to ask for a decision to be made manually, where a decision is made using automated means and this adversely impacts you.

To exercise any of these rights, please contact our Data Protection Office as described in the “Contract us” section above.

While we will strive to honor requests you may make to exercise your rights, in considering each request we must take into account other conflicting obligations we may have as well as the rights of other data subjects. As a result, there is a chance that your request may be only partially fulfilled or in limited circumstances rejected. If this is the case an explanation will be provided to you.

If you wish to exercise your rights in relation to the processing of your personal data conducted by one of our processors or associated co-controllers then please contact us in the first instance.

If you are a California resident, please refer to our California Consumer Privacy Act Disclosure & Statement of Rights for more information about your privacy rights and our privacy practices.

Through this website, we do not purposefully market any products or services to, or knowingly gather or solicit data from, children under thirteen (13) years of age. By using this website you represent that you are not under thirteen (13) years of age. If you are under the age of thirteen (13), please do not transmit to us any of your personal data.

If you believe we have not processed your personal data in accordance with our data protection obligations, and that you have been affected by our non-compliance, you can make a complaint to us by contacting our Data Protection Office as described in the “Contract us” section above.

From time to time we may make changes to this privacy statement. If we make any substantial changes to this privacy statement and the way in which we use your personal data we will post these changes on this page and will do our best to notify you of any significant changes.