Privacy Notice

RJI CAPITAL CORPORATION PRIVACY NOTICE

Last updated: December 2023

This privacy notice sets out how RJI Capital Corporation process your personal data as controllers.

Personal data is information about individuals or information from which individuals can be identified (personal data).

A controller is an entity that makes decisions about how your personal data is handled and which is responsible for how your personal data is handled, under data protection law.

RJI Capital Corporation is registered in the U.S. with its office at 8350 Broad St. 3^rd Floor, Suite 330, McLean, VA 22102 United States.

How do we collect personal data?

We collect personal data about you in the following circumstances:

• when a client has engaged us to collect information about you;
• when a client has engaged us to collect information about another party and you are relevant to the investigation or information that is being collected as part of an investigation;
• if you work for one of our clients or are a direct client of RJI Capital Corporation, we will collect personal data about you as part of our engagement to provide services or any processes carried out prior to or after our engagement;
• if you are a business partner or work for one of our service providers or any third party we have a relationship with;
• directly from you when contact us via phone, email or speak to us in person including to enquire into our services; and
• when you use this website, for example, when you log in to your account. For more information on the processing of your data through the use of cookies when you use our website please see our .

We will also collect personal data about you directly from you, for example, when you contact us with an enquiry or as part of our relationship with you if you are a direct client of RJI Capital Corporation.

We might collect personal data about you from third party sources, including service providers and other third parties we have a relationship with, from social media and other online platforms, information and data providers, from online and paper publications and from other publicly available records, including official records.

We might also generate personal data about you, for example, we might generate reports or comments relating to you as part of an investigation.

What personal data do we collect?

 The personal data we collect about you might include the following:

• personal and business contact details;
• employment information including position and work experience;
• date of birth, country of residence and languages spoken;
• information relating to your marital status, family members, friends and dependants;
• information relating to your employees, business partners and colleagues;
• information, images and audio appearing in photographs and videos, including data shown in CCTV footage;
• citizenship information and copies of ID documents, including passports;
• comments and opinions expressed about you including in information we might generate about you;
• information relating to proceedings or other investigations you are the subject of or are otherwise relevant to;
• comments you made and opinions you expressed;
• vehicle registration information;
• payment details;
• if you have an RJI Capital Corporation account, your account log in details;
• if you are a client, travel itinerary information and other information relating to your travel plans and schedules;
• information on your whereabouts;
• information relating to communications you took part in, or you were mentioned in; and
• any other data that might be relevant to an investigation conducted by us.

Some information we might process about you might be special category data. This is information that merits special protection under data protection law and includes information revealing racial or ethnic origin, political opinion, religious or philosophical beliefs, trade union membership, as well as information relating to your health, sex life and sexual orientation.

We might also process criminal offence data about you. This includes a range of information including information on unproved allegations, information relating to the absence or existence of convictions, personal data about penalties, conditions or restrictions placed on you as part of a criminal justice process, civil measures which may lead to a criminal activity if not adhered to as well as information on criminal activity, allegations, investigations and proceedings.

How do we use your personal data?

When we process your personal data, we rely on one of the following lawful bases:

• entering into and performing a contract with you;
• the legitimate interests of RJI Capital Corporation or a third party;
• your consent;
• a legal obligation that RJI Capital Corporation is subject to; or
• your vital interests or those of another person.

The following is a list of the purposes for which we process your personal data, and the lawful bases on which we carry out such processing:

When we process special category personal data, we rely on one of the lawful bases set out in the table above and one of the following lawful bases:

• you have made the data manifestly public;
• we have your explicit consent;
• the processing is necessary in order to establish, exercise or defend legal claims (or potential legal claims) or to obtain legal advice;
• the processing is necessary for reasons of substantial public interest, for example, preventing or detecting unlawful acts, safeguarding the economic well-being of certain individuals, safeguarding of children and individuals at risk, protecting the public against dishonesty, and for journalistic purposes in connection with unlawful acts and dishonesty; or
• the processing is necessary to protect your vital interests or the vital interests of another person when you or another individual is physically or legally incapable of giving consent.

When we process criminal offence data, we rely on one of the lawful bases set out in the table above and one of the following conditions:

• you have made the data manifestly public;
• we have your consent;
• the processing is necessary in order to establish, exercise or defend legal claims (or potential legal claims) or to obtain legal advice;
• the processing is carried out for reasons of substantial public interest, for example, preventing or detecting unlawful acts, safeguarding the economic well-being of certain individuals, safeguarding of children and individuals at risk, protecting the public against dishonesty and, for journalistic purposes in connection with unlawful acts and dishonesty; or
• the processing is necessary to protect your vital interests or the vital interests of another person when you or another individual is physically or legally incapable of giving consent.

Future processing

We may also process your personal data for additional purposes in the future: (a) to comply with a legal obligation we are under; (b) with your consent; or (c) if we believe that the same lawful basis applies and the new purposes are compatible with the original purpose.

When you are required to provide us with your data

In certain circumstances, you may be obliged to provide us with your personal data under a statutory or contractual requirement. This might include, but is not limited to, personal data we require to enter into an agreement with you or the business you work for; for tax and accounting purposes; and to enable us to fulfil our compliance and other obligations under relevant legislation or regulation. Failure to provide us with personal data required under a statutory or contractual requirement may prevent us from entering into or performing our obligations under a contract with you or your business.

When do we disclose your personal data?

We may share your personal data with third parties including the following:

• our clients (we offer services to both individual clients and corporate clients);
• group companies (including Magellan Holdings Limited, RJI Capital (UK) Limited and RJI Capital Corporation)including to allow communications between members of staff employed by different group companies;
• third party service providers (including any IT providers or parties assisting us in an investigation);
• other third parties we might have a relationship with (for example, if we are engaging a security partner on your behalf);
• government bodies and law enforcement agencies, including the HMRC, including in order to assist with any investigations;
• courts and tribunals including when we bring a claim or defend ourselves against a claim that requires the disclosure of personal data;
• our advisors, including accountants, auditors, lawyers and other external professional advisors; and
• third parties in the context of a sale or possible sale of the whole of or part of our business or the restructuring of our business.

International data transfers

We might transfer your personal data outside the UK and/or EEA from time to time for the purposes outlined in this privacy notice including when your personal data is shared with third parties or within our group of companies.

When we transfer your personal data to a country that is deemed not to provide equivalent level of protection as that provided in the UK and/or EEA, if required, we implement appropriate safeguards for the transfer including the European Commission standard contractual clauses and the UK addendum to the European Commission standard contractual clauses.

How long do we retain your personal data for?

We only retain personal data for as long as is reasonably necessary in order to fulfil the purposes we collect it for, including for the purposes of satisfying any contractual requirements or other legal, accounting, or reporting requirements.

To determine the appropriate retention period for your personal data, we consider the purposes for which we process the personal data, the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, whether we can achieve those purposes through other means and the applicable legal requirements. We may also retain your information as necessary to comply with our legal obligations, resolve disputes, maintain appropriate business records and enforce our agreements.

Your rights:

You may have the following rights under data protection legislation. If you have any questions about your rights, or you wish to exercise any of these rights, please email . We may require you to provide forms of identity should you wish to exercise one of your rights below.

Access: Upon request, you are entitled to confirmation of whether we process your personal data. Subject to exemptions, you are also entitled a copy of your personal data if we process it and certain supplemental information.

Rectification: If the personal data we hold about you is incorrect, you have the right for it to be rectified. You also have the right to ask us to complete information you think is incomplete.

Erasure: In certain circumstances, you have the right to ask us to erase your personal data.

Restriction: In certain circumstances, you have the right to ask us to restrict the processing of your personal data.

Objection: You may object to our processing of your personal data if our processing is carried out pursuant to our legitimate interests. Please note, however, that should we determine that our interests are so compelling as to override your objection we may continue to process your personal data.

Portability: You may have the right to receive some of your personal data in machine readable format.  This right extends to you being able to request that such data is sent to a third-party controller.

Withdrawing consent: If the lawful basis we rely on to process your personal data is consent you have the right to withdraw this consent. Please email us at info@arcanumglobal.com to withdraw consent for the processing of your personal data.

To withdraw your consent for the processing of your personal data by a third party, please contact that organisation.

Complaining to a supervisory authority: Further information about your rights can also be obtained from your national data protection regulator – in the UK, this is the ICO (https://ico.org.uk/). If you have any cause for complaint about our use of your personal data, you have the right to lodge a complaint with your national data protection supervisory authority, although we would ask that you contact us in the first instance.

Your right to be informed: You can contact us to find out more or to ask any questions you may have about our use of your personal data.

Some of these rights are subject to exceptions and are not absolute.

Appendix – Appropriate policy document

As part of its operations and as set out in this privacy notice, RJI Capital Corporation processes special category data and, in limited circumstances, criminal offence data.

Special category data is defined at Article 9 of the UK GDPR as personal data revealing:

• racial or ethnic origin;
• political opinions;
• religious or philosophical beliefs;
• trade union membership;
• genetic data;
• biometric data for the purpose of uniquely identifying a natural person;
• data concerning health; or
• data concerning a natural person’s sex life or sexual orientation.

Criminal offence data

Article 10 of the UK GDPR covers processing in relation to criminal convictions and offences or related security measures. In addition, section 11(2) of the Data Protection Act 2018 specifically confirms that this includes personal data relating to the alleged commission of offences or proceedings for an offence committed or alleged to have been committed, including sentencing. This is collectively referred to as ‘criminal offence data’.

Appropriate policy document requirement

Special category data and criminal offence data merit specific protection under data protection law.

In some cases, and in relation to the processing of special category data and criminal offence data under the conditions set out above, Schedule 1 of the Data Protection Act 2018 dictates that our policies meet certain requirements which are sometimes included in a separate document called an ‘appropriate policy document’.

This Appendix seeks, in conjunction with the privacy notice above and RJI Capital Corporation’s internal data retention policy, to ensure that RJI Capital Corporation complies with these requirements and provides all the information required under an appropriate policy document.

Data protection principles

Lawfulness, fairness and transparency: RJI Capital Corporation has identified an appropriate lawful basis for the processing of special category personal data under Article 6 of the GDPR and, when required, an appropriate lawful basis under Article 9 of the UK GDPR and/or a further Schedule 1 condition under the Data Protection Act 2018.

RJI Capital Corporation has identified an appropriate lawful basis for the processing of criminal offence data under Article 6 of the UK GDPR and a further Schedule 1 condition under the Data Protection Act 2018.

Information on the lawful bases and conditions RJI Capital Corporation relies on is provided in the privacy notice above.

RJI Capital Corporation has provided an appropriate description of its data processing activities involving special category data and criminal offence data in the privacy notice above.

RJI Capital Corporation makes its privacy notice available on its website.

Purpose limitation: RJI Capital Corporation has identified the purposes of processing special category and criminal offence data as set out in the section titled ‘How do we use your personal data?’ in the privacy notice above.

RJI Capital Corporation does not currently plan on using special category or criminal offence data for any other purposes. However, if RJI Capital Corporation needs to process such personal data for a new purpose, RJI Capital Corporation will: (i) ensure the new purpose is compatible with the original purpose; (ii) get data subject consent; or (iii) the use of the data for a new purpose will be carried out under a clear legal provision.

Data minimisation: RJI Capital Corporation is committed to only collecting personal data which is adequate, relevant and limited to what is necessary to achieve the purposes at hand. RJI Capital Corporation will be periodically reviewing the personal data processed by RJI Capital Corporation and will be deleting anything that is no longer required in accordance with RJI Capital Corporation’s internal data retention policy.

Accuracy: When RJI Capital Corporation collects personal data, RJI Capital Corporation takes steps to ensure that personal data is accurate at the point of collection and, in the event RJI Capital Corporation subsequently becomes aware that personal data is inaccurate or out of date, to ensure that data is erased or rectified without delay. Individuals are legally entitled to request that any incorrect personal data we hold about them is appropriately rectified.

Storage Limitation, data retention and deletion: Personal data will not be kept longer in a form that permits identification of individuals for any longer than necessary for the purposes for which they are processed. We will determine and apply specific data retention periods for different types of personal data based on any statutory retention periods that apply and otherwise taking into account the purpose of retaining the data, for example, in relation to the bringing or defending of legal claims.

For more information on RJI Capital Corporation’s data retention criteria please see the section titled ‘How long do we retain your personal data for?’ above. RJI Capital Corporation has an internal data retention policy which it periodically reviews and updates.

Integrity and confidentiality: Personal data will be processed in a manner that ensures an appropriate degree of security, including implementing appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage.

Accountability principle: RJI Capital Corporation is under an obligation to comply with the principles set out above and to demonstrate compliance with these principles. RJI Capital Corporation maintains appropriate records, policies and procedures relating to its data processing activities.